Technical Information
Malicious functions:
Kills system processes:
- sshd
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:23
- 0.0.0.0:22
- 0.0.0.0:80
- 0.0.0.0:3001
- 0.0.0.0:48101
- 0.0.0.0:4321
- 0.0.0.0:6667
- 0.0.0.0:6697
- 0.0.0.0:4102
- 0.0.0.0:1312
Establishes connection:
- 8.#.8.8:53
- 23.##.37.59:81
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 13#.##7.134.13:23
- 45.###.194.56:23
- 17#.##8.110.105:23
- 21#.##2.25.246:23
- 47.##.184.195:23
- 97.###.187.59:23
- 34.##.178.134:23
- 19#.##8.168.183:23
- 14#.##.51.193:23
- 21#.##9.103.147:23
- 19#.#1.253.4:23
- 17#.##.84.167:23
- 11#.##.184.93:23
- 65.###.119.225:23
- 88.##.58.99:23
- 61.#.18.162:23
- 44.##.53.144:23
- 23#.##.136.137:23
- 18#.##.231.83:23
- 16#.##.99.142:23
- 39.#.238.38:23
- 24#.##.93.147:23
- 15#.##2.76.75:23
- 19#.##0.23.126:23
- 10#.##.17.214:23
- 14#.##.209.141:23
- 46.###.209.137:23
- 18#.##2.243.37:23
- 87.###.209.189:23
- 11#.##8.126.2:23
- 11#.#5.9.103:23
- 63.##.162.20:23
- 62.##.60.17:23
- 96.###.218.168:23
- 58.###.254.24:23
- 69.###.144.243:23
- 40.##.174.144:23
- 11#.##.253.249:23
- 18#.##4.72.131:23
- 18#.##7.47.136:23
- 19.###.53.169:23
- 24#.#.179.3:23
- 14#.##9.149.169:23
- 20#.##9.39.243:23
- 78.##.8.33:23
- 67.###.146.255:23
- 17#.##2.166.207:23
- 15#.##8.20.231:23
- 16#.#9.33.83:23
- 11#.##.122.82:23
- 25#.##9.108.17:23
- 14#.##.171.163:23
- 17#.##.222.246:23
- 21#.##2.12.27:23
- 10#.##1.141.120:23
- 14#.##9.95.39:23
- 10#.##.244.234:23
- 43.###.197.59:23
- 20#.##0.252.112:23
- 20#.##2.111.47:23
- 24#.##2.126.252:23
