Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- /var/Sofia
Performs operations with the file system:
Deletes files:
- /dev/zero
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:9105
Establishes connection:
- 8.#.8.8:53
- 37.##.226.209:28344
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 18#.##1.38.83:23
- 20#.#7.12.54:23
- 94.###.110.248:23
- 14#.##.157.126:23
- 16#.##3.54.212:23
- 10#.##2.72.60:23
- 19#.#0.46.29:23
- 24.###.252.173:23
- 53.##.118.177:23
