Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- f2j00bub3u2d
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:2174
Establishes connection:
- 8.#.8.8:53
- 17#.##4.22.166:53
- 13#.##2.21.97:8745
- 81.###.136.222:53
- 17#.###.24.104:38441
- 19#.##.195.195:53
- 17#.##2.24.104:4444
- 13#.#95.4.2:53
- 19#.##.209.234:4200
- 94.##.114.254:53
- 19#.##.222.61:2474
- 85.##.244.49:4444
- 51.###.108.203:53
- 19#.##.209.234:3257
- 19#.##.222.61:5555
- 19#.##.222.61:8745
- 51.##.149.139:53
- 85.##.244.49:3333
- 19#.##.144.87:53
- 19#.##.209.234:38441
- 51.###.162.59:53
- 19#.##.209.234:0
- 17#.##2.24.104:8745
- 19#.##.222.61:8932
- 85.##.244.49:24811
- 19#.##.209.234:2222
- 13#.##2.21.97:7214
- 85.##.244.49:2222
DNS ASK:
- ku####klan.libre
Sends data to the following servers:
- 19#.#6.209.234
