Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- /bin/busybox
Kills the following processes:
- <SAMPLE>
- agetty
- /bin/busybox
- exim4
- bash
Network activity:
Establishes connection:
- 19#.##.97.85:9090
- 15#.###.170.48:37215
- 19#.##0.78.86:37215
- 15#.###.156.212:37215
- 15#.##.96.91:37215
- 41.##.111.30:37215
- 19#.##.96.181:37215
- 41.##.99.5:37215
- 19#.###.108.228:37215
- 19#.##.35.190:37215
- 41.###.219.88:37215
- 15#.###.131.153:37215
- 41.###.106.243:37215
- 15#.##.243.216:37215
- 15#.##.159.71:37215
- 15#.###.30.164:37215
- 41.###.120.186:37215
- 41.###.2.27:37215
- 15#.###.193.253:37215
- 15#.##.36.223:37215
- 41.##.26.243:37215
- 41.###.144.71:37215
- 41.###.255.78:37215
- 41.##.34.154:37215
- 41.##.198.183:37215
- 15#.##.202.218:37215
- 19#.###.192.48:37215
- 41.###.57.206:37215
- 19#.##.123.236:37215
- 15#.###.157.16:37215
- 41.##.138.184:37215
- 15#.##.25.28:37215
- 41.#.#11.136:37215
- 41.##.151.166:37215
- 41.##.243.238:37215
- 41.###.92.194:37215
- 19#.##5.180.7:37215
- 19#.###.96.190:37215
- 41.###.103.228:37215
- 15#.###.139.198:37215
- 19#.###.67.171:37215
- 19#.##9.14.79:37215
- 19#.##.154.90:37215
- 41.###.183.69:37215
- 15#.##4.211.6:37215
- 41.##.95.151:37215
- 41.##.176.240:37215
- 19#.###.66.181:37215
- 19#.###.117.248:37215
- 15#.##4.39.18:37215
- 19#.##.64.71:37215
- 19#.##.165.51:37215
- 41.##.55.99:37215
- 15#.###.42.120:37215
- 41.#.#69.46:37215
- 41.###.212.99:37215
- 19#.###.230.80:37215
- 19#.###.237.158:37215
- 19#.###.58.195:37215
- 19#.###.114.92:37215
- 15#.###.196.252:37215
- 15#.##.78.246:37215
- 41.##.247.92:37215
- 19#.##.52.65:37215
- 15#.##8.15.14:37215
- 19#.##5.56.90:37215
- 41.###.191.98:37215
- 19#.##.250.197:37215
- 15#.###.26.250:37215
- 41.###.179.157:37215
- 15#.###.168.210:37215
- 15#.##8.2.239:37215
- 41.###.140.170:37215
- 15#.##.188.21:37215
- 15#.##.144.39:37215
- 15#.###.197.68:37215
- 15#.##3.77.11:37215
- 41.#.#.211:37215
- 19#.##1.143.6:37215
- 15#.###.134.195:37215
- 41.###.188.85:37215
- 19#.##3.9.121:37215
- 41.##.166.237:37215
- 19#.###.36.196:37215
- 15#.###.120.61:37215
- 41.###.33.132:37215
- 19#.##.201.43:37215
- 41.#.#28.197:37215
- 19#.###.182.201:37215
- 41.###.103.12:37215
- 19#.##0.64.41:37215
- 19#.###.24.202:37215
- 19#.##8.73.24:37215
- 19#.###.141.217:37215
- 15#.###.151.245:37215
- 41.###.104.6:37215
- 15#.##.111.137:37215
- 41.##.164.37:37215
- 19#.##.29.193:37215
- 19#.##.236.175:37215
- 15#.##.100.219:37215
- 41.###.40.45:37215
- 15#.##6.3.253:37215
- 41.###.44.199:37215
- 41.##.123.27:37215
- 19#.###.127.25:37215
- 41.###.30.240:37215
- 19#.###.113.187:37215
