Technical Information
Malicious functions:
Substitutes application name for:
Kills the following processes:
- <SAMPLE>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.217.50:3467
Establishes connection:
- 8.#.8.8:53
- 19#.##9.147.16:4321
- 37.##.150.53:7685
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##9.147.16:4321
- 37.##.150.53:7685
- 23#.##6.170.119:23
- 16#.##8.152.239:23
- 68.##.132.160:23
- 29.###.88.107:23
- 24#.##4.120.95:23
- 20#.##5.255.168:23
- 10.###.76.243:23
- 19#.##2.4.149:23
- 14#.##4.222.172:23
- 12#.#.111.54:23
- 20#.##.233.115:23
- 16#.##8.21.246:23
- 58.###.46.178:23
- 14#.##7.203.113:23
- 14#.##9.96.43:23
- 12#.#.249.100:23
- 13.##.106.237:23
- 14.###.37.191:23
- 31.##.212.246:23
- 16#.##.234.217:23
- 24#.##5.90.47:23
- 24#.#7.2.104:23
- 16#.##.59.193:23
- 46.###.144.67:23
- 58.###.167.49:23
- 22#.##.68.152:23
- 67.##.233.40:23
- 56.##8.7.167:23
- 19#.##.81.209:23
- 12#.##.41.186:23
- 14#.#.39.240:23
- 20#.##.255.143:23
Receives data from the following servers:
- 37.##.150.53:7685
- 19#.##9.147.16:4321
