Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- [kworker]
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:1812
Establishes connection:
- 8.#.8.8:53
- 89.##.41.79:1283
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 18#.##.110.108:23
- 45.#.213.204:23
- 11#.##6.115.197:23
- 13.###.170.208:23
- 11#.##.254.92:23
- 84.##.117.34:23
- 23.##.107.140:23
- 16#.##9.139.233:23
- 20#.##.142.244:23
- 89.##.41.79:1283