- 15#.###.54.162:37215
- 41.###.21.13:37215
- 41.##.14.192:37215
- 41.##.80.247:37215
- 15#.##.106.204:37215
- 19#.#.249.2:37215
- 41.##.84.245:37215
- 19#.###.227.27:37215
- 15#.###.145.182:37215
- 19#.###.72.123:37215
- 15#.###.53.154:37215
- 15#.###.85.107:37215
- 15#.###.238.220:37215
- 41.##.239.35:37215
- 19#.###.141.191:37215
- 19#.##.86.183:37215
- 15#.##.193.182:37215
- 41.###.104.229:37215
- 15#.###.160.221:37215
- 15#.##.195.85:37215
- 19#.##.83.195:37215
- 19#.###.205.144:37215
- 19#.###.238.85:37215
- 15#.##.244.130:37215
- 15#.###.11.224:37215
- 41.###.129.132:37215
- 19#.##.13.57:37215
- 15#.##5.22.2:37215
- 15#.###.15.247:37215
- 15#.###.95.121:37215
- 15#.##.33.182:37215
- 15#.##.242.192:37215
- 41.##.222.120:37215
- 41.##.117.3:37215
- 19#.###.239.156:37215
- 19#.##1.9.24:37215
- 19#.###.207.234:37215
- 41.###.125.172:37215
- 41.###.99.148:37215
- 15#.###.18.220:37215
- 41.###.70.33:37215
- 19#.###.22.162:37215
- 19#.###.124.57:37215
- 19#.##.23.35:37215
- 41.##.191.104:37215
- 19#.##.212.38:37215
- 15#.##.196.85:37215
- 15#.##.89.83:37215
- 19#.#.114.25:37215
- 15#.##.221.17:37215
- 41.##.121.111:37215
- 19#.##.141.230:37215
- 41.##.32.180:37215
- 41.##.136.18:37215
- 41.###.35.203:37215
- 15#.##.231.152:37215
- 15#.###.77.234:37215
- 19#.##3.47.17:37215
- 15#.##0.6.160:37215
- 15#.###.106.77:37215
- 15#.##.161.196:37215
- 41.###.105.113:37215
- 41.##.73.164:37215
- 41.###.21.46:37215
- 19#.###.209.200:37215
- 41.###.211.162:37215
- 15#.###.151.72:37215
- 15#.##.49.51:37215
- 19#.###.24.127:37215
- 41.###.32.196:37215
- 41.##.169.201:37215
- 15#.##6.66.87:37215
- 15#.###.116.96:37215
- 15#.##.59.179:37215
- 15#.#.2.92:37215
- 19#.##9.93.21:37215
- 41.##.166.94:37215
- 41.###.160.35:37215
- 41.###.230.140:37215
- 41.###.89.103:37215
- 41.###.190.143:37215
- 15#.##.6.126:37215
- 19#.###.66.103:37215
- 41.###.124.85:37215
- 19#.##.120.178:37215
- 19#.##0.18.73:37215
- 41.##.224.147:37215
- 15#.###.40.102:37215
- 41.###.118.27:37215
- 19#.###.113.30:37215
- 15#.###.99.251:37215
- 15#.##.25.134:37215
- 15#.###.116.136:37215
- 41.##.92.121:37215
- 41.###.168.3:37215
- 15#.##.137.22:37215
- 41.###.251.211:37215
- 41.#.#89.122:37215
- 15#.###.78.251:37215
- 15#.###.208.160:37215
- 41.###.107.211:37215
- 41.##.81.72:37215
- 15#.##.159.189:37215
- 19#.###.187.50:37215
- 41.###.188.244:37215
- 19#.##.94.218:37215
- 19#.###.31.151:37215
- 19#.###.186.105:37215
- 15#.###.245.166:37215
- 19#.#.32.137:37215
- 15#.##.86.171:37215
- 19#.###.211.211:37215
- 15#.##.243.159:37215
- 15#.###.174.186:37215
- 19#.###.145.91:37215
- 41.##.82.182:37215
