Technical Information
Malicious functions:
Kills system processes:
- sshd
Kills the following processes:
- rpc.idmapd
- cron
- atd
- systemd-logind
- rsyslogd
- acpid
- dbus-daemon
- agetty
- exim4
- systemd
- bash
- run.sh
Network activity:
Establishes connection:
- 19#.##.97.74:911
- 86.#.#91.149:2002
- 1.#.#.0:9527
- 18#.###.255.255:9527
- 96.###.72.89:2002
- 20#.#.97.104:2002
- 14#.##8.37.254:9527
- 13#.##2.147.0:9527
- 12#.##.146.252:2002
- 10#.###.162.193:2002
- 4.###.127.146:9527
- 54.###.255.255:9527
- 12#.###.112.149:2002
- 14#.##0.31.43:2002
- 1.##.#74.239:9527
- 14#.##6.103.20:9527
- 22#.##.87.153:2002
- 31.##6.4.0:2002
- 20#.##7.86.112:9527
- 11#.##.210.213:9527
- 32.###.48.165:2002
- 39.##.131.188:2002
- 90.###.104.132:9527
- 15#.###.161.250:9527
- 99.###.82.224:2002
- 19#.##.1.243:2002
- 19#.###.131.227:9527
- 13#.##.66.34:9527
- 22#.###.224.242:2002
- 4.###.52.220:2002
- 41.#.0.0:9527
- 13#.##.141.133:9527
- 17#.##7.44.182:2002
- 21#.##0.128.88:2002
- 21#.##2.226.55:9527
- 11#.##0.38.144:9527
- 14#.##5.78.53:2002
- 17#.#.0.0:2002
- 19#.###.139.235:9527
- 14#.##6.66.31:9527
- 19#.##.15.234:2002
- 84.###.254.58:2002
- 15#.###.206.255:9527
- 78.###.50.55:9527
- 11#.##.247.111:2002
- 82.##.238.46:2002
- 94.###.8.175:9527
- 14.#.0.0:9527
- 99.#.#43.210:2002
- 19#.##6.95.144:2002
- 19.###.39.110:9527
- 22#.##9.236.57:9527
- 11#.##.105.226:2002
- 76.###.97.232:2002
- 20#.##.11.9:9527
- 10#.##4.11.133:9527
- 16#.##3.237.56:2002
- 41.##.111.40:2002
- 11#.##.136.121:9527
- 12.###.216.53:2002
- 40.###.54.107:2002
- 15#.##6.53.82:9527
- 37.###.140.216:9527
- 17#.#.162.145:2002
- 10#.###.173.142:2002
- 70.##.154.26:9527
- 16#.##8.88.24:9527
- 17#.#.82.84:2002
- 19#.##.236.22:2002
- 59.###.44.158:9527
- 18#.##.50.6:9527
- 57.###.21.18:2002
- 16#.##3.74.179:2002
- 4.###.255.255:9527
- 10#.##.214.166:9527
- 49.###.197.52:2002
- 20#.##0.64.106:2002
- 15#.##.31.243:9527
- 82.##.252.172:9527
- 17#.##.187.132:2002
- 11#.##.102.200:2002
- 75.##.73.145:9527
- 48.###.31.250:9527
- 18#.##.181.219:2002
- 10#.###.255.255:2002
- 69.#.#13.123:9527
- 99.###.59.225:9527
- 37.###.131.69:2002
- 18#.##.123.195:2002
- 22#.##.34.35:9527
- 40.##.42.0:9527
- 12#.##.239.210:2002
- 60.###.90.216:2002
- 19#.##0.68.220:9527
- 48.##.186.31:9527
- 15#.##6.194.77:2002
- 19#.##.24.243:2002
- 72.###.51.132:9527
- 10#.##.44.208:9527
- 48.###.185.176:2002
- 20#.##.14.111:2002
- 18#.##.38.56:9527
- 81.#.#29.240:9527
- 97.###.203.219:2002
- 11#.##.213.246:2002
- 50.##.23.129:9527
- 23.###.210.56:9527
- 38.##.210.133:2002
- 72.###.166.90:2002
- 22#.##6.135.60:9527
- 11#.##1.159.2:9527
- 21#.#.122.15:2002
- 12.###.193.145:2002
- 69.##.164.254:9527
- 48.###.28.42:9527
- 13#.##.212.244:2002
- 20#.##7.17.35:2002
- 45.###.156.126:9527
- 11#.##1.181.73:9527
