Technical Information
Malicious functions:
Launches itself as a daemon
Kills the following processes:
- exim4
- bash
- run.sh
Network activity:
Establishes connection:
- 8.#.8.8:53
- 80.###.134.53:666
- 80.###.134.53:374
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 80.###.134.53:666
- 88.##.86.19:23
- 15#.##2.60.43:23
- 11#.#.92.154:23
- 20#.##4.196.217:23
- 12#.##3.129.183:23
- 12#.##.127.117:23
- 48.##.150.230:23
- 89.##.58.89:23
- 18#.##.189.135:23
- 88.###.198.28:23
- 65.###.243.147:23
- 12#.##6.126.8:23
- 45.##5.15.83:23
- 46.###.150.161:23
- 14#.##6.9.147:23
- 61.##.80.203:23
- 90.###.207.38:23
- 13#.##.169.34:23
- 14#.##.221.222:23
- 57.##6.65.75:23
- 21#.##3.152.10:23
- 16#.##7.235.190:23
- 81.###.161.198:23
- 1.##.247.174:23
- 18#.##4.66.217:23
- 19#.##6.210.187:23
- 11#.##4.122.211:23
- 31.##.229.175:23
- 2.###.196.166:23
- 16#.##7.37.95:23
- 21#.#3.4.45:23
- 13#.##5.197.121:23
- 13#.##6.38.212:23
- 13#.##.193.235:23
- 11#.##9.253.210:23
- 11#.##.103.105:23
- 95.###.250.23:23
- 14#.##.163.141:23
- 57.##.13.127:23
- 10#.##7.213.208:23
- 35.###.141.112:23
- 21#.##0.26.185:23
- 90.###.13.152:23
- 13#.##9.52.121:23
- 13#.#0.13.51:23
- 22#.##0.85.237:23
- 70.##.177.140:23
- 14#.##.151.118:23
- 15#.##9.215.61:23
- 2.###.186.104:23
- 61.##.159.89:23
- 58.###.136.238:23
- 17#.##.194.177:23
- 57.##.116.64:23
- 21#.##.186.86:23
- 15#.##7.22.187:23
- 16#.##9.60.188:23
- 21#.##7.66.33:23
- 14#.#.179.115:23
- 74.###.231.192:23
- 10#.##.165.67:23
- 15#.#.105.47:23
- 20#.##.123.140:23
- 17#.##.108.168:23
- 84.###.185.130:23
- 72.##.27.254:23
- 92.##2.65.50:23
- 38.###.76.228:23
- 18#.##.249.67:23
- 21#.##3.27.149:23
- 16#.##.202.222:23
- 21#.##4.40.15:23
- 72.##.73.46:23
- 68.##.98.63:23
- 52.###.238.109:23
- 63.###.250.30:23
- 54.###.143.213:23
- 16#.##5.162.133:23
- 13#.##3.76.41:23
- 12#.#7.82.84:23
- 15#.##0.137.155:23
- 12#.#.179.7:23
- 14#.##9.75.255:23
- 17#.##0.32.103:23
- 13#.##1.91.216:23
- 19#.##3.164.233:23
- 23.###.111.187:23
- 20#.##1.182.63:23
- 10#.##1.16.214:23
- 14#.##3.122.22:23
- 14#.##4.89.16:23
- 9.###.143.134:23
- 53.###.241.230:23
- 13#.##7.84.53:23
- 52.###.27.169:23
- 12#.##1.211.38:23
- 11#.##5.70.231:23
- 16#.##0.144.35:23
- 16#.##3.155.213:23
- 17#.##9.11.51:23
- 81.###.231.68:23
- 70.##.12.129:23
- 13#.##2.144.116:23
- 10#.##8.138.210:23
- 24.###.227.64:23
- 90.###.90.215:23
- 15#.##.97.155:23
- 94.###.149.29:23
- 66.###.173.141:23
- 18#.##7.150.164:23
- 20#.#2.118.7:23
- 16#.##.198.122:23
- 16#.##9.22.126:23
- 18#.##.150.143:23
- 92.##.156.136:23
- 86.###.24.159:23
- 10#.##2.88.66:23
- 10#.##.146.35:23
- 17#.##.251.145:23
- 18#.##7.143.111:23
- 20#.#8.116.0:23
- 16#.##.62.241:23
- 11#.##6.20.51:23
- 89.##.112.113:23
