Technical Information
Malicious functions:
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Deletes folders:
- /var/run/.lightscan"
Creates or modifies files:
- /run/.lightpid
Network activity:
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Connects to the following servers over the IRC protocol:
- Server: 21#.#09.222.122; Command: PASS fuckya\n
- Server: 21#.#09.222.122; Command: NICK [MS]smfdqqavaj\n
- Server: 21#.#09.222.122; Command: USER FOR FREE localhost :G66K ;)\n
- Server: 21#.#09.222.122; Command: TOPIC #g66k\n
- Server: 21#.#09.222.122; Command: PONG :989A2211
- Server: 21#.#09.222.122; Command: JOIN #g66k :key\n
- Server: 21#.#09.222.122; Command: NOTICE #g66k :[advscan] scanning range: 18#.51.0.0/16 (user:admin pass:admin). wait..\n
- Server: 21#.#09.222.122; Command: PONG 366
- Server: 21#.#09.222.122; Command: PONG PRIVMSG
- Server: 21#.#09.222.122; Command: PONG NOTICE