Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e28081
Kills the following processes:
- kthreadd
- rcu_gp
- rcu_par_gp
- kworker/0:0H
- kworker/u2:0
- mm_percpu_wq
- rcu_tasks_rude_
- rcu_tasks_trace
- ksoftirqd/0
- rcu_sched
- migration/0
- kworker/0:1
- cpuhp/0
- kdevtmpfs
- netns
- kauditd
- khungtaskd
- oom_reaper
- writeback
- kcompactd0
- ksmd
- khugepaged
- kintegrityd
- kblockd
- blkcg_punt_bio
- edac-poller
- devfreq_wq
- kworker/0:1H
- kswapd0
- kthrotld
- acpi_thermal_pm
- ipv6_addrconf
- kworker/u2:1
- kworker/u2:2
- kstrp
- zswap-shrink
- kworker/u3:0
- kworker/0:2
- ata_sff
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- jbd2/sda1-8
- ext4-rsv-conver
- ttm_swap
- kworker/u2:3
- kworker/0:0
- 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##me.xyz
Sends data to the following servers:
- 45.###.232.208:33335
- 17#.##7.167.142:23
- 13#.##9.181.175:23
- 34.##.67.212:23
- 26.##.124.221:23
- 24#.#1.251.2:23
- 91.##8.6.23:23
- 19#.##8.39.204:23
- 90.###.116.105:23
- 98.##.194.14:23
- 47.##3.6.91:23
- 72.###.221.50:23
- 92.##2.49.26:23
- 69.##.11.14:23
- 54.##.136.108:23
- 15#.#0.76.4:23
- 88.##.194.27:23
- 23#.##2.204.59:23
- 19#.##.179.37:23
- 1.###.107.157:23
- 74.##.126.88:23
- 22#.##8.171.24:23
- 21#.##4.182.41:23
- 23#.##9.116.44:23
- 22#.#8.14.54:23
- 19#.#9.93.62:23
- 43.##.64.237:23
- 80.##.0.101:23
- 11#.##5.238.93:23
- 11#.##.11.147:23
- 24#.##.219.216:23
- 28.###.37.145:23
- 14#.##4.75.57:23
- 63.##8.53.14:23
- 11#.##0.180.135:23
- 21#.##.65.161:23
- 22#.##.239.191:23
- 70.###.163.78:23
- 51.###.252.216:23
- 36.###.157.132:23
- 30.#.42.70:23
- 11#.##7.196.154:23
- 17#.##6.177.64:23
- 13#.##7.147.35:23
- 25#.##5.172.238:23
- 13.###.116.16:23
- 54.###.115.86:23
- 80.##.140.185:23
- 10#.##8.183.151:23
- 41.##6.19.59:23
- 21#.##.147.215:23
- 10#.##.115.39:23
- 14#.#.83.106:23
- 65.###.79.149:23
- 14#.##3.148.19:23
- 94.##.58.79:23
- 10#.##9.237.172:23
- 13#.##.35.111:23
- 10#.##7.220.74:23
- 13#.##.125.32:23
- 14#.##4.169.64:23
- 17#.##2.243.165:23
- 14#.##.86.122:23
- 45.###.123.120:23
- 71.###.83.102:23
- 11#.##.155.68:23
- 16#.##5.122.105:23
- 22#.##.49.170:23
- 20#.##6.77.140:23
- 85.###.200.177:23
- 25#.##6.247.190:23
- 21#.##2.202.134:23
- 12#.#43.2.4:23
- 12#.##.189.183:23
- 23#.#7.5.169:23
Receives data from the following servers:
- 45.###.232.208:33335