- 41.###.215.34:37215
- 15#.###.208.52:37215
- 41.##.16.89:37215
- 15#.##.5.236:37215
- 41.###.21.153:37215
- 15#.##5.39.41:37215
- 41.##.245.15:37215
- 19#.###.52.155:37215
- 15#.#.108.126:37215
- 19#.###.155.137:37215
- 15#.###.77.215:37215
- 41.##.48.75:37215
- 19#.###.109.231:37215
- 41.###.63.240:37215
- 19#.##2.11.90:37215
- 41.###.130.174:37215
- 41.###.172.192:37215
- 19#.##.135.50:37215
- 15#.#.212.42:37215
- 19#.##.111.50:37215
- 41.##.86.247:37215
- 19#.##.94.160:37215
- 15#.###.33.187:37215
- 15#.###.145.22:37215
- 19#.##.61.236:37215
- 19#.##.189.122:37215
- 41.##.16.136:37215
- 41.##.173.67:37215
- 41.###.24.62:37215
- 15#.###.152.35:37215
- 41.###.18.73:37215
- 15#.###.140.134:37215
- 41.###.154.6:37215
- 41.#.#44.26:37215
- 15#.##.190.246:37215
- 41.###.147.17:37215
- 41.#.#9.201:37215
- 19#.###.232.170:37215
- 19#.##.193.187:37215
- 41.##.65.64:37215
- 41.###.33.72:37215
- 15#.###.208.224:37215
- 19#.###.154.241:37215
- 19#.###.194.176:37215
- 41.###.121.95:37215
- 15#.###.117.82:37215
- 15#.###.69.102:37215
- 41.###.18.30:37215
- 19#.###.137.169:37215
- 19#.###.167.109:37215
- 19#.###.243.194:37215
- 15#.###.187.47:37215
- 15#.##.143.29:37215
- 15#.###.170.82:37215
- 15#.###.175.177:37215
- 41.##.156.153:37215
- 15#.##.186.51:37215
- 19#.###.40.239:37215
- 41.###.18.50:37215
- 15#.##.90.111:37215
- 41.###.224.73:37215
- 19#.###.235.208:37215
- 41.###.89.229:37215
- 19#.###.207.46:37215
- 15#.###.24.171:37215
- 41.###.212.166:37215
- 41.###.180.15:37215
- 15#.###.147.121:37215
- 15#.##.33.217:37215
- 15#.###.182.83:37215
- 19#.###.109.196:37215
- 15#.###.89.113:37215
- 41.###.225.83:37215
- 41.##.41.70:37215
- 15#.###.157.146:37215
- 19#.##.54.134:37215
- 41.##.0.84:37215
- 19#.##.22.109:37215
- 19#.###.255.189:37215
- 41.###.195.111:37215
- 19#.###.17.219:37215
- 41.#.#3.16:37215
- 15#.#.241.135:37215
- 41.###.138.205:37215
- 19#.###.108.94:37215
- 15#.##.239.59:37215
- 19#.###.65.147:37215
- 15#.###.94.144:37215
- 15#.##.221.99:37215
- 15#.###.26.173:37215
- 41.###.137.102:37215
- 19#.##7.178.9:37215
- 19#.##.123.217:37215
- 19#.###.250.149:37215
- 15#.##.228.184:37215
- 41.##.224.235:37215
- 15#.###.147.222:37215
- 41.###.27.244:37215
- 41.##.89.76:37215
- 15#.###.112.63:37215
- 15#.##3.39.10:37215
- 19#.###.164.253:37215
- 15#.##.53.162:37215
- 19#.###.217.53:37215
- 15#.###.82.203:37215
- 15#.##.238.79:37215
- 15#.###.128.61:37215
- 41.###.50.153:37215
- 19#.###.232.45:37215
- 41.###.21.247:37215
- 19#.###.88.148:37215
- 41.###.25.5:37215
- 15#.###.102.33:37215
- 41.###.4.89:37215
- 15#.###.54.254:37215
- 19#.###.124.125:37215
