Technical Information
Malicious functions:
Removes itself
Substitutes application name for:
- [procManager]
Network activity:
Establishes connection:
- 8.#.8.8:53
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Connects to the following servers over the IRC protocol:
- Server: 18#.#44.25.177; Command: NICK [SEIZE|x86_32]ZGIYYPA\nUSER vamp localhost localhost :kebs4head\n
- Server: 18#.#44.25.177; Command: PONG :8C33305E\n
- Server: 18#.#44.25.177; Command: PONG :F2011290\n
- Server: 18#.#44.25.177; Command: PONG :29270C74\n
- Server: 18#.#44.25.177; Command: PONG :C35C823B\n