Technical Information
Malicious functions:
Launches itself as a daemon
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:23
- 0.0.0.0:80
Establishes connection:
- 8.#.8.8:53
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Connects to the following servers over the IRC protocol:
- Server: 45.##5.185.187; Command: NICK [DEVICE|x86_32]MO1NQ\nUSER MO1NQ localhost localhost :MO1NQ\n
- Server: 45.##5.185.187; Command: PONG :267275B7\n
- Server: 45.##5.185.187; Command: MODE MO1NQ -xi\n
- Server: 45.##5.185.187; Command: JOIN #fuckyourmother :shedead\n
- Server: 45.##5.185.187; Command: WHO MO1NQ\n