Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- /bin/busybox
Kills system processes:
- sshd
Kills the following processes:
- <SAMPLE>
Network activity:
Establishes connection:
- 8.#.8.8:53
- 10#.#.186.118:6949
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 91.###.101.86:60001
- 69.#.#31.214:60001
- 15#.##5.49.86:60001
- 94.###.154.78:60001
- 11#.##.32.183:60001
- 19#.##.160.132:60001
- 18#.##.186.240:60001
- 12#.###.104.255:60001
- 12#.##.121.21:60001
- 48.##.108.121:60001
- 20#.###.12.122:60001
- 19#.##.232.29:60001
- 16#.##.141.175:60001
- 66.###.62.3:60001
- 19#.##2.59.51:60001
- 22#.###.135.244:60001
- 13.##.17.48:60001
- 21#.##9.26.49:60001
- 11#.##.143.31:60001
- 17#.###.65.184:60001
- 48.###.182.172:60001
- 14#.##7.70.22:60001
- 89.###.54.224:60001
- 14.###.203.42:60001
- 15#.###.85.216:60001
- 22#.###.180.168:60001
- 11#.##.91.167:60001
- 89.##.180.40:60001
- 64.##.207.220:60001
- 71.##.41.119:60001
- 38.##.191.33:60001
- 12#.##7.81.95:60001
- 42.###.107.87:60001
- 21#.##.134.73:60001
- 11#.###.104.235:60001
- 14#.#.45.41:60001
- 10#.###.203.128:60001
- 10#.##.150.93:60001
- 17#.###.122.66:60001
- 12#.#.194.70:60001
- 14#.##.99.146:60001
- 21#.###.211.212:60001
- 14#.###.227.123:60001
- 14#.###.107.81:60001
- 16#.###.143.235:60001
- 12.##.172.81:60001
- 85.###.105.202:60001
- 98.##.177.66:60001
- 20#.##.171.234:60001
- 66.###.57.19:60001
- 12#.###.223.179:60001
- 15#.###.245.222:60001
- 68.##.154.1:60001
- 18#.###.219.251:60001
- 10#.###.101.59:60001
- 13#.###.109.153:60001
- 18#.###.157.51:60001
- 17#.###.176.152:60001
- 16#.###.181.112:60001
- 91.##.85.41:60001
- 9.##.#6.135:60001
- 21#.#.59.154:60001
- 18#.###.141.156:60001
- 17#.##5.6.175:60001
- 79.##.214.239:60001
- 42.###.74.122:60001
- 59.###.108.72:60001
- 89.#.#9.185:60001
- 78.##.22.243:60001
- 10#.###.188.14:60001
- 63.##.248.184:60001
- 65.#.#4.95:60001
- 95.###.99.104:60001
- 74.###.44.65:60001
- 83.###.86.39:60001
- 20#.##.160.229:60001
- 11#.###.198.132:60001
- 15#.###.139.55:60001
- 10#.##.150.88:60001
- 14#.###.130.174:60001
- 87.###.154.25:60001
- 12#.##.127.236:60001
- 90.###.242.176:60001
- 15#.###.47.210:60001
- 16#.###.186.217:60001
- 32.#.#22.68:60001
- 44.###.97.188:60001
- 19#.###.112.209:60001
- 96.##.241.84:60001
- 17#.###.108.250:60001
- 24.###.112.23:60001
- 15#.###.255.33:60001
- 40.##.49.27:60001
- 13#.###.219.53:60001
- 21#.###.172.169:60001
- 96.##.68.44:60001
- 10#.#.63.47:60001
- 72.##.236.69:60001
- 21#.##5.9.138:60001
- 72.##.202.146:60001
- 15#.##.127.129:60001
- 13#.###.210.32:60001
- 21#.###.245.193:60001
- 17#.###.37.218:60001
- 15#.##.14.12:60001
- 17#.##7.32.61:60001
- 13#.###.221.51:60001
- 20#.##.1.141:60001
- 17#.##.151.25:60001
- 20#.##.244.40:60001
- 44.##.236.190:60001
- 13.###.49.15:60001
- 16#.##0.71.9:60001
