Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- ZmYzZIBVZZDEI24RBREV0EB0MpRZYGGRzVznxuZM0i420uGWiu4RiWzERZ4p2GEYW0DnBB
Kills the following processes:
- <SAMPLE>
- Unknown process with PID: 4294966612
Network activity:
Establishes connection:
- 8.#.8.8:53
- 19#.###.194.242:63042
DNS ASK:
- lo###ngxd.xyz
Sends data to the following servers:
- 65.#.0.99:23
- 17.##.109.99:23
- 15#.##1.93.14:23
- 86.##.234.109:23
Receives data from the following servers:
- 19#.###.194.242:63042
