Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- sh -c pkill -9 mips
- pkill -9 mips
- sh -c pkill -9 \"mips\"
- sh -c killall -9 mips
- sh -c killall -9 \"mips\"
- sh -c pkill -9 mipsel
- pkill -9 mipsel
- sh -c pkill -9 \"mipsel\"
- sh -c killall -9 mipsel
- sh -c killall -9 \"mipsel\"
- sh -c pkill -9 sh4
- pkill -9 sh4
- sh -c pkill -9 \"sh4\"
- sh -c killall -9 sh4
- sh -c killall -9 \"sh4\"
- sh -c pkill -9 x86
- pkill -9 x86
- sh -c pkill -9 \"x86\"
- sh -c killall -9 x86
- sh -c killall -9 \"x86\"
- sh -c pkill -9 i686
- pkill -9 i686
- sh -c pkill -9 \"i686\"
- sh -c killall -9 i686
- sh -c killall -9 \"i686\"
- sh -c pkill -9 ppc
- pkill -9 ppc
- sh -c pkill -9 \"ppc\"
- sh -c killall -9 ppc
- sh -c killall -9 \"ppc\"
- sh -c pkill -9 i586
- pkill -9 i586
- sh -c pkill -9 \"i586\"
- sh -c killall -9 i586
- sh -c killall -9 \"i586\"
- sh -c pkill -9 arm
- pkill -9 arm
- sh -c pkill -9 \"arm\"
- sh -c killall -9 arm
- sh -c killall -9 \"arm\"
- sh -c pkill -9 arm4
- pkill -9 arm4
- sh -c pkill -9 \"arm4\"
- sh -c killall -9 arm4
- sh -c killall -9 \"arm4\"
- sh -c pkill -9 arm5
- pkill -9 arm5
- sh -c pkill -9 \"arm5\"
- sh -c killall -9 arm5
- sh -c killall -9 \"arm5\"
- sh -c pkill -9 arm6
- pkill -9 arm6
- sh -c pkill -9 \"arm6\"
- sh -c killall -9 arm6
- sh -c killall -9 \"arm6\"
- sh -c pkill -9 arm7
- pkill -9 arm7
- sh -c pkill -9 \"arm7\"
- sh -c killall -9 arm7
- sh -c killall -9 \"arm7\"
- sh -c pkill -9 arc
- pkill -9 arc
- sh -c pkill -9 \"arc\"
- sh -c killall -9 arc
- sh -c killall -9 \"arc\"
- sh -c pkill -9 spc
- pkill -9 spc
- sh -c pkill -9 \"spc\"
- sh -c killall -9 spc
- sh -c killall -9 \"spc\"
- sh -c pkill -9 x86_64
- pkill -9 x86_64
- sh -c pkill -9 \"x86_64\"
- sh -c killall -9 x86_64
- sh -c killall -9 \"x86_64\"
- sh -c pkill -9 x86_32
- pkill -9 x86_32
- sh -c pkill -9 \"x86_32\"
- sh -c killall -9 x86_32
- sh -c killall -9 \"x86_32\"
- sh -c pkill -9 powerpc-440fp
- pkill -9 powerpc-440fp
- sh -c pkill -9 \"powerpc-440fp\"
- sh -c killall -9 powerpc-440fp
- sh -c killall -9 \"powerpc-440fp\"
- sh -c pkill -9 powerpc
- pkill -9 powerpc
- sh -c pkill -9 \"powerpc\"
- sh -c killall -9 powerpc
- sh -c killall -9 \"powerpc\"
- sh -c pkill -9 ntpd
- pkill -9 ntpd
- sh -c pkill -9 \"ntpd\"
- sh -c killall -9 ntpd
- sh -c killall -9 \"ntpd\"
- sh -c pkill -9 sshd
- pkill -9 sshd
- sh -c pkill -9 \"sshd\"
- sh -c killall -9 sshd
- sh -c killall -9 \"sshd\"
- sh -c pkill -9 openssh
- pkill -9 openssh
- sh -c pkill -9 \"openssh\"
- sh -c killall -9 openssh
- sh -c killall -9 \"openssh\"
- sh -c pkill -9 bash
- pkill -9 bash
- sh -c pkill -9 \"bash\"
- sh -c killall -9 bash
- sh -c killall -9 \"bash\"
- sh -c pkill -9 tftp
- pkill -9 tftp
- sh -c pkill -9 \"tftp\"
- sh -c killall -9 tftp
- sh -c killall -9 \"tftp\"
- sh -c pkill -9 wget
- pkill -9 wget
Attempts to kill system processes:
- killall -9 sshd
Kills system processes:
- sshd
Attempts to kill the following processes:
- killall -9 mips
- killall -9 mipsel
- killall -9 sh4
- killall -9 x86
- killall -9 i686
- killall -9 ppc
- killall -9 i586
- killall -9 arm
- killall -9 arm4
- killall -9 arm5
- killall -9 arm6
- killall -9 arm7
- killall -9 arc
- killall -9 spc
- killall -9 x86_64
- killall -9 x86_32
- killall -9 powerpc-440fp
- killall -9 powerpc
- killall -9 ntpd
- killall -9 openssh
- killall -9 bash
- killall -9 tftp
Kills the following processes:
- systemd
- bash
Network activity:
Establishes connection:
- 8.#.8.8:53
- 10#.###.110.183:42065
Sends data to the following servers:
- 10#.###.110.183:42065
Receives data from the following servers:
- 10#.###.110.183:42065
Other:
Collects CPU information