Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- 41moqrq5addpc4a5di0i4
Network activity:
Awaits incoming connections on ports:
- 19#.##8.216.50:3467
Establishes connection:
- 8.#.8.8:53
- 5.###.227.140:4321
- 5.###.227.140:7685
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 5.###.227.140:4321
- 5.###.227.140:7685
- 0.0.0.0:0
- 87.###.99.220:23
- 7.###.122.44:23
- 25.##.136.111:23
- 42.###.227.14:23
- 49.###.211.165:23
- 13#.##.218.34:23
- 22#.##.153.194:23
- 10#.#0.8.80:23
- 17#.##7.200.233:23
- 16#.##0.180.21:23
- 17#.##5.86.43:23
- 22#.##6.245.120:23
- 25#.##9.16.118:23
- 61.###.141.220:23
- 96.###.11.253:23
- 19#.##3.216.38:23
- 13#.##2.170.186:23
- 79.###.164.150:23
- 12.###.129.73:23
- 25.###.235.211:23
- 11.###.184.234:23
- 22#.##5.245.102:23
- 18#.##3.94.14:23
- 18#.##.211.29:23
- 20#.##7.130.49:23
- 23.###.229.129:23
- 25#.##0.33.52:23
- 10#.##0.80.165:23
- 21#.#8.8.182:23
- 12.#.111.114:23
- 81.###.232.147:23
- 41.###.132.214:23
- 9.##.116.64:23
- 10#.##.206.74:23
- 23#.##9.41.159:23
- 17#.##9.82.164:23
- 25#.#.11.154:23
- 23#.#48.93.1:23
- 10#.##.106.58:23
- 96.###.111.71:23
- 20#.#5.19.55:23
- 24#.##0.235.47:23
- 19#.##9.231.12:23
- 22#.#29.97.5:23
- 24#.##9.119.34:23
- 65.##.25.79:23
- 12.##.23.167:23
- 11#.##.248.201:23
- 22#.##2.231.112:23
- 19#.##8.128.10:23
- 12#.##.99.208:23
- 4.###.154.82:23
- 17#.##.30.250:23
- 21.###.160.238:23
- 59.##.218.233:23
- 39.##.54.38:23
- 93.###.184.207:23
- 14.###.152.178:23
- 18#.##4.37.90:23
- 56.##5.2.112:23
- 60.###.103.140:23
- 35.##5.86.28:23
- 47.###.76.240:23
- 12#.##.213.200:23
- 11#.#.246.70:23
- 11#.##.13.136:23
- 23#.##.218.23:23
- 53.###.125.122:23
- 71.###.187.100:23
- 24#.##6.131.49:23
- 13#.##6.155.235:23
- 32.###.18.232:23
Receives data from the following servers:
- 5.###.227.140:7685
