Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- vv4qzp3tmpvryiyevir3idw
Kills the following processes:
- <SAMPLE>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.216.50:3467
Establishes connection:
- 8.#.8.8:53
- 18#.###.110.240:4321
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 0.0.0.0:0
- 18#.###.110.240:4321
- 15#.##.150.236:23
- 20#.##5.247.163:23
- 16#.##8.115.40:23
- 23#.##0.214.47:23
- 24#.#05.3.1:23
- 2.##.17.206:23
- 23#.##7.183.193:23
- 10#.##6.253.214:23
- 20#.##9.64.117:23
- 81.###.164.236:23
- 75.##.223.229:23
- 10.###.145.211:23
- 21#.##7.229.85:23
- 18#.#0.12.74:23
- 23.###.122.195:23
- 95.##.178.163:23
- 16#.##.119.203:23
- 11#.##0.236.96:23
- 17#.##1.94.99:23
- 10#.##.184.77:23
- 20#.##2.130.237:23
- 12#.##3.71.47:23
- 67.###.118.55:23
- 23.##.37.70:23
- 94.###.210.195:23
- 13#.#7.246.4:23
- 37.##9.69.1:23
Receives data from the following servers:
- 18#.###.110.240:4321