Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- Sd8NRdORQO8GVrQSMHU2
Kills system processes:
- sshd
Kills the following processes:
- exim4
- bash
- run.sh
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:23
Establishes connection:
- 8.#.8.8:53
- 18#.###.105.160:37008
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 18#.###.105.160:37008
- 17#.##.89.241:23
- 19#.##8.135.101:23
- 13#.##6.167.30:23
- 83.##.217.71:23
- 44.###.189.57:23
- 13#.##4.110.182:23
- 16#.##7.168.198:23
- 18#.##.197.17:23
- 72.###.109.135:23
- 69.###.117.242:23
- 16#.##.194.197:23
- 16#.##1.124.205:23
- 11#.##.60.176:23
- 94.##.105.96:23
- 19#.##9.107.43:23
- 64.##5.215.9:23
- 12#.##4.69.124:23
- 76.##.66.238:23
- 65.###.230.232:23
- 15#.##7.204.22:23
- 40.###.125.157:23
- 44.##.58.63:23
- 10#.##.44.189:23
- 20#.#2.72.93:23
- 18#.##2.82.109:23
- 12#.##7.193.100:23
- 32.###.73.130:23
- 18#.#7.50.98:23
- 20#.##8.243.17:23
- 21#.##4.173.65:23
- 70.##.119.128:23
- 10#.##5.144.107:23
- 32.##.228.27:23
- 94.###.132.159:23
- 19#.##4.189.93:23
- 98.##.46.30:23
- 16#.##.97.130:23
- 13#.#2.5.12:23
- 66.##.212.99:23
- 17#.##0.111.82:23
- 17.##.183.105:23
- 5.##.244.118:23
- 19.###.30.144:23
- 4.###.159.24:23
- 15#.##.177.239:23
- 11#.##8.14.48:23
- 14#.##5.50.167:23
- 13#.##5.197.130:23
- 16#.##3.254.180:23
- 45.##3.61.23:23
- 71.###.137.186:23
- 12#.##3.24.55:23
- 57.###.139.126:23
- 11#.##6.226.250:23
- 68.###.169.197:23
- 16#.##3.12.242:23
- 21#.##2.119.57:23
- 64.##3.44.37:23
- 37.##.224.50:23
- 96.#.110.116:23
- 11#.##5.116.231:23
- 11#.#64.24.5:23
- 87.###.185.65:23
- 79.###.229.76:23
- 11#.##7.9.106:23
- 17#.##8.28.117:23
- 92.###.192.79:23
- 21#.##6.193.21:23
- 10#.##6.36.17:23
- 77.###.229.22:23
- 16#.##.167.199:23
- 13#.##5.168.164:23
- 18#.##.211.129:23
- 58.##9.4.239:23
- 11#.##.123.103:23
- 11#.##1.93.160:23
- 79.###.107.21:23
- 31.###.202.248:23
- 83.##.233.177:23
- 62.###.172.161:23
- 17#.##3.228.241:23
- 99.###.153.59:23
- 27.#.174.3:23
- 16.###.197.88:23
- 10#.##2.119.2:23
- 22#.##9.251.237:23
- 97.###.128.141:23
- 19#.##.103.74:23
- 17#.##0.17.152:23
- 68.##.70.22:23
- 18#.##3.213.192:23
- 13#.##8.143.125:23
- 11#.##5.214.213:23
- 64.###.241.169:23
- 47.##.39.125:23
- 22#.##.193.160:23
- 16#.##8.3.160:23
- 18#.##6.102.79:23
- 21#.##1.79.210:23
- 18#.#5.9.253:23
- 12#.##.227.238:23
- 96.##.138.127:23
- 13#.##4.201.222:23
- 17#.##9.9.107:23
- 12.###.226.53:23
- 60.##.6.207:23
- 12.###.11.190:23
- 70.###.30.219:23
- 36.###.168.171:23
- 47.##.219.152:23
- 20#.#.21.17:23
- 18#.##.78.152:23
- 13#.##0.232.5:23
- 12.###.228.64:23
- 64.###.133.109:23
- 19.##.123.255:23
- 12#.#.8.90:23
- 22#.##.221.174:23