- 20#.##7.25.234:2002
- 17#.##.222.27:2002
- 72.##.237.86:9527
- 41.###.53.6:9527
- 18#.##6.171.22:2002
- 19#.##.229.143:2002
- 60.###.220.44:9527
- 27.##.202.27:9527
- 80.###.142.114:2002
- 18#.##6.19.113:2002
- 40.###.144.183:9527
- 19#.##7.162.49:9527
- 15#.##.30.213:2002
- 22#.##7.5.161:2002
- 21#.##.189.31:9527
- 71.###.248.238:9527
- 15#.###.107.240:2002
- 17#.##.12.207:2002
- 75.###.94.92:9527
- 15#.##8.74.254:9527
- 36.##.128.197:2002
- 20.##.235.69:2002
- 16#.##.198.108:9527
- 74.###.231.105:9527
- 58.###.130.0:2002
- 54.##.98.137:2002
- 16#.##1.195.3:9527
- 95.##.249.119:9527
- 24.##.81.52:2002
- 12#.#.0.0:2002
- 20#.##8.82.230:9527
- 51.##.239.141:9527
- 18#.###.252.219:2002
- 81.###.242.13:2002
- 52.###.105.119:9527
- 12#.##4.19.149:9527
- 15#.##.171.221:2002
- 16#.###.143.226:2002
- 20#.###.161.168:9527
- 96.##.220.255:9527
- 73.##.36.173:2002
- 16#.##8.74.69:2002
- 90.##.187.165:9527
- 67.###.68.201:9527
- 15#.##.20.186:2002
- 10#.##.127.232:2002
- 24.###.223.232:9527
- 14#.##9.207.76:9527
- 14#.###.143.165:2002
- 20#.##4.196.55:2002
- 40.###.95.28:9527
- 15#.###.156.193:9527
- 12#.#.161.155:2002
- 15#.#.58.100:2002
- 20#.##1.76.160:9527
- 14#.##.33.154:9527
- 79.##.253.255:2002
- 75.###.77.79:2002
- 94.##.34.129:9527
- 8.##.22.53:9527
- 2.##.88.14:2002
- 19#.##.42.239:2002
- 70.###.34.116:9527
- 19#.##.98.167:9527
- 89.###.156.132:2002
- 11#.###.146.216:2002
- 8.###.39.32:9527
- 19#.##1.48.202:9527
- 50.###.124.22:2002
- 78.###.59.135:2002
- 34.###.163.48:9527
- 10#.#.217.142:9527
- 79.##.236.144:2002
- 18#.###.103.162:2002
- 13#.##.38.180:9527
- 14#.###.157.236:9527
- 63.###.162.31:2002
- 20#.##6.2.137:2002
- 74.##.48.16:9527
- 17#.##8.22.239:9527
- 2.###.223.0:2002
- 17#.###.176.217:2002
- 19#.##1.41.225:9527
- 91.#.#7.162:9527
- 19#.##8.100.16:2002
- 14#.##.133.0:2002
- 87.###.110.25:9527
- 17.##.71.141:9527
- 39.###.114.194:2002
- 11#.##0.81.234:2002
- 16#.##4.3.46:9527
- 19#.###.114.118:9527
- 17#.##1.169.48:2002
- 17#.##7.84.182:2002
- 69.##.187.230:9527
- 17#.##.177.160:9527
- 21#.##1.58.71:2002
- 15#.##.129.26:2002
- 12#.###.161.234:9527
- 20.###.242.160:9527
- 16#.#.20.212:2002
- 35.#.118.1:2002
- 71.###.48.222:9527
- 76.###.122.117:9527
- 12#.##.131.49:2002
- 69.###.102.105:2002
- 8.##.#76.155:9527
- 50.###.154.229:9527
- 12#.##.249.143:2002
- 4.##.#24.207:2002
- 14#.###.255.255:9527
- 81.###.129.215:9527
- 15#.###.220.105:2002
- 22#.##1.85.10:2002
- 38.###.251.59:9527
- 99.###.115.171:9527
- 17#.##6.174.20:2002
- 54.###.247.80:2002
- 84.##.226.159:9527
- 41.###.249.96:9527
- 49.###.30.0:2002
- 18#.###.245.227:2002
- 14#.##.55.9:9527
- 18#.#.22.187:9527
- 32.###.113.29:2002
- 45.###.40.250:2002
- 52.###.135.171:9527
- 58.##.254.178:9527
- 32.###.2.200:2002
- 20.###.177.61:2002
- 46.##.50.50:9527
