Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- sh -c pkill -9 mips
- pkill -9 mips
- sh -c pkill -9 \"mips\"
- sh -c pkill -9 mipsel
- pkill -9 mipsel
- sh -c pkill -9 \"mipsel\"
- sh -c pkill -9 sh4
- pkill -9 sh4
- sh -c pkill -9 \"sh4\"
- sh -c pkill -9 x86
- pkill -9 x86
- sh -c pkill -9 \"x86\"
- sh -c pkill -9 i686
- pkill -9 i686
- sh -c pkill -9 \"i686\"
- sh -c pkill -9 ppc
- pkill -9 ppc
- sh -c pkill -9 \"ppc\"
- sh -c pkill -9 i586
- pkill -9 i586
- sh -c pkill -9 \"i586\"
- sh -c pkill -9 arm
- pkill -9 arm
- sh -c pkill -9 \"arm\"
- sh -c pkill -9 arm4
- pkill -9 arm4
- sh -c pkill -9 \"arm4\"
Network activity:
Establishes connection:
- 8.#.8.8:53
- 45.###.2.248:42069
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 45.###.2.248:42069
Receives data from the following servers:
- 45.###.2.248:42069
Other:
Collects CPU information