Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- [kworker]
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:1812
Establishes connection:
- 8.#.8.8:53
- 37.##.230.190:1283
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 22#.##.52.221:23
- 11#.##0.243.112:23
- 22#.#6.68.65:23
- 16#.##5.178.251:23
- 18#.##9.222.52:23
- 14#.#47.35.6:23
- 16#.##5.146.135:23
- 11#.##1.237.234:23
- 14#.##.221.139:23
- 37.##.230.190:1283