Technical Information
Malicious functions:
Launches itself as a daemon
Kills system processes:
- sshd
Kills the following processes:
- systemd
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:8235
Establishes connection:
- 8.#.8.8:53
- 45.##.196.75:4859
- 45.##.196.75:23894
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 45.##.196.75:4859
- 45.##.196.75:23894
- 15#.##7.92.147:23
- 15#.##7.12.239:23
- 15#.##7.211.135:23
- 15#.##7.85.248:23
- 15#.##7.16.88:23
- 15#.##7.57.155:23
- 15#.##7.124.159:23
- 15#.##7.105.226:23
- 15#.#77.2.1:23
- 15#.##7.235.9:23
- 15#.##7.105.225:23
- 15#.##7.238.138:23
- 15#.##7.173.112:23
- 15#.##7.61.34:23
- 15#.##7.80.38:23
- 15#.##7.246.155:23
- 15#.##7.180.83:23
- 15#.##7.226.21:23
- 15#.##7.66.121:23
- 15#.##7.189.226:23
- 15#.##7.188.249:23
- 15#.##7.67.16:23
- 15#.##7.225.45:23
- 15#.##7.200.161:23
- 15#.##7.242.154:23
- 15#.##7.164.190:23
- 15#.##7.169.124:23
- 15#.##7.155.189:23
- 15#.##7.66.166:23
- 15#.##7.50.92:23
- 15#.##7.164.179:23
- 15#.##7.61.31:23
- 15#.##7.7.165:23
- 15#.##7.189.29:23
Receives data from the following servers:
- 45.##.196.75:4859