Technical Information
Malicious functions:
Kills system processes:
- sshd
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:23
- 0.0.0.0:22
- 0.0.0.0:80
- 0.0.0.0:3001
- 0.0.0.0:48101
- 0.0.0.0:4321
- 0.0.0.0:6667
- 0.0.0.0:6697
- 0.0.0.0:4102
- 0.0.0.0:1312
Establishes connection:
- 8.#.8.8:53
- 23.##.37.59:81
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 47.##.11.49:23
- 4.###.130.208:23
- 23#.##9.139.153:23
- 22#.##.213.114:23
- 48.##.246.249:23
- 22#.##2.194.110:23
- 37.###.207.173:23
- 75.###.237.215:23
- 96.##.128.67:23
- 58.#.198.189:23
- 44.###.126.134:23
- 20#.##.221.254:23
- 23#.#.73.7:23
- 12#.##2.191.211:23
- 98.###.133.241:23
- 31.##3.79.26:23
- 12#.##.54.122:23
- 10#.#4.65.69:23
- 19#.##.20.141:23
- 10#.##4.194.232:23
- 23#.##9.41.97:23
- 21#.##6.106.185:23
- 17#.##.161.236:23
- 43.##.162.183:23
- 12#.##.62.200:23
- 18#.#.146.76:23
- 15#.##.34.111:23
- 34.##.255.29:23
- 13#.##5.155.172:23
- 14#.##.89.178:23
- 22#.##5.132.149:23
- 81.##.146.252:23
- 16#.##.167.184:23
- 22#.##1.237.58:23
- 47.##.20.100:23
- 13#.##.240.172:23
- 96.###.190.50:23
- 23#.##2.149.66:23
- 67.###.129.25:23
- 16#.##0.222.152:23
- 77.##7.178.8:23
- 17#.##.199.250:23
- 16#.##7.189.171:23
- 19#.##.206.226:23
- 85.###.230.213:23
- 23#.##6.144.18:23
- 88.##.138.100:23
- 24#.##7.199.246:23
- 24#.##0.231.244:23
- 24#.##.27.212:23
- 20#.#.129.139:23
- 18#.##.159.43:23
- 22#.##2.76.84:23
- 19#.##6.143.177:23
- 11#.##3.136.168:23
- 10#.##.171.13:23
- 23#.##2.130.81:23
- 24#.##.56.236:23
- 25#.##.194.203:23
- 93.##.212.112:23
- 19#.##4.12.229:23
- 21#.##9.160.23:23
- 93.###.160.128:23
- 38.##.103.177:23
- 19#.##3.220.20:23
- 96.###.222.225:23
- 20#.##8.104.28:23
- 92.##2.95.43:23
- 54.###.149.213:23
- 44.##.218.94:23
- 31.###.145.117:23
- 20#.##7.211.121:23
- 16#.##0.232.108:23
- 22#.##8.45.199:23
- 91.##3.49.61:23
- 5.###.154.96:23
- 20#.##1.115.158:23
- 13#.##9.151.53:23
- 24#.##.201.95:23
- 66.##.38.8:23
- 21#.##8.85.120:23
- 11#.##1.200.228:23
- 47.###.232.146:23
- 37.###.231.22:23
- 80.###.230.142:23
- 13.###.210.79:23
- 11#.##5.149.0:23
- 10#.##.32.228:23
- 20#.##3.216.65:23
- 19#.##9.17.158:23
- 69.###.171.21:23
- 14#.##7.151.143:23
- 11#.##.207.42:23
- 18#.##3.69.65:23
- 10#.#9.136.1:23
- 99.##.165.103:23
- 17#.##.123.86:23
- 16#.##7.194.12:23
- 16#.#.158.213:23
- 23#.##3.208.128:23
- 22#.##9.74.129:23
- 23#.##9.132.32:23
- 21#.##4.177.159:23
- 24.##.197.55:23
- 53.##.237.255:23
- 13#.##0.254.129:23
- 10#.##6.241.187:23
- 23#.##3.80.112:23
- 19#.##.104.123:23
- 10#.##.176.120:23
- 34.#.227.246:23
- 22#.##2.10.74:23
- 66.#.176.158:23
- 11#.##8.236.162:23
- 12#.##1.137.42:23
- 61.##5.16.52:23
- 16#.##.224.14:23
- 35.###.243.58:23
- 11#.##.118.23:23
- 11#.#62.25.8:23
