Technical Information
Malicious functions:
Launches itself as a daemon
Kills system processes:
- sshd
Kills the following processes:
- <SAMPLE>
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:57886
Establishes connection:
- 8.#.8.8:53
- 68.###.157.144:37212
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##.213.245:37215
- 19#.###.249.245:37215
- 15#.##6.7.112:37215
- 19#.###.240.244:37215
- 41.###.175.99:37215
- 19#.###.150.95:37215
- 19#.##.143.223:37215
- 15#.##.150.203:37215
- 15#.##.252.71:37215
- 19#.##7.29.90:37215
- 41.###.64.33:37215
- 19#.##.60.38:37215
- 41.##.80.179:37215
- 19#.###.240.194:37215
- 41.##.18.246:37215
- 19#.###.180.38:37215
- 15#.###.124.55:37215
- 15#.##.205.80:37215
- 19#.##5.25.76:37215
- 19#.##.49.151:37215
- 68.###.157.144:37212
- 41.##.10.21:37215
- 41.##.225.35:37215
- 15#.###.250.112:37215
- 15#.###.213.201:37215
- 41.###.94.110:37215
- 41.###.47.69:37215
- 41.##.214.43:37215
- 19#.##.200.219:37215
- 19#.#.48.176:37215
- 19#.##.162.9:37215
- 41.##.70.28:37215
- 15#.##.129.206:37215
- 15#.###.86.153:37215
- 15#.##.184.58:37215
- 41.##.50.234:37215
- 15#.##3.60.22:37215
- 19#.##6.58.12:37215
- 19#.###.185.81:37215
- 19#.##.186.179:37215
- 19#.###.205.237:37215
- 15#.###.218.60:37215
- 15#.###.105.222:37215
- 15#.###.215.98:37215
- 41.##.21.15:37215
- 41.###.246.123:37215
- 19#.##.218.43:37215
- 41.##.33.9:37215
- 41.##.126.13:37215
- 41.###.34.157:37215
- 15#.###.131.231:37215
- 41.###.168.234:37215
- 19#.##.102.113:37215
- 19#.###.141.169:37215
- 41.###.243.34:37215
- 41.##.63.33:37215
- 15#.###.52.174:37215
- 41.##.221.159:37215
- 41.###.150.14:37215
- 19#.##.217.205:37215
- 19#.##.198.94:37215
- 15#.##.37.254:37215
- 15#.##8.79.82:37215
- 41.###.103.37:37215
- 15#.##.224.152:37215
- 41.###.10.121:37215
- 41.###.59.243:37215
- 19#.##.92.230:37215
- 15#.##.243.103:37215
- 19#.###.138.188:37215
- 41.###.190.173:37215
- 15#.###.231.163:37215
- 15#.###.103.156:37215
- 15#.###.233.153:37215
- 15#.##4.50.44:37215
- 41.###.143.166:37215
- 15#.##6.68.3:37215
- 41.#.#54.52:37215
- 41.###.235.199:37215
- 15#.###.121.185:37215
- 41.###.105.126:37215
- 19#.###.75.233:37215
- 15#.##.102.23:37215
- 15#.###.232.207:37215
- 41.###.203.110:37215
- 41.###.25.194:37215
- 15#.##.91.112:37215
- 15#.##.92.181:37215
- 41.###.187.27:37215
- 41.###.99.143:37215
- 19#.##.66.173:37215
- 15#.##.41.25:37215
- 15#.##.59.14:37215
- 41.##.7.200:37215
- 15#.##.205.61:37215
- 19#.#.48.199:37215
- 19#.##.147.237:37215
- 19#.##.178.181:37215
- 15#.##.47.82:37215
- 15#.###.84.201:37215
- 41.##.185.185:37215
- 15#.##.36.55:37215
- 19#.###.174.67:37215
- 41.#.#3.40:37215
- 19#.###.16.186:37215
- 41.###.134.26:37215
- 15#.###.155.165:37215
- 41.##.58.162:37215
- 41.###.30.183:37215
- 15#.#.37.228:37215
- 15#.##9.1.137:37215
- 19#.##.1.23:37215
- 41.##.240.246:37215
- 19#.###.84.145:37215
- 41.###.234.211:37215
- 41.##.124.207:37215
- 19#.##.11.104:37215
- 15#.###.116.107:37215
- 41.###.220.127:37215
- 19#.##.87.244:37215
- 41.##.198.80:37215
- 19#.###.161.140:37215
- 15#.#.36.139:37215
- 15#.##3.154.8:37215
- 19#.##.178.202:37215
- 15#.###.99.254:37215
- 41.###.154.157:37215
- 15#.##.236.211:37215
- 41.##.29.57:37215
Receives data from the following servers:
- 68.###.157.144:37212
Other:
Collects information about network activity