Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- h0orr08c3qrn
Modifies firewall settings:
- iptables -A INPUT -p tcp --dport 22 -j DROP
Operates the following engine modules:
- err
Launches processes:
- sh -c iptables -A INPUT -p tcp --dport 22 -j DROP
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:48101
- 0.0.0.0:7152
DNS ASK:
- ti##.#sia.apple.com
- s2#.#ill123.com
Sends data to the following servers:
- 17.###.34.253:123