- 74.###.239.67:23
- 10#.##2.124.132:23
- 67.##.21.129:23
- 12#.##3.206.250:23
- 18#.##0.255.136:23
- 51.#.91.23:23
- 52.##.107.195:23
- 11#.##.150.14:23
- 96.##5.7.55:23
- 19#.#2.38.23:23
- 13#.##.33.154:23
- 59.##8.56.43:23
- 19#.#6.232.1:23
- 13#.##.235.12:23
- 18#.##3.2.237:23
- 31.###.189.233:23
- 79.##.37.67:23
- 42.###.190.139:23
- 12#.##3.177.42:23
- 17#.##3.10.146:23
- 20#.##9.239.211:23
- 20#.##3.222.243:23
- 36.##3.48.16:23
- 59.##.176.46:23
- 68.###.138.155:23
- 17#.##5.241.239:23
- 10#.##8.97.244:23
- 18#.##.218.53:23
- 17#.##4.62.73:23
- 15#.##9.234.184:23
- 20#.##7.104.234:23
- 64.###.216.234:23
- 14.###.69.222:23
- 16#.##0.100.189:23
- 12#.##.207.234:23
- 54.###.113.12:23
- 32.##.50.206:23
- 19#.##7.82.11:23
- 83.###.194.127:23
- 17#.##.135.198:23
- 13#.##4.112.166:23
- 15#.##3.198.32:23
- 21#.##3.79.206:23
- 15#.##0.82.248:23
- 50.###.121.226:23
- 10#.##.145.217:23
- 20#.##.37.166:23
- 18#.##3.158.35:23
- 18#.#.142.238:23
- 11#.##9.175.46:23
- 14#.##.152.137:23
- 13#.#1.216.7:23
- 27.###.12.204:23
- 19#.##8.198.103:23
- 20#.##7.62.252:23
- 19#.##.246.170:23
- 76.###.255.42:23
- 21#.##0.246.104:23
- 13#.#.143.182:23
- 19#.##.179.248:23
- 93.##.165.143:23
- 17#.##2.217.61:23
- 57.##.163.223:23
- 13#.##6.28.132:23
- 78.##.181.169:23
- 12#.##.174.136:23
- 16#.##6.14.54:23
- 45.#.169.130:23
- 17.###.174.252:23
- 21#.##.170.248:23
- 24.##5.55.78:23
- 16#.##6.185.210:23
- 22#.##.143.102:23
- 17#.##9.32.254:23
- 72.##8.89.99:23
- 48.##.95.128:23
- 11#.##.190.55:23
- 25.###.254.120:23
- 17#.##.88.109:23
- 16#.##.206.41:23
- 17#.##7.176.235:23
- 11#.##.221.246:23
- 19#.##.23.119:23
- 20#.##.152.18:23
- 20#.##1.106.160:23
- 17.##.196.181:23
- 12#.##2.31.210:23
- 23.##.36.53:23
- 13#.##.153.14:23
- 65.###.215.105:23
- 15#.#3.28.96:23
- 79.###.198.168:23
- 34.###.73.247:23
- 13#.##8.6.106:23
- 74.###.160.41:23
- 82.##.120.218:23
- 12#.##5.217.69:23
- 14#.##1.121.223:23
- 87.###.105.25:23
- 14.#.42.73:23
- 87.###.119.172:23
- 13#.##7.205.234:23
- 32.###.180.117:23
- 21#.##0.245.206:23
- 90.###.166.238:23
- 97.##.79.135:23
- 14#.##9.25.137:23
- 44.###.87.109:23
- 15#.##4.245.2:23
- 10#.##9.44.217:23
- 21#.##.11.212:23
- 51.###.139.248:23
- 22#.##.216.89:23
- 20#.#.85.197:23
- 15#.##6.252.96:23
- 10#.##8.223.88:23
- 11#.##5.187.50:23
- 10#.##4.181.242:23
- 22#.##.229.15:23
- 69.##.32.67:23
- 13#.##6.214.24:23
- 14#.##0.242.51:23
- 49.##5.90.21:23
- 42.##.9.16:23
- 21#.##.11.131:23
- 22#.##6.219.195:23
- 48.###.183.139:23
- 21#.##.110.219:23
- 82.###.126.231:23
- 17#.##4.100.130:23
- 11#.##.183.246:23
- 16#.#38.56.4:23
- 15#.#.237.203:23
- 14#.##5.65.204:23
- 61.###.196.208:23
- 8.###.233.102:23
- 18#.##7.170.214:23
- 13#.#.226.106:23
- 68.##.5.193:23
