Technical Information
Malicious functions:
Launches itself as a daemon
Kills system processes:
- sshd
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:22
- 0.0.0.0:8625
Establishes connection:
- 21#.##.9.21:8812
HTTP GET requests:
- 21#.##.###.########?bid=eth0-192.168.206.50-52540123456:204726&sp=8625
- 62.###.#55.28/sn3d7kw2ib
- my###.#erokuapp.com/
DNS ASK:
- go##le.com
- fa###ook.com
- ba##u.com
- am##on.com
- wi###edia.org
Sends data to the following servers:
- 21#.##.9.21:8812
Receives data from the following servers:
- 21#.##.9.21:8812