Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Network activity:
Awaits incoming connections on ports:
- 19#.###.218.50:23952
- 0.0.0.0:10000
Establishes connection:
- 8.#.8.8:53
- 20#.###.126.254:5714
- 14#.###.166.99:10000
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 20#.###.126.254:5714
- 12#.##3.32.235:23
- 20#.##7.62.36:23
- 81.###.98.235:23
- 65.###.179.47:23
- 12#.##.239.226:23
- 16#.##5.232.51:23
- 14#.#3.16.12:23
- 64.##.248.168:23
- 22#.##.221.200:23
- 14#.###.166.99:10000
Receives data from the following servers:
- 20#.###.126.254:5714
- 14#.###.166.99:10000