Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- tokio-runtime-w
Launches processes:
- chmod +x /tmp/ISW0O8B66G
Performs operations with the file system:
Modifies file access rights:
- /tmp/ISW0O8B66G
Creates or modifies files:
- /tmp/ISW0O8B66G
Network activity:
Establishes connection:
- 52.###.112.114:80
DNS ASK:
- as######b.s3.amazonaws.com
Sends data to the following servers:
- 52.###.112.114:80
Receives data from the following servers:
- 52.###.112.114:80