- 4.#.#40.242:23
- 20#.##.192.171:23
- 14#.##7.189.118:23
- 13#.##.160.254:23
- 14#.#5.93.24:23
- 16#.##1.216.209:23
- 18#.##2.61.152:23
- 11#.##9.86.225:23
- 40.##.116.136:23
- 96.###.230.26:23
- 18#.#.127.214:23
- 16#.##9.134.42:23
- 98.###.85.195:23
- 20#.##0.140.10:23
- 10#.##1.185.165:23
- 22#.#.218.171:23
- 8.###.104.136:23
- 17#.##3.93.237:23
- 15#.##9.4.149:23
- 77.###.108.219:23
- 10#.#0.3.136:23
- 15#.##3.53.56:23
- 18.###.157.93:23
- 16#.##6.202.169:23
- 15#.#5.23.42:23
- 93.###.91.134:23
- 15#.##8.128.79:23
- 13#.##5.131.36:23
- 91.##.31.96:23
- 64.###.146.222:23
- 42.##.191.243:23
- 21#.##.197.106:23
- 70.#.180.25:23
- 42.###.110.248:23
- 18#.##2.20.215:23
- 19#.##6.172.204:23
- 18#.##7.156.186:23
- 40.###.78.106:23
- 71.##8.22.46:23
- 17#.#.225.210:23
- 21#.##7.175.219:23
- 48.###.54.189:23
- 10#.##0.17.180:23
- 92.##.144.166:23
- 93.###.231.101:23
- 19#.##0.120.25:23
- 19#.##3.166.115:23
- 15#.##7.48.122:23
- 17#.##.81.161:23
- 16#.##.224.14:23
- 16#.##.215.76:23
- 20#.##1.91.29:23
- 1.###.230.153:23
- 18.##.40.95:23
- 14#.##3.104.50:23
- 10#.##2.65.20:23
- 18#.##2.3.215:23
- 16#.##9.109.2:23
- 69.###.125.92:23
- 10#.##5.228.8:23
- 12#.##7.183.54:23
- 53.##.65.32:23
- 23.##.167.203:23
- 95.##4.63.85:23
- 16#.##7.141.106:23
- 77.##2.8.181:23
- 20#.##1.127.138:23
- 15#.##7.19.233:23
- 92.##.62.182:23
- 19#.#8.2.74:23
- 15#.##7.83.63:23
- 15#.##.223.144:23
- 54.###.173.196:23
- 19#.##.36.226:23
- 36.##.94.182:23
- 14#.##3.207.135:23
- 15#.##4.176.195:23
- 47.###.200.72:23
- 10#.#.50.84:23
- 13#.#7.43.85:23
- 2.##.244.12:23
- 62.###.249.20:23
- 89.###.69.232:23
- 11#.##6.140.54:23
- 17#.##1.11.142:23
- 13#.##6.34.50:23
- 14#.##4.231.159:23
- 1.###.98.110:23
- 9.##.54.4:23
- 14.###.245.61:23
- 52.###.238.154:23
- 17#.##8.89.102:23
- 73.##.165.132:23
- 18#.##.160.60:23
- 18#.##8.66.143:23
- 20#.##9.133.142:23
- 86.##8.51.42:23
- 94.###.136.145:23
- 19#.##5.33.234:23
- 13#.##.215.149:23
- 20#.##9.164.64:23
- 64.###.39.161:23
- 19#.##.242.54:23
- 15#.##7.214.93:23
- 13#.##0.11.69:23
- 19#.#43.26.1:23
- 22#.##5.108.227:23
- 20#.##5.222.149:23
- 17#.##5.98.188:23
- 17#.##.15.249:23
- 22#.##1.37.208:23
- 34.###.101.49:23
- 20#.##8.165.62:23
- 18#.##.153.239:23
- 57.##.108.202:23
- 5.#.#9.130:23
- 17#.##2.31.198:23
- 11#.##7.84.136:23
- 50.##.73.80:23
- 14#.#3.90.1:23
- 92.###.109.44:23
- 12#.##.249.20:23
- 20#.##3.215.89:23
- 15#.##6.247.192:23
- 11#.##.110.223:23
- 19#.##.139.71:23
- 78.##8.9.211:23
- 10#.##8.217.151:23
- 12#.##0.159.150:23
- 18#.##.106.11:23
- 20#.##.208.57:23
- 14#.##4.135.105:23
- 14#.##.223.53:23
- 17#.##.141.88:23
- 21#.#8.89.29:23
- 10#.##5.247.245:23
- 15#.##4.194.155:23
Receives data from the following servers:
- 80.###.134.53:666