- 21#.###.198.162:9527
- 80.###.205.193:2002
- 11#.##6.27.114:2002
- 59.###.33.5:9527
- 52.##.183.79:9527
- 31.##.158.119:2002
- 10#.##.168.208:2002
- 17#.##0.12.240:9527
- 16#.##.111.180:9527
- 14#.##0.16.250:2002
- 13#.##.76.222:2002
- 8.###.25.166:9527
- 71.###.93.56:9527
- 39.###.61.84:2002
- 34.###.83.35:2002
- 41.###.86.118:9527
- 13#.###.179.125:9527
- 12#.###.150.237:2002
- 89.###.112.108:2002
- 61.###.2.98:9527
- 20#.##.30.233:9527
- 21#.###.130.186:2002
- 19#.###.128.172:2002
- 17#.##8.0.84:9527
- 97.###.251.124:9527
- 11#.##4.22.22:2002
- 14#.###.203.145:2002
- 89.##.234.202:9527
- 17#.##5.188.3:9527
- 14#.##.33.115:2002
- 41.##.155.154:2002
- 19#.##5.238.49:9527
- 10#.##0.86.77:9527
- 13#.##.5.80:2002
- 40.###.86.65:2002
- 53.###.108.225:9527
- 14#.###.115.245:9527
- 31.###.219.67:2002
- 10#.###.153.173:2002
- 46.###.113.102:9527
- 61.###.218.97:9527
- 97.###.240.183:2002
- 14.###.142.73:2002
- 22#.##2.64.69:9527
- 17#.##.215.3:9527
- 49.###.113.230:2002
- 74.###.203.240:2002
- 14#.##2.116.56:9527
- 20#.##.134.105:9527
- 14#.###.141.209:2002
- 49.###.58.231:2002
- 14#.##4.14.89:9527
- 16#.##.104.169:9527
- 15#.###.229.211:2002
- 19#.##.224.57:2002
- 79.##.45.97:9527
- 11#.##.161.149:9527
- 34.##.221.254:2002
- 22#.###.205.225:2002
- 17#.##2.91.125:9527
- 19#.##0.35.17:9527
- 71.###.74.228:2002
- 14#.#.176.186:2002
- 5.##.8.79:9527
- 11#.##.98.103:9527
- 59.##.177.31:2002
- 18#.#.241.155:2002
- 90.###.249.73:9527
- 14#.#.188.97:9527
- 65.##.42.214:2002
- 41.##2.3.8:2002
- 18#.##6.20.196:9527
- 16#.##.192.254:9527
- 81.###.192.125:2002
- 31.###.245.94:2002
- 21#.##.53.65:9527
- 57.###.111.100:9527
- 12#.##1.67.7:2002
- 13#.##6.73.125:2002
- 54.###.85.76:9527
- 19#.##3.78.81:9527
- 22#.##0.161.92:2002
- 19#.##.105.17:2002
- 19#.##9.48.155:9527
- 91.#.0.0:9527
- 21#.##.190.244:2002
- 20#.##.171.222:2002
- 93.###.74.128:9527
- 19#.##2.147.23:9527
- 94.###.186.146:2002
- 20#.##5.13.70:2002
- 19#.##.184.228:2002
- 79.###.16.215:9527
- 14#.##.38.235:2002
- 58.###.96.238:2002
- 10#.##9.133.26:2002
- 14#.##8.184.35:9527
- 19#.##5.61.206:2002
- 27.###.229.255:2002
- 14#.###.107.120:9527
- 10#.###.139.118:2002
- 68.##.186.157:2002
- 19#.##8.214.73:2002
- 17#.###.110.223:9527
- 27.##.111.24:9527
- 17#.##3.9.129:2002
- 17#.##3.253.58:2002
- 10#.##2.141.38:9527
- 16#.###.174.190:2002
- 66.##.231.55:9527
- 63.###.138.40:2002
- 88.##.220.63:9527
- 10#.###.161.165:9527
- 16#.###.109.134:2002
- 21#.##8.16.158:2002
- 15#.###.158.141:9527
- 64.#.#45.168:9527
- 16#.##.6.117:2002
- 12.###.39.78:9527
- 36.###.233.87:9527
- 57.###.167.225:9527
- 17#.#.3.2:2002
- 15#.##.175.116:2002
- 20#.##6.144.22:9527
- 11#.###.139.239:9527
- 19#.###.239.195:2002
- 13#.##5.118.59:2002
- 17#.##.161.75:9527
- 11#.##2.111.26:9527
- 20#.##3.62.23:2002
