Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- vsljxmhxoy53g2pfapvka
- jzsyp1eujzje0ruv4qod
- fbiueov0zeg10ucrc2a320
- wgvqfkxf3zzptl3hvjmf
- q0osudlip21gc2gv10v5ztb
- rmspmo0wgoivkd2lo5hpn5k
- epbwgdgv4wy0td5ev4ehqdf
- fyfpovz211qcood4dy5u
- errvkbkfcrkyfyyz3lwfs
- mnxrl5et4qopjpcnbtc0rm22
- ikz3ijxadwgi4w3iupjveu4l
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.211.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.18:4321
- 5.###.227.18:7685
