Technical Information
Malicious functions:
Launches itself as a daemon
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Creates folders:
- /root/files
Creates or modifies files:
- /root/login2
- /root/daemon.log
- <SAMPLE_FULL_PATH>.pid
Deletes files:
- /root/list2
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:1337
- 0.0.0.0:9000
Establishes connection:
- <LOCAL_DNS_SERVER>
- 40.###.200.201:443
- 10#.##4.42.193:443
- 10#.##4.42.1:443
- 15#.##1.245.140:443
- 94.###.180.39:443
Attacks using a special dictionary (brute-force technique) via the SSH protocol
DNS ASK:
- mi###soft.com
- tw##ter.com
- ww#.#eddit.com
- my.#ail.ru
Sends data to the following servers:
- 40.###.200.201:443
- 10#.##4.42.193:443
- 10#.##4.42.1:443
- 15#.##1.245.140:443
- 94.###.180.39:443
Receives data from the following servers:
- 40.###.200.201:443
- 10#.##4.42.193:443
- 10#.##4.42.1:443
- 15#.##1.245.140:443
- 94.###.180.39:443