Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e28081
Kills the following processes:
- kthreadd
- rcu_gp
- rcu_par_gp
- kworker/0:0
- kworker/0:0H
- kworker/u2:0
- mm_percpu_wq
- rcu_tasks_rude_
- rcu_tasks_trace
- ksoftirqd/0
- rcu_sched
- migration/0
- cpuhp/0
- kdevtmpfs
- netns
- kauditd
- khungtaskd
- oom_reaper
- writeback
- kcompactd0
- ksmd
- khugepaged
- kintegrityd
- kblockd
- blkcg_punt_bio
- edac-poller
- devfreq_wq
- kworker/0:1H
- kworker/0:2
- kswapd0
- kthrotld
- acpi_thermal_pm
- ipv6_addrconf
- kworker/u2:1
- kstrp
- zswap-shrink
- kworker/u3:0
- ata_sff
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- jbd2/sda1-8
- ext4-rsv-conver
- ttm_swap
- kworker/u2:4
- kworker/0:1
- 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##me.xyz
Sends data to the following servers:
- 45.###.232.208:33335
- 56.##.207.232:23
- 13.###.38.164:23
- 89.###.153.165:23
- 24#.##7.185.78:23
- 12.##.73.60:23
- 35.###.207.109:23
- 14.###.218.123:23
- 19#.##.101.12:23
- 29.##.147.74:23
- 23#.##9.238.58:23
- 31.###.36.109:23
- 25#.##6.212.209:23
- 44.##.16.190:23
- 16#.##.76.119:23
- 20#.##6.167.190:23
- 17#.##.152.59:23
- 67.###.159.59:23
- 16#.##.203.154:23
- 14#.##2.245.25:23
- 15.##.251.203:23
- 13#.##.79.244:23
- 15#.##2.59.131:23
- 21#.##2.240.89:23
- 12#.##.220.136:23
- 78.###.112.168:23
- 75.#.23.220:23
- 11#.##6.16.100:23
- 11#.##1.26.123:23
- 19#.##8.121.124:23
- 10#.##8.181.184:23
- 41.###.77.171:23
- 99.###.121.15:23
- 11#.##5.221.221:23
- 22#.#8.136.9:23
- 55.###.101.162:23
- 21#.##.191.138:23
- 23#.##.196.241:23
- 23#.##0.57.60:23
- 38.##9.52.9:23
- 10#.##3.28.124:23
Receives data from the following servers:
- 45.###.232.208:33335
