Technical Information
Malicious functions:
Removes itself
Substitutes application name for:
- A3WtjHCMKKcjBMKvujwndtNlQN4KBcMewoaNaoXNtAdv68xaNNtMMacA6roc2AlnvrNwjW1QQAKMMeK4A3N3AQjRoCtHbeCtjbpQWopXW26jKCcbxW2vj62tbK27jteNy67nMoWloe
Kills the following processes:
- <SAMPLE>
Network activity:
Awaits incoming connections on ports:
- 19#.###.217.50:56242
Establishes connection:
- 8.#.8.8:53
- 19#.##.119.207:34255
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- sk##ine.wtf
