Technical Information
Malicious functions:
Launches itself as a daemon
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:23
- 0.0.0.0:80
Establishes connection:
- 21#.###.118.131:2323
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Connects to the following servers over the IRC protocol:
- Server: 18#.#0.68.175; Command: NICK [KEK|MIPS]WGAZ5\nUSER WGAZ5 localhost localhost :WGAZ5\n
- Server: 18#.#0.68.175; Command: PONG :3CE3DC8E\n
- Server: 18#.#0.68.175; Command: MODE WGAZ5 -xi\n
- Server: 18#.#0.68.175; Command: JOIN #donks :swagfag\n
- Server: 18#.#0.68.175; Command: WHO WGAZ5\n