- 20#.##.199.52:23
- 15#.##5.215.194:23
- 16#.##2.210.50:23
- 15#.##7.242.201:23
- 9.##.204.254:23
- 10#.#7.98.11:23
- 45.###.90.225:23
- 60.##.211.202:23
- 14#.##6.203.170:23
- 66.##.236.105:23
- 11#.##5.54.103:23
- 15#.##2.212.178:23
- 71.###.147.71:23
- 2.###.169.89:23
- 18#.##3.7.166:23
- 17#.##3.37.239:23
- 15#.#5.121.5:23
- 17#.##4.122.235:23
- 17#.##9.72.141:23
- 12#.##3.219.8:23
- 85.#.210.250:23
- 16#.##.89.251:23
- 14#.##.47.208:23
- 65.###.113.173:23
- 39.###.220.43:23
- 99.##.109.216:23
- 4.##.152.56:23
- 19#.##0.0.180:23
- 10#.##.138.116:23
- 15#.##5.166.177:23
- 11#.##.121.194:23
- 21#.##2.125.66:23
- 12#.##.184.135:23
- 14#.#12.9.70:23
- 58.###.253.218:23
- 60.##.32.225:23
- 11#.##2.123.248:23
- 12#.##4.119.148:23
- 12#.#.66.249:23
- 21#.#2.4.76:23
- 82.###.118.138:23
- 22#.##7.217.36:23
- 87.###.102.171:23
- 89.##.26.160:23
- 17#.##3.156.25:23
- 22#.##9.179.222:23
- 14#.##.62.235:23
- 12#.##.89.133:23
- 12#.##0.166.93:23
- 74.###.152.28:23
- 18#.##4.201.233:23
- 72.##.47.12:23
- 85.###.72.253:23
- 17#.##7.123.75:23
- 63.##7.14.42:23
- 10#.##2.193.25:23
- 14#.##.212.107:23
- 68.###.139.244:23
- 74.##.238.25:23
- 14#.##7.193.217:23
- 11#.#4.70.23:23
- 11#.#.201.94:23
- 73.###.148.152:23
- 64.#.50.4:23
- 14#.##7.249.97:23
- 86.###.204.158:23
- 12#.##3.252.177:23
- 10#.##9.208.7:23
- 10#.##.132.166:23
- 15#.##0.67.134:23
- 82.###.252.231:23
- 17#.##1.43.66:23
- 17#.##.112.249:23
- 17#.##2.170.39:23
- 15#.#.60.111:23
- 23.##.79.165:23
- 20#.##4.215.228:23
- 81.##.68.209:23
- 16#.##4.23.81:23
- 13#.#8.21.55:23
- 57.###.90.179:23
- 38.##.66.154:23
- 13#.##8.87.102:23
- 95.##.146.250:23
- 10#.##.85.126:23
- 14#.##.244.203:23
- 88.##.113.240:23
- 58.##.202.70:23
- 67.#.32.45:23
- 12#.##.124.132:23
- 20#.##.205.64:23
- 13.##.192.212:23
- 15#.##1.70.224:23
- 47.##9.64.28:23
- 58.###.129.92:23
- 21#.##.186.85:23
- 76.##.171.207:23
- 13#.##2.233.164:23
- 19#.##8.146.24:23
- 10#.##3.21.19:23
- 13#.##.174.34:23
- 16#.##5.138.97:23
- 18#.##5.35.201:23
- 16#.#1.15.33:23
- 19#.##3.124.230:23
- 75.##3.1.79:23
- 15#.##7.234.208:23
- 15#.##.121.210:23
- 16#.##.127.116:23
- 12#.##.59.252:23
- 34.#.221.244:23
- 12#.##0.28.158:23
- 11#.##6.255.103:23
- 59.##.23.83:23
- 63.##.215.201:23
- 12#.##7.251.145:23
- 35.###.142.51:23
- 13#.##2.117.185:23
- 20#.##9.169.182:23
- 5.##.112.173:23
- 20#.##.170.164:23
- 75.###.110.150:23
- 19#.##.20.138:23
- 17#.#7.255.1:23
- 14#.##.76.176:23
- 12#.#6.4.115:23
- 11#.##6.197.228:23
- 10#.##2.47.229:23
- 12#.##9.44.62:23
- 70.##.78.181:23
- 63.##.47.29:23
- 9.##.230.169:23
- 22#.##.68.130:23
- 8.##.197.132:23
- 20#.##.225.250:23
- 85.###.133.204:23
- 1.###.2.35:23
