Technical Information
Malicious functions:
Launches itself as a daemon
Kills system processes:
- sshd
Kills the following processes:
- cron
- atd
- systemd-logind
- rsyslogd
- dbus-daemon
- agetty
- exim4
- bash
- run.sh
- kworker/u2:1
- systemd
Network activity:
Establishes connection:
- 8.#.8.8:53
- 80.###.134.53:1001
- 80.###.134.53:379
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 20#.##0.115.227:23
- 17#.##.66.254:23
- 27.###.236.228:23
- 11#.#9.7.182:23
- 87.###.68.136:23
- 20#.##3.191.190:23
- 20#.##.158.153:23
- 38.###.68.255:23
- 63.##.1.20:23
- 9.##.193.30:23
- 53.##.118.142:23
- 11#.##.173.190:23
- 17#.##1.64.11:23
- 85.##.26.196:23
- 19#.##.249.101:23
- 21#.##1.254.190:23
- 23.###.224.44:23
- 71.###.184.84:23
- 17#.##6.227.34:23
- 70.###.145.56:23