Technical Information
Malicious functions:
Launches itself as a daemon
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:13324
Establishes connection:
- 8.#.8.8:53
- 16#.###.103.39:34129
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 86.###.247.225:23
- 70.##.165.216:23
- 75.##.144.46:23
- 39.##.124.243:23
- 12#.##7.255.111:23
- 65.##.207.146:23
- 18#.##1.213.9:23
- 85.#.4.231:23
- 16#.##7.7.157:23
- 16#.###.103.39:34129