Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- 45fk7uscfjknhd8j0c1o
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Creates or modifies files:
- /sys/.sen
- /proc/.sen
- /dev/.sen
- /dev/.2wrja6rj
- /usr/bin/busybox
Deletes files:
- /.sen
- /.2wrja6rj
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:60912
- 0.0.0.0:47292
Establishes connection:
- 8.#.8.8:53
DNS ASK:
- go##le.com
Sends data to the following servers:
- <LOCAL_GATE>:1900
