Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- fKuZtVt4MMbLKUERe2P0TTbuDwAU
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:23
- 0.0.0.0:22
- 0.0.0.0:443
- 0.0.0.0:81
- 0.0.0.0:8080
Establishes connection:
- 8.#.8.8:53
- 20#.##1.34.89:721
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 18#.##.153.18:23
- 17#.#85.5.40:23
- 11#.##.28.174:23
- 11#.#0.19.84:23
- 86.###.254.233:23
- 14#.##7.4.132:23
- 9.###.95.212:23
- 14#.##1.238.145:23
- 80.##4.19.62:23
- 11#.##4.231.64:23
- 10#.##8.208.172:23
- 22#.##8.2.229:23
- 11#.##.94.192:23
- 20#.#4.8.189:23
- 14#.##9.169.155:23
- 17#.##8.173.67:23
- 20#.#1.193.4:23
- 19#.##0.207.241:23
- 10#.##1.143.160:23
- 86.##.244.37:23
- 13#.##0.176.119:23
- 12#.##5.130.137:23
- 20#.##2.243.148:23
- 16#.##6.180.183:23
- 21#.##2.66.85:23
- 16#.##.113.227:23
- 96.###.57.112:23
- 13#.##1.37.176:23
- 13#.##6.14.181:23
- 77.###.61.140:23
- 19#.##.52.161:23
- 13#.#3.240.3:23
- 14.##.69.253:23
- 69.##.69.63:23
- 99.##2.5.156:23
- 16#.##0.0.173:23
- 5.###.139.253:23
- 17#.##7.104.250:23
- 18#.##0.124.225:23
- 11#.##.189.180:23
- 12#.##6.7.126:23
- 95.###.209.27:23
- 83.##.129.71:23
- 74.###.144.132:23
- 17#.##8.26.238:23
- 96.###.126.190:23
- 15#.##5.49.159:23
- 14#.##5.254.140:23
- 79.##.33.180:23
- 41.###.125.162:23
- 75.###.173.151:23
- 12#.##.183.73:23
- 11#.##.40.185:23
- 16#.##6.91.31:23
- 14#.##3.181.216:23
- 17#.##2.242.18:23
- 97.#.138.93:23
- 18.##.236.100:23
- 19#.#1.66.71:23
- 81.###.122.251:23
- 82.##6.4.41:23
- 61.###.224.246:23
- 15#.##9.247.141:23
- 69.###.114.129:23
- 95.##8.85.17:23
- 20#.##4.41.52:23
- 17#.##7.225.121:23
- 10#.#7.81.91:23
- 16#.##4.207.152:23
- 16#.##1.116.67:23
- 22#.##3.80.181:23
- 20.#.83.238:23
- 15#.##.156.65:23
- 22#.##2.223.254:23
- 45.##.198.37:23
- 20#.##.17.238:23
- 19#.##.172.21:23
- 58.##.118.44:23
- 11#.##9.77.61:23
- 45.##.227.84:23
- 19#.##.59.128:23
- 17#.##3.246.185:23
- 76.###.161.18:23
- 10#.##6.156.184:23
- 17#.##8.129.175:23
- 82.###.165.174:23
- 11#.#6.62.40:23
- 84.###.242.95:23
- 11#.##9.188.92:23
- 60.##.73.40:23
- 13.###.186.213:23
- 22#.##6.248.77:23
Receives data from the following servers:
- 20#.##1.34.89:721