- 17#.##.203.72:23
- 17#.##.103.27:23
- 93.#.52.187:23
- 97.##.200.204:23
- 69.###.126.163:23
- 12#.##0.224.103:23
- 17#.#3.12.72:23
- 14#.#8.6.244:23
- 88.##.148.244:23
- 58.###.153.142:23
- 87.##.213.239:23
- 10#.##8.128.97:23
- 15#.##1.38.194:23
- 91.#.249.142:23
- 20#.##.218.65:23
- 74.##.25.52:23
- 19#.##.115.219:23
- 11#.##0.150.240:23
- 37.###.187.250:23
- 19#.##9.198.24:23
- 66.##8.23.72:23
- 19#.##.139.89:23
- 13#.##6.228.168:23
- 18#.##.244.28:23
- 19.##.78.48:23
- 18.##.175.67:23
- 38.###.157.161:23
- 10#.##0.102.97:23
- 11#.#8.7.90:23
- 77.##.145.141:23
- 18#.##8.226.52:23
- 58.###.184.87:23
- 17#.##9.119.163:23
- 81.###.132.206:23
- 11#.##.174.216:23
- 85.###.68.140:23
- 21#.##.244.58:23
- 90.##.158.254:23
- 18#.##0.84.56:23
- 51.#.224.87:23
- 19.##.212.153:23
- 19#.##3.75.82:23
- 12#.##.84.178:23
- 13#.##8.31.164:23
- 15#.##6.243.180:23
- 16#.##3.245.49:23
- 19#.##7.18.183:23
- 11#.##.44.136:23
- 12#.##7.17.135:23
- 17#.##.197.107:23
- 21#.##.191.131:23
- 98.###.126.244:23
- 11#.##9.107.90:23
- 20#.##5.19.82:23
- 13#.##7.133.111:23
- 21#.##0.33.138:23
- 89.##1.29.50:23
- 14#.#64.2.91:23
- 95.##.103.68:23
- 9.###.170.73:23
- 43.###.147.82:23
- 20#.##3.39.92:23
- 13#.##8.70.230:23
- 19#.##.24.219:23
- 18#.##8.42.13:23
- 35.###.140.24:23
- 14#.##4.29.87:23
- 18#.##0.5.125:23
- 13#.##.137.42:23
- 57.##.182.143:23
- 10#.##9.139.221:23
- 17#.##7.105.23:23
- 82.###.157.31:23
- 16#.##4.186.39:23
- 19#.##.146.51:23
- 12#.##9.114.24:23
- 41.##.76.16:23
- 17#.##7.112.44:23
- 19#.##9.200.55:23
- 18#.##0.3.175:23
- 18#.##6.220.99:23
- 14#.##3.229.108:23
- 16#.##.53.160:23
- 14#.##3.223.203:23
- 15#.##8.61.11:23
- 11#.#09.3.69:23
- 13#.##.146.210:23
- 97.##.168.7:23
- 14#.##.172.70:23
- 70.###.168.135:23
- 18#.##.49.184:23
- 16#.##1.233.181:23
- 17#.##7.237.48:23
- 11#.##8.120.55:23
- 12.###.141.32:23
- 73.##.60.79:23
- 18#.##7.213.189:23
- 59.##2.99.0:23
- 19#.##.213.113:23
- 17#.##6.106.194:23
- 68.##.221.109:23
- 15#.##.181.28:23
- 20#.##3.7.225:23
- 17#.##3.250.179:23
- 75.###.100.169:23
- 21#.##3.100.35:23
- 98.###.91.162:23
- 13#.##8.0.173:23
- 21#.##8.18.74:23
- 80.###.182.122:23
- 15#.##3.189.230:23
- 21#.##8.230.33:23
- 21#.##.239.60:23
- 83.##.214.120:23
- 87.##.235.236:23
- 21#.##1.107.88:23
- 67.###.230.103:23
- 11#.##4.151.210:23
- 59.###.48.158:23
- 85.###.165.26:23
- 14#.##0.39.255:23
- 68.##2.41.5:23
- 85.###.235.193:23
- 34.###.128.103:23
- 19#.##.247.47:23
- 54.##.171.98:23
- 47.##9.30.22:23
- 17#.##5.152.32:23
- 19.###.236.177:23
- 18#.##5.60.68:23
- 68.##.182.212:23
- 13#.##3.117.216:23
- 43.###.226.213:23
Receives data from the following servers:
- 18#.###.105.160:37008
