Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- sh -c pkill -9 Josho.*
- pkill -9 Josho.*
- sh -c pkill -9 \"Josho.*\"
- sh -c /bin/busybox kill -9 Josho.*
- /bin/busybox kill -9 Josho.*
- sh -c /bin/busybox kill -9 \"Josho.*\"
- sh -c pkill -9 Owari.*
- pkill -9 Owari.*
- sh -c pkill -9 \"Owari.*\"
- sh -c /bin/busybox kill -9 Owari.*
- /bin/busybox kill -9 Owari.*
- sh -c /bin/busybox kill -9 \"Owari.*\"
- sh -c pkill -9 yakuza.*
- pkill -9 yakuza.*
- sh -c pkill -9 \"yakuza.*\"
- sh -c /bin/busybox kill -9 yakuza.*
- /bin/busybox kill -9 yakuza.*
- sh -c /bin/busybox kill -9 \"yakuza.*\"
- sh -c pkill -9 *.yakuza
- pkill -9 *.yakuza
- sh -c pkill -9 \"*.yakuza\"
- sh -c /bin/busybox kill -9 *.yakuza
- /bin/busybox kill -9 *.yakuza
Network activity:
Establishes connection:
- 8.#.8.8:53
- 13#.###.162.161:1337
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 13#.###.162.161:1337
Receives data from the following servers:
- 13#.###.162.161:1337
Other:
Collects CPU information