Technical Information
Malicious functions:
Launches processes:
- sh -c mkdir \"/log\" > /dev/null 2>&1
- mkdir /log
- uname -a
- sh -c route | grep default | grep -v grep
- grep -v grep
- route
- grep default
Performs operations with the file system:
Creates folders:
- /log
Creates or modifies files:
- //bin/.xCloudClientRunOne.pid
- /bin/.xCloudClientRunOne.pid
- /etc/xCloud.db
- /log/Log.txt
- /bin/.version
- /etc/xCloud.db-journal
- /bin/.pid
Deletes files:
- /etc/xCloud.db-wal
- /etc/xCloud.db-journal
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:61617
- 0.0.0.0:15008
Establishes connection:
- <LOCAL_DNS_SERVER>
DNS ASK:
- 1.###.##8.192.in-addr.arpa
Sends data to the following servers:
- 23#.###.255.250:1900
- <LOCAL_DNS_SERVER>
Receives data from the following servers:
- <LOCAL_DNS_SERVER>
Other:
Collects CPU information
