Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- zzsaoaapdnmvmidutzxmb
- r54an0uzxefiqjpmwegd13xl
- h5oavswgi2gpjyrfb5imz0ur
- 0vjs02kdocvho2pksubye1l
- rtygc3iu1w5yedjspp3exh
- ufnjywwvjxcrq3riqtr1a2
- abeqahprygci3zq3hdbo
- ldeuc1tnmqzgs5xvxbt3
- c14y2ykwnd2aml4hxcekcqqn
- qhgtefo53xgzsyzp3v3xjmn
- yzugmk5qivtc40nmxqkmme
- lsam0fdwiy4wfpefcl1ube
- nbvrsi212l3fgd2kgwnn
- ztsril11dhv3oqvmootxufn
- o5hxnxpskpdmecsodvs5
- rqychisx1srnxuiij0kzp
- hbdhqpz3tey5slz0hai5kfi
- 2hnkgd5fkh3p1yexghuilbgg
- w4quppj5lporhikn335cjojg
- 3bthbprrnbsd4hj2uoepb
- vpcwyw1etblktax5gjdrnr
- jhqihpiuzz4b1qd1f0pos1o
- ipvzrqns21tpu5psgfi20mx
- dpa24wlvywsikvv30ykq5unq
- qtld0bg2ciebdmnztocpixv5
- gvzbyodn5dlcx201z21zhtkj
- mr0nq5z1u1lpdl4ahngo4nk
- foy5cszsd14n3drmujroeui
- hdflvaup53vgpa14dm5rtb
- btajtv1leeprvobt42enyr2o
- jzxa5ue5fuyghqki1yni
- g0swookwidt0xlt2oi5v1da
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.212.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.18:4321
- 5.###.227.18:7685
