Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e28081
Kills the following processes:
- kthreadd
- rcu_gp
- rcu_par_gp
- kworker/0:0
- kworker/0:0H
- kworker/u2:0
- mm_percpu_wq
- ksoftirqd/0
- rcu_sched
- rcu_bh
- migration/0
- cpuhp/0
- kdevtmpfs
- netns
- kauditd
- khungtaskd
- oom_reaper
- writeback
- kcompactd0
- ksmd
- crypto
- kintegrityd
- kblockd
- ata_sff
- devfreq_wq
- watchdogd
- kworker/0:1H
- kswapd0
- kthrotld
- ipv6_addrconf
- kworker/u2:2
- kstrp
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- kworker/0:2
- kworker/u3:0
- jbd2/sda1-8
- ext4-rsv-conver
- kworker/0:1
- 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##me.xyz
Sends data to the following servers:
- 45.###.232.208:33335
- 23#.##0.183.239:23
- 30.###.209.125:23
- 94.###.168.160:23
- 30.###.246.50:23
- 81.###.249.159:23
- 57.##.44.197:23
- 39.##.165.154:23
- 22#.##2.171.75:23
- 24#.##5.76.166:23
- 55.##9.47.34:23
- 16#.##4.45.102:23
- 72.###.104.17:23
- 15#.##.216.83:23
- 17#.##.186.205:23
- 15#.##3.180.216:23
- 10#.##8.101.106:23
- 57.##.58.71:23
- 19#.##5.151.179:23
- 22#.##4.76.170:23
- 51.###.240.31:23
- 24#.#.85.31:23
- 20.###.210.41:23
- 14#.#0.54.35:23
- 95.##.141.238:23
- 17#.##.124.229:23
- 19#.#3.40.94:23
- 24#.##4.78.136:23
- 45.###.211.47:23
- 15#.##6.23.238:23
- 13#.##8.153.36:23
- 93.###.150.231:23
- 16#.##9.140.149:23
- 23.###.239.96:23
- 24#.#9.1.50:23
- 20.##7.63.42:23
- 16.###.138.179:23
- 58.###.248.216:23
- 24#.##.246.178:23
- 25#.##.186.52:23
- 18#.##.160.100:23
- 14#.##.97.174:23
- 85.###.108.154:23
- 91.###.243.75:23
- 20.##4.30.34:23
- 36.###.171.123:23
- 10#.##6.23.30:23
- 6.###.102.192:23
- 17#.##.34.228:23
- 24#.##5.143.21:23
- 54.##8.62.8:23
- 50.##.213.134:23
- 44.###.162.133:23
- 7.###.121.163:23
- 15#.##4.112.23:23
- 20#.##.126.203:23
- 57.#.116.214:23
- 83.##.91.133:23
- 16#.##.102.77:23
- 24#.##2.110.135:23
- 19#.#7.50.83:23
- 21#.##6.101.197:23
- 76.###.77.208:23
- 99.##.131.140:23
- 93.###.204.97:23
- 18#.#.120.119:23
- 3.###.170.115:23
- 10#.##1.152.194:23
- 17#.##7.253.40:23
- 18#.##7.24.215:23
- 20#.##.115.53:23
- 22#.##.232.226:23
- 24#.##0.226.246:23
Receives data from the following servers:
- 45.###.232.208:33335
