Technical Information
Malicious functions:
Substitutes application name for:
- FLSa4dMoaqoZkMq64rf6ER2W5rIa
Kills system processes:
- sshd
Kills the following processes:
- exim4
- bash
- run.sh
- <SAMPLE>
Network activity:
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Connects to the following servers over the IRC protocol:
- Server: 37.##.225.230; Command: NICK [KTN|MIPSEL]OCLKD\nUSER ktn localhost localhost :UTSEVC\n
- Server: 37.##.225.230; Command: PONG :A5FB3546\n
- Server: 37.##.225.230; Command: MODE OCLKD -xi\n
- Server: 37.##.225.230; Command: JOIN #ktx :\n
- Server: 37.##.225.230; Command: WHO OCLKD\n