Technical Information
Malicious functions:
Substitutes application name for:
- bitcoin-scheduler
- bitcoin-http
- bitcoin-httpworker
- bitcoin-loadblk
- bitcoin-torcontrol
- bitcoin-dnsseed
- bitcoin-addcon
- bitcoin-net
- bitcoin-opencon
- bitcoin-msghand
- bitcoin-wallet
Performs operations with the file system:
Creates folders:
- /root/.bitcoin
- /root/.bitcoin/database
- /root/.bitcoin/blocks
- /root/.bitcoin/blocks/index
- /root/.bitcoin/chainstate
Creates or modifies files:
- /root/.bitcoin/.lock
- /root/.bitcoin/bitcoind.pid
- /root/.bitcoin/debug.log
- /root/.bitcoin/.cookie
- /root/.bitcoin/db.log
- /root/.bitcoin/blocks/index/LOG
- /root/.bitcoin/blocks/index/LOCK
- /root/.bitcoin/blocks/index/MANIFEST-000001
- /root/.bitcoin/blocks/index/000001.dbtmp
- /root/.bitcoin/blocks/index/000003.log
- /root/.bitcoin/blocks/index/MANIFEST-000002
- /root/.bitcoin/blocks/index/000002.dbtmp
- /root/.bitcoin/chainstate/LOG
- /root/.bitcoin/chainstate/LOCK
- /root/.bitcoin/chainstate/MANIFEST-000001
- /root/.bitcoin/chainstate/000001.dbtmp
- /root/.bitcoin/chainstate/000003.log
- /root/.bitcoin/chainstate/MANIFEST-000002
- /root/.bitcoin/chainstate/000002.dbtmp
- /root/.bitcoin/blocks/blk00000.dat
- /root/.bitcoin/blocks/rev00000.dat
- /root/.bitcoin/database/log.0000000001
- /root/.bitcoin/__db.80000001.f192274a
- /root/.bitcoin/wallet.dat
Deletes files:
- /root/.bitcoin/blocks/index/MANIFEST-000001"
- /root/.bitcoin/chainstate/MANIFEST-000001"
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:8332
- 0.0.0.0:8333
Establishes connection:
- 127.0.0.1:9051
- <LOCAL_DNS_SERVER>
- 47.##.57.145:0
- 10#.#5.38.181:0
- 10#.##6.161.94:0
- 54.##.6.125:0
- 47.##.188.64:0
- 13.##.124.112:0
- 13.##.168.64:0
- 12#.#6.203.53:0
- 10#.#4.105.65:0
- 11#.#3.172.14:0
- 14#.#.43.37:0
- 47.##.4.116:0
- 46.##1.48.183:0
- 11#.#3.161.10:0
- 10#.##.105.103:0
- 11#.##.173.212:0
- 35.###.101.254:0
- 69.##.148.54:0
- 45.##.142.99:0
- 10#.##2.25.119:0
- 47.##.36.250:0
- 47.##.57.68:0
- 71.##.211.251:0
- [2##########001:4a1:5400:ff:fe77:3d4e]:0
- [2##########400:4b17:5400:ff:fe77:6883]:0
- [2#########8:78cf:3c6e:16e:433f:4b87]:0
- [2#########5:79fb:28b1:7b7:ba62:cb8d]:0
- [2##########801:2b6:5400:ff:fe76:65ae]:0
- [2##########:6ab8:2cfe:21d5:4d32:96f0]:0
- [2##########:6ab8:3cb8:277a:bd18:6545]:0
- [2##########001:e1b:5400:ff:fe76:65ad]:0
- [2#########8:78cf:4a4:19:4650:c241]:0
- [2##########:79fb:247b:1da4:ba53:51ea]:0
- [2#########b8c:1:225:90ff:fe54:5306]:0
- [2##########801:5ba:5400:ff:fe77:3d4f]:0
- [2######80:1:a::236:1]:0
- 10#.#8.25.45:0
- 10#.#8.24.45:0
- [2#######0:2048:1::681c:192d]:0
- [2#######0:2048:1::681c:182d]:0
- 10#.##.105.103:8333
- 11#.##.161.10:8333
- 10#.##6.161.94:8333
- [2###########00:b320:99a9:9e18:74d6:d1b]:8333
- [2#######:c280:1cf0::a]:8333
- [2##########:78cf:2c79:2460:b071:3b14]:8333
- 49.##.165.225:8333
- 49.##.222.26:8333
- 65.##.19.49:8333
- 24.###.95.147:8333
DNS ASK:
- bt#########der.bitcoinunlimited.info
- bi#####unlimited.info
- se##.#itcoinabc.org
Sends data to the following servers:
- 10#.##.105.103:8333
- 11#.##.161.10:8333
- 10#.##6.161.94:8333
- 49.##.165.225:8333
- 49.##.222.26:8333
- 65.##.19.49:8333
- 24.###.95.147:8333
Receives data from the following servers:
- 127.0.0.1:9051
- 10#.##.105.103:8333
- 11#.##.161.10:8333
- 10#.##6.161.94:8333
- 49.##.222.26:8333
- 65.##.19.49:8333
- 24.###.95.147:8333
Other:
Collects CPU information
Collects RAM information