Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Performs operations with the file system:
Mounts file systems:
- /
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:1122
Establishes connection:
- 19#.##.195.195:53
- 89.##.41.75:2533
- 17#.##4.22.166:53
- 20#.##.197.122:53
- 89.##.41.74:16618
- 80.###.203.134:53
- 65.##.1.106:53
- 45.##.43.45:3856
- 16#.##5.111.72:53
- 5.###.109.23:53
- 19#.##.191.19:20149
- 45.##.49.203:53
- 45.##.43.45:20854
- 21#.##0.70.42:53
- 18#.###.123.68:10787
- 94.###.43.254:53
- 89.##.41.75:17246
DNS ASK:
- wh####am.gophher
- io####cher.pirate
- cl####latform.dyn
Sends data to the following servers:
- 17#.##4.22.166:53
- 80.###.203.134:53
- 45.##.43.45:3856
- 16#.##5.111.72:53
- 5.###.109.23:53
- 19#.##.191.19:20149
- 45.##.49.203:53
- 45.##.43.45:20854
- 18#.###.123.68:10787
Receives data from the following servers:
- 17#.##4.22.166:53
- 80.###.203.134:53
- 45.##.43.45:3856
- 16#.##5.111.72:53
- 5.###.109.23:53
- 19#.##.191.19:20149
- 45.##.49.203:53
- 45.##.43.45:20854
- 18#.###.123.68:10787