Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- 3gquret3fw4i
Performs process tracing:
- swapper/0
Kills the following processes:
- run.sh
- bash
- 3gquret3fw4i
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:8345
Establishes connection:
- 8.#.8.8:53
- 1.#.0.1:53
- 21#.##.149.10:35342
DNS ASK:
- se#.#######cyber-security-rebirthltd.su
Sends data to the following servers:
- 41.##.70.25:37215
- 41.##.195.100:37215
- 15#.##.237.24:37215
- 19#.###.111.183:37215
- 19#.###.214.185:37215
- 41.###.198.41:37215
- 41.###.113.175:37215
- 41.##.236.204:37215
- 17#.##.132.116:37215
- 41.##.252.252:37215
- 41.##.139.198:37215
- 15#.###.122.185:37215
- 19#.##9.77.41:37215
- 15#.##.160.116:37215
- 41.###.13.20:37215
- 41.###.62.57:37215
- 19#.###.77.149:37215
- 15#.###.188.100:37215
- 41.###.5.188:37215
- 41.###.46.124:37215
- 41.###.143.140:37215
- 41.###.186.120:37215
- 41.###.37.141:37215
- 19#.##.18.0:37215
- 41.###.245.137:37215
- 9.##.#1.131:37215
- 15#.###.246.221:37215
- 41.###.210.68:37215
- 41.###.229.11:37215
- 41.##.253.204:37215
- 41.##.170.169:37215
- 15#.#.82.26:37215
- 15#.###.51.234:37215
- 41.###.73.220:37215
- 41.###.44.201:37215
- 17#.##.141.210:37215
- 41.#.#51.228:37215
- 15#.##1.25.99:37215
- 19#.###.124.138:37215
- 41.###.215.181:37215
- 19#.###.145.129:37215
- 18#.###.120.223:37215
- 19#.##.248.198:37215
- 19#.###.47.123:37215
- 41.#.#8.195:37215
- 41.##.19.182:37215
- 15#.###.234.178:37215
- 15#.##.183.101:37215
- 15#.###.169.198:37215
- 44.###.125.145:37215
- 84.###.223.71:37215
- 20#.###.145.47:37215
- 15#.###.182.61:37215
- 41.##.212.213:37215
- 41.##.209.207:37215
- 25.##.114.69:37215
- 19#.###.23.211:37215
- 41.##.144.51:37215
- 4.##.#9.100:37215
- 62.##.206.52:37215
- 15#.###.162.143:37215
- 19#.###.119.171:37215
- 41.###.144.204:37215
- 97.##.180.128:37215
- 41.###.59.56:37215
- 13#.##.186.50:37215
- 41.#.#01.244:37215
- 41.##.107.20:37215
- 15#.###.221.216:37215
- 18#.###.145.151:37215
- 21#.##0.77.24:37215
- 41.##.169.13:37215
- 15#.###.242.103:37215
- 18.###.215.48:37215
- 41.###.18.200:37215
- 41.##.236.179:37215
- 97.###.154.246:37215
- 38.###.29.163:37215
- 15#.##.104.30:37215
- 15#.##3.99.77:37215
- 15#.##4.87.83:37215
- 20#.###.211.161:37215
- 13#.###.184.188:37215
- 41.###.165.228:37215
- 41.##.211.248:37215
- 12#.###.113.243:37215
- 41.###.201.20:37215
- 13#.##.192.248:37215
- 15#.#.213.240:37215
- 19#.##.79.90:37215
- 41.###.75.119:37215
- 41.##.25.239:37215
- 19#.##.193.153:37215
- 15#.##.49.59:37215
- 19#.###.146.179:37215
- 19#.###.37.166:37215
- 41.##.218.165:37215
- 21#.##.149.10:35342
Receives data from the following servers:
- 21#.##.149.10:35342
