Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.213.50:3467
Establishes connection:
- 8.#.8.8:53
- 19#.##9.147.16:4321
- 37.##.150.53:7685
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##9.147.16:4321
- 37.##.150.53:7685
- 0.0.0.0:0
- 14#.##2.123.175:23
- 14#.##.158.34:23
- 31.###.118.113:23
- 36.###.235.107:23
- 19#.##1.63.224:23
- 9.##.121.207:23
- 10#.##2.145.208:23
- 43.##.114.4:23
- 15#.##.137.234:23
- 48.###.188.102:23
- 10#.##.106.196:23
- 14#.##.229.62:23
- 25#.##.152.46:23
- 14.##.70.10:23
- 10#.##.227.31:23
- 21#.##.227.207:23
- 14#.##8.98.61:23
- 16.##.151.236:23
- 41.###.255.15:23
- 10#.##.143.171:23
- 18#.##6.105.154:23
- 24#.##1.28.102:23
- 43.###.176.149:23
- 48.###.64.255:23
- 94.##.19.225:23
- 12#.#4.45.18:23
- 23.##.141.94:23
- 17#.#3.64.55:23
- 24#.##.158.154:23
- 11#.##5.171.186:23
- 13#.#.225.232:23
- 20#.##.239.180:23
- 39.##.139.180:23
- 16#.##4.251.59:23
- 13#.##2.202.47:23
- 8.###.152.221:23
- 69.###.120.17:23
- 44.###.118.149:23
- 16#.##1.58.65:23
- 35.##.102.199:23
- 24#.##2.250.144:23
- 86.##.217.138:23
- 11#.##4.45.208:23
- 18#.##9.54.211:23
- 12#.##.251.174:23
- 65.###.213.144:23
- 12#.#9.1.246:23
- 23#.##.235.180:23
- 54.###.231.16:23
- 21#.##.124.169:23
- 49.###.207.134:23
- 21#.##0.160.125:23
- 13#.#2.16.12:23
- 12#.##4.57.121:23
- 34.##.100.138:23
- 51.##9.143.6:23
- 13#.##8.141.202:23
- 18#.##9.40.151:23
- 89.###.56.106:23
- 22.##0.40.68:23
- 74.##.228.191:23
- 44.###.110.16:23
- 19#.##.108.144:23
- 19#.##.75.232:23
- 19#.##9.17.75:23
- 21.###.218.142:23
- 20#.##4.157.121:23
- 19#.##2.230.133:23
- 18#.##.233.218:23
- 11#.##5.113.211:23
- 17#.##6.179.115:23
- 63.##.102.137:23
- 19#.##1.81.49:23
- 62.###.64.124:23
- 13#.##.208.212:23
- 84.##.135.67:23
- 47.##.97.75:23
- 15#.##.125.158:23
- 47.###.104.105:23
- 13#.##0.128.79:23
- 19#.##4.233.224:23
- 12.##.56.202:23
- 21#.##2.252.170:23
- 11#.##9.73.253:23
Receives data from the following servers:
- 37.##.150.53:7685
- 19#.##9.147.16:4321