- 19#.##.69.248:37215
- 41.##.172.215:37215
- 41.###.236.112:37215
- 15#.###.100.182:37215
- 15#.##0.81.33:37215
- 19#.###.107.216:37215
- 15#.##.84.14:37215
- 15#.#.168.207:37215
- 19#.###.107.97:37215
- 41.###.119.158:37215
- 15#.##.177.105:37215
- 15#.###.202.184:37215
- 41.###.82.226:37215
- 19#.###.247.153:37215
- 41.##.101.137:37215
- 19#.###.148.221:37215
- 41.###.93.210:37215
- 19#.##.123.64:37215
- 15#.##.253.176:37215
- 41.###.1.234:37215
- 41.###.20.13:37215
- 15#.##4.86.54:37215
- 15#.##.11.28:37215
- 15#.##.3.255:37215
- 19#.###.132.52:37215
- 15#.##.172.34:37215
- 15#.###.100.123:37215
- 19#.##.49.67:37215
- 15#.##3.8.225:37215
- 19#.##2.252.4:37215
- 41.###.53.61:37215
- 19#.##.69.103:37215
- 15#.###.61.218:37215
- 41.##.240.84:37215
- 15#.##7.69.46:37215
- 19#.##.246.59:37215
- 19#.##.26.2:37215
- 15#.###.231.167:37215
- 41.##.81.68:37215
- 41.##.35.167:37215
- 15#.###.176.100:37215
- 15#.##.52.105:37215
- 41.##.156.116:37215
- 15#.###.134.232:37215
- 15#.##.106.71:37215
- 19#.###.208.44:37215
- 41.##.234.108:37215
- 15#.###.135.131:37215
- 41.###.131.189:37215
- 41.###.43.111:37215
- 41.##.224.123:37215
- 41.###.15.187:37215
- 19#.###.197.123:37215
- 19#.#.219.248:37215
- 41.###.206.120:37215
- 19#.###.83.171:37215
- 41.##.9.95:37215
- 19#.###.245.95:37215
- 19#.###.169.229:37215
- 19#.###.11.178:37215
- 19#.##.254.223:37215
- 19#.##4.76.17:37215
- 41.###.121.79:37215
- 19#.###.18.177:37215
- 15#.###.110.16:37215
- 15#.###.50.219:37215
- 19#.###.221.178:37215
- 15#.###.183.75:37215
- 19#.###.147.179:37215
- 41.##.115.50:37215
- 15#.##4.66.30:37215
- 41.###.125.158:37215
- 41.##.51.51:37215
- 15#.###.138.214:37215
- 15#.###.119.196:37215
- 19#.###.202.90:37215
- 19#.###.42.231:37215
- 15#.##.156.137:37215
- 19#.###.64.157:37215
- 19#.###.238.38:37215
- 19#.###.20.136:37215
- 41.###.95.95:37215
- 19#.##0.16.38:37215
- 15#.##.139.225:37215
- 15#.###.208.235:37215
- 41.###.128.237:37215
- 19#.##.22.35:37215
- 41.##.81.224:37215
- 19#.###.230.216:37215
- 41.##.152.197:37215
- 15#.##.230.57:37215
- 41.###.243.103:37215
- 15#.###.81.241:37215
- 19#.##6.22.67:37215
- 41.###.17.127:37215
- 41.##.111.75:37215
- 19#.###.207.204:37215
- 15#.#.152.194:37215
- 41.##.194.7:37215
- 41.##.46.106:37215
- 41.###.62.173:37215
- 41.###.101.119:37215
- 41.###.163.179:37215
- 19#.##.63.186:37215
- 19#.##1.58.61:37215
- 19#.##.39.213:37215
- 41.###.89.196:37215
- 19#.###.80.122:37215
- 41.###.95.219:37215
- 19#.##.103.22:37215
- 19#.##4.146.6:37215
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##.97.85:9090
Other:
Collects information about network activity