Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:3902
Establishes connection:
- <LOCAL_DNS_SERVER>
- 95.###.62.169:5600
HTTP GET requests:
- http://##.##.244.61/
Sends data to the following servers:
- 33.##.215.152:80
- 13#.##.152.200:80
- 40.###.179.213:80
- 11#.##2.150.230:80
- 22#.#3.7.171:80
- 16#.##.179.149:80
- 21#.##5.93.11:80
- 24#.##2.74.168:80
- 15#.##0.248.28:80
- 81.###.230.85:80
- 20.##.6.147:80
- 23#.#.172.249:80
- 17#.##3.51.235:80
- 42.###.155.50:80
- 19#.##5.206.187:80
- 91.##.56.27:80
- 14#.##.157.220:80
- 11#.##.143.134:80
- 28.#.154.49:80
- 18.##.34.249:80
- 57.##.43.144:80
- 1.##.99.118:80
- 99.###.158.243:80
- 25#.#2.97.62:80
- 24#.##4.52.75:80
- 90.###.207.152:80
- 15#.##.179.67:80
- 47.##2.189.0:80
- 25#.##1.107.175:80
- 88.###.59.198:80
- 67.##6.169.8:80
- 11.##.98.63:80
- 82.###.230.214:80
- 43.###.147.227:80
- 23#.##9.41.61:80
- 9.##.176.244:80
- 55.##.145.62:80
- 23#.#38.4.0:80
- 13#.##9.153.52:80
- 67.##.73.70:80
- 21#.##4.191.180:80
- 86.##.231.64:80
- 10#.##.111.34:80
- 10#.##4.76.225:80
- 23#.##6.130.220:80
- 49.##.24.54:80
- 24#.##1.198.93:80
- 17#.##9.231.123:80
- 16#.##9.182.246:80
- 15#.##6.0.245:80
- 14#.##4.15.233:80
- 19#.##0.235.67:80
- 12#.##.229.243:80
- 4.##.219.54:80
- 15#.##7.241.74:80
- 24#.##2.193.171:80
- 17#.##9.56.40:80
- 1.###.143.245:80
- 17#.##.93.125:80
- 68.###.230.106:80
- 23.###.167.77:80
- 69.###.48.124:80
- 87.###.226.50:80
- 15#.##1.0.153:80
- 20#.##0.91.127:80
- 15#.##4.238.46:80
- 46.###.95.177:80
- 16#.##4.147.26:80
- 60.##.183.129:80
- 78.###.159.166:80
- 33.##.38.128:80
- 10#.#4.8.26:80
- 16#.#5.0.127:80
- 33.###.221.174:80
- 19#.##2.132.101:80
- 16.##.197.60:80
- 15#.##.54.195:80
- 61.##.119.123:80
- 94.###.81.176:80
- 16.##.2.158:80
- 46.##.177.175:80
- 13#.##3.79.80:80
- 89.##.37.132:80
- 13#.##2.201.112:80
- 24#.##.174.182:80
- 22#.##.115.207:80
- 21.##.183.211:80
- 55.##1.69.93:80
- 11#.##.164.205:80
- 30.###.166.93:80
- 17#.##3.102.197:80
- 98.###.203.207:80
- 16#.##7.128.91:80
- 18#.##4.102.122:80
- 15#.##3.88.96:80
- 14#.##.118.88:80
- 18#.##5.125.240:80
- 16#.##.248.97:80
- 13#.##7.52.52:80
- 10#.##.132.239:80
- 45.###.118.243:80
- 3.#.#84.178:80
- 15#.##7.246.117:80
- 70.##.192.79:80
- 23#.##.227.207:80
- 30.###.73.121:80
- 10#.##3.98.84:80
- 19#.##9.170.33:80
- 77.##.213.104:80
- 19#.##2.152.26:80
- 73.###.132.92:80
- 23#.##.130.67:80
- 10#.#.102.14:80
- 24#.##5.117.1:80
- 29.##.45.60:80
- 12#.#16.2.28:80
- 72.#.238.49:80
- 14#.##.204.129:80
- 60.##3.7.249:80
- 24#.##.59.185:80
- 28.##.138.108:80
- 14.###.190.95:80
- 15.###.121.97:80
- 14#.##.191.213:80
- 27.##.221.218:80
- 14#.##4.182.106:80
- 10#.##7.81.32:80
- 29.##.24.254:80
- 19#.##.44.133:80
- 13#.##9.203.121:80
- 21#.##.228.135:80
- 10#.##8.39.124:80
- 39.##.220.189:80
- 18#.##2.211.231:80
- 13#.##0.69.141:80
- 14#.##4.197.57:80
- 84.##1.45.97:80
- 67.##.129.32:80
- 33.###.35.168:80
- 71.###.78.138:80
- 70.##.32.228:80
- 77.###.70.117:80
- 19#.##.50.159:80
- 97.###.222.56:80
- 2.###.103.83:80
- 24#.##.118.96:80
- 4.##.81.198:80
- 16#.##.97.149:80
- 82.###.125.227:80
- 22#.##0.119.176:80
- 15#.##0.73.225:80
- 23.##.224.95:80
- 15#.##.238.118:80
- 13#.##8.175.188:80
- 78.##7.163.7:80
- 21#.#.0.153:80
- 13#.##.180.213:80
- 15#.#.167.52:80
- 20.##.166.227:80
