Technical Information
Malicious functions:
Kills system processes:
- sshd
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:23
- 0.0.0.0:22
- 0.0.0.0:80
Establishes connection:
- 8.#.8.8:53
- 82.###.234.75:80
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- 82.##8.234.75
Sends data to the following servers:
- 82.###.234.75:80
- 24#.##4.214.180:23
- 12#.##0.117.97:23
- 11#.##4.165.149:23
- 10#.##4.246.84:23
- 20#.##9.118.90:23
- 17#.##0.235.69:23
- 15#.##8.225.140:23
- 23#.#6.63.48:23
- 17#.##9.22.141:23
- 16.###.20.195:23
- 13.###.161.126:23
- 22#.##0.244.136:23