- 18#.##.32.79:60001
- 15#.##.214.60:60001
- 2.###.221.170:60001
- 57.###.57.104:60001
- 13#.##.136.60:60001
- 16#.###.148.201:60001
- 1.##.#50.52:60001
- 10#.##.34.77:60001
- 22#.###.138.121:60001
- 20#.##.119.147:60001
- 16#.###.107.27:60001
- 11#.##9.24.63:60001
- 20#.###.102.70:60001
- 18#.##.53.228:60001
- 20#.#.194.150:60001
- 12#.###.242.113:60001
- 19#.###.245.21:60001
- 71.##.140.111:60001
- 14#.###.15.170:60001
- 12#.##6.30.9:60001
- 21#.###.141.66:60001
- 15#.###.112.49:60001
- 69.###.224.95:60001
- 20.##.167.26:60001
- 16#.###.232.18:60001
- 18#.##.33.97:60001
- 8.##.#16.55:60001
- 15#.###.11.137:60001
- 10#.##4.95.92:60001
- 76.###.140.54:60001
- 20#.###.147.234:60001
- 11#.##.134.179:60001
- 19#.#.128.211:60001
- 27.###.125.102:60001
- 9.###.240.66:60001
- 69.###.26.97:60001
- 78.##.86.94:60001
- 81.##.87.41:60001
- 22#.#.68.211:60001
- 17#.##0.34.66:60001
- 14#.###.191.121:60001
- 13#.###.175.59:60001
- 71.##.73.1:60001
- 89.###.158.16:60001
- 44.##.78.106:60001
- 17#.##.3.168:60001
- 45.###.106.212:60001
- 11#.##.254.245:60001
- 20#.###.184.144:60001
- 17#.###.240.93:60001
- 14#.###.208.27:60001
- 19#.###.86.210:60001
- 48.###.93.78:60001
- 81.###.19.13:60001
- 76.###.179.214:60001
- 73.###.184.248:60001
- 16#.###.221.57:60001
- 9.##.#54.48:60001
- 89.###.238.118:60001
- 13#.###.185.207:60001
- 14#.##.229.252:60001
- 17#.###.80.202:60001
- 17#.###.136.228:60001
- 18#.##.105.18:60001
- 47.##.24.208:60001
- 37.###.254.178:60001
- 16#.###.154.30:60001
- 96.###.199.115:60001
- 92.###.91.103:60001
- 10#.###.30.189:60001
- 14#.###.164.201:60001
- 15#.###.16.196:60001
- 18#.###.76.155:60001
- 11#.##.181.19:60001
- 31.###.188.240:60001
- 11#.##.83.241:60001
- 60.###.68.239:60001
- 36.###.248.114:60001
- 19#.##.53.143:60001
- 10#.###.111.193:60001
- 12#.##.39.43:60001
- 12#.##.14.116:60001
- 71.###.223.225:60001
- 46.###.196.5:60001
- 82.###.223.188:60001
- 14.###.231.34:60001
- 4.###.175.103:60001
- 11#.###.201.225:60001
- 22#.###.81.242:60001
- 14#.###.225.143:60001
- 12#.###.249.209:60001
- 10#.##3.85.95:60001
- 17.###.5.234:60001
- 18#.##6.47.86:60001
- 14#.##1.72.49:60001
- 43.##.168.165:60001
- 21#.###.126.195:60001
- 5.###.192.83:60001
- 11#.##.123.171:60001
- 17.##.45.176:60001
- 22#.##.151.18:60001
- 10#.###.142.183:60001
- 60.##.48.80:60001
- 18#.##.135.167:60001
- 20#.###.144.103:60001
- 18#.###.123.114:60001
- 87.##.41.137:60001
- 37.###.85.204:60001
- 18.##.10.116:60001
- 87.###.45.222:60001
- 19#.##.3.109:60001
- 19#.##.52.28:60001
- 22#.###.26.249:60001
- 21#.##.122.215:60001
- 35.###.123.50:60001
- 11#.###.143.116:60001
- 37.##.216.47:60001
- 13#.###.172.112:60001
- 19#.##.171.182:60001
- 16#.##.143.200:60001
- 14#.###.138.14:60001
- 96.###.161.132:60001
- 14#.#.66.63:60001
- 4.###.146.128:60001
- 13#.##.166.160:60001