- 16#.##.48.240:2002
- 18#.#.4.49:9527
- 22#.##5.204.94:9527
- 10#.##8.197.91:2002
- 19#.###.186.141:2002
- 78.###.246.51:9527
- 51.##.201.27:9527
- 19#.##.125.227:2002
- 18#.###.169.134:2002
- 72.###.49.72:9527
- 99.###.184.251:9527
- 62.##.230.70:9527
- 80.##.61.104:2002
- 13#.###.239.113:9527
- 12#.###.169.234:9527
- 19#.##.12.185:2002
- 40.###.97.172:2002
- 19#.###.210.192:9527
- 17#.##2.7.81:9527
- 10#.##.190.186:2002
- 71.##.140.102:2002
- 20#.##1.98.109:9527
- 12#.##.186.226:9527
- 61.###.157.254:2002
- 98.###.124.32:9527
- 19#.##6.160.48:2002
- 90.##.137.66:2002
- 10#.##.157.120:9527
- 49.##.20.77:9527
- 16#.###.174.126:2002
- 63.#.149.3:2002
- 16#.##.1.135:9527
- 18#.###.138.194:9527
- 12#.##6.143.74:2002
- 27.###.82.208:2002
- 27.##.102.26:9527
- 15#.##4.9.93:9527
- 84.###.254.12:2002
- 1.###.43.153:2002
- 14#.##3.88.239:9527
- 13#.###.225.141:9527
- 50.###.251.115:2002
- 48.#.#05.226:2002
- 16#.##8.32.149:9527
- 58.##.24.16:9527
- 13#.###.221.212:2002
- 19.###.115.154:2002
- 13#.#.50.42:9527
- 20#.##3.125.48:9527
- 68.###.229.8:2002
- 18#.##.192.62:9527
- 97.###.131.88:9527
- 91.##.223.63:2002
- 73.###.98.212:2002
- 90.##.204.212:9527
- 18#.##.10.160:9527
- 81.###.140.80:2002
- 11#.##1.171.67:2002
- 17#.###.218.217:9527
- 22#.##.48.38:9527
- 16#.###.156.179:2002
- 82.###.204.95:9527
- 20#.##2.93.141:9527
- 22#.##7.107.88:2002
- 58.###.30.175:2002
- 89.##.108.50:9527
- 18#.##.17.1:9527
- 18#.##.0.222:2002
- 14#.###.255.246:2002
- 17#.###.252.244:9527
- 16#.###.143.214:9527
- 78.#.#25.64:2002
- 16#.##.167.102:9527
- 15#.###.228.182:9527
- 19#.##.12.48:2002
- 14#.##.11.134:2002
- 86.###.66.32:9527
- 66.###.103.196:9527
- 39.##.123.43:2002
- 39.###.243.250:2002
- 60.###.54.176:9527
- 10#.##.186.101:9527
- 10#.##.164.143:2002
- 54.###.185.7:2002
- 65.##.191.70:9527
- 21#.##3.75.4:2002
- 22#.#.151.158:9527
- 65.###.81.143:9527
- 19#.###.224.208:2002
- 88.##.49.154:9527
- 80.###.204.200:9527
- 39.###.218.95:2002
- 8.###.122.105:2002
- 18#.##7.98.78:9527
- 13#.##3.88.169:9527
- 12#.##3.22.0:2002
- 54.###.222.225:2002
- 17#.##7.74.97:9527
- 69.##.141.48:9527
- 18#.###.121.211:2002
- 20#.##8.253.23:2002
- 20#.##1.4.181:9527
- 95.###.70.71:2002
- 97.##.176.2:2002
- 1.##.#20.12:9527
- 16#.##7.82.100:9527
- 16#.###.160.118:2002
- 16#.##1.146.60:2002
- 85.###.61.92:9527
- 10#.##1.242.21:2002
- 10#.#.112.133:9527
- 15#.##.248.13:9527
- 60.###.174.115:2002
- 71.###.228.155:2002
- 16#.##.140.247:9527
- 19#.##7.36.97:9527
- 78.###.212.39:2002
- 20.#.43.39:2002
- 21#.###.158.186:9527
- 20#.##6.67.180:9527
- 1.##.#81.54:2002
- 11#.##.98.174:9527
- 49.###.221.224:9527
- 67.###.90.52:2002
- 16#.###.192.255:2002
- 20#.##.192.16:9527
- 19#.##.213.13:9527
- 20#.###.133.202:2002
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##.97.74:911