- 15#.##.31.128:60001
- 20#.##.102.43:60001
- 13#.#.113.54:60001
- 22#.###.45.182:60001
- 20.##.172.66:60001
- 11#.##.108.83:60001
- 19#.##.215.238:60001
- 43.###.93.174:60001
- 66.##.177.217:60001
- 14#.###.128.144:60001
- 76.###.21.45:60001
- 19.###.183.251:60001
- 19#.###.183.176:60001
- 11#.##.238.255:60001
- 19#.##.53.235:60001
- 16#.###.201.102:60001
- 19#.###.197.60:60001
- 87.###.251.166:60001
- 10#.##.97.173:60001
- 47.###.10.72:60001
- 12#.##.60.148:60001
- 8.###.245.37:60001
- 20#.##.28.85:60001
- 78.##.243.71:60001
- 18#.##.147.218:60001
- 20.##.27.14:60001
- 15#.##.211.209:60001
- 11#.###.129.244:60001
- 18#.###.55.150:60001
- 20#.###.79.103:60001
- 15#.###.199.32:60001
- 9.##.#41.20:60001
- 63.###.21.191:60001
- 16#.###.218.83:60001
- 16#.###.36.238:60001
- 12#.###.142.71:60001
- 21#.##9.34.48:60001
- 19.##.186.12:60001
- 19#.##6.37.95:60001
- 16#.###.68.123:60001
- 43.##.139.53:60001
- 14#.##.185.83:60001
- 15#.###.193.167:60001
- 15#.###.35.230:60001
- 34.###.187.30:60001
- 47.###.4.193:60001
- 97.###.252.82:60001
- 18#.##.245.173:60001
- 5.###.184.249:60001
- 18#.##.53.99:60001
- 16#.##.217.53:60001
- 19#.###.140.180:60001
- 98.##.16.131:60001
- 19#.##.97.201:60001
- 16#.###.160.35:60001
- 21#.###.201.133:60001
- 70.##.29.192:60001
- 19#.###.107.217:60001
- 62.###.237.164:60001
- 18#.###.87.236:60001
- 16#.#.77.175:60001
- 14#.##.17.106:60001
- 14#.###.75.147:60001
- 16#.#.168.222:60001
- 18#.###.10.226:60001
- 21#.###.255.103:60001
- 32.##.236.75:60001
- 38.##.213.170:60001
- 17#.###.116.13:60001
- 18#.##5.6.136:60001
- 12#.###.97.183:60001
- 16#.##.162.201:60001
- 20#.##.107.231:60001
- 10#.###.218.15:60001
- 10#.###.241.206:60001
- 20#.##3.98.69:60001
- 19#.##0.6.47:60001
- 27.##.234.186:60001
- 21#.##.17.209:60001
- 12#.###.205.230:60001
- 62.###.187.158:60001
- 85.###.210.155:60001
- 20#.###.135.21:60001
- 20#.##3.47.17:60001
- 20#.##.151.251:60001
- 12#.##6.82.98:60001
- 14#.###.171.89:60001
- 18#.##.51.182:60001
- 84.###.165.96:60001
- 86.###.51.124:60001
- 21#.##.123.207:60001
- 18#.###.31.118:60001
- 60.##.120.17:60001
- 10#.##.93.248:60001
- 94.##.80.48:60001
- 38.###.104.187:60001
- 88.###.142.25:60001
- 15#.###.209.58:60001
- 14#.###.214.88:60001
- 98.###.6.87:60001
- 62.###.82.66:60001
- 73.#.#6.215:60001
- 82.###.166.41:60001
- 17.##.52.49:60001
- 13#.##.175.10:60001
- 17#.##.33.183:60001
- 10#.##6.68.55:60001
- 16#.##4.87.24:60001
- 53.###.61.163:60001
- 93.###.157.21:60001
- 61.#.6.57:60001
- 18#.###.123.184:60001
- 65.###.211.114:60001
- 95.###.59.149:60001
- 16#.##7.96.97:60001
- 22#.##.9.215:60001
- 24.###.62.223:60001
- 58.###.131.204:60001
- 5.###.238.78:60001
- 18.##.40.221:60001
- 10#.##.34.33:60001
- 15#.###.133.58:60001
Receives data from the following servers:
- 10#.#.186.118:6949
