Technical Information
Malicious functions:
Substitutes application name for:
- /bin/busybox
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:61341
Establishes connection:
- 23.###.165.119:1024
- 8.#.8.8:53
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 23.###.165.119:1024
- 39.##5.163.4:23
- 20#.##2.129.28:23
- 79.###.143.150:23
- 22#.##.26.134:23
- 18#.##7.187.248:23
- 11#.##8.100.227:23
- 15#.##.128.49:23
- 11#.##7.215.89:23
- 21#.##.133.59:23
- 14#.##6.171.48:23
- 12#.##9.4.221:23
- 18#.##.136.25:23
- 14#.##0.154.85:23
- 72.##.37.13:23
- 96.###.11.215:23
- 30.###.72.143:23
- 13.###.188.64:23
- 35.###.224.52:23
- 11#.##9.189.29:23
- 85.##.231.13:23
- 20#.##2.60.157:23
- 11#.##3.194.27:23
- 14#.##.107.36:23
- 11#.##8.42.237:23
- 20#.##0.76.105:23
- 10#.##3.141.158:23
- 15#.##9.56.40:23
- 11#.##7.150.187:23
- 20#.#12.3.24:23
- 53.###.112.175:23
- 20#.##2.200.195:23
- 11#.##8.2.111:23
- 21#.##.85.208:23
- 51.###.73.131:23
- 19#.#9.30.48:23
- 11#.##0.129.156:23
- 27.#.26.142:23
- 16.###.199.19:23
- 23#.##3.157.90:23
- 27.#.7.138:23
- 22#.##.223.231:23
- 11#.##.116.139:23
- 22.##.243.203:23
- 71.##.42.251:23
- 11#.##3.35.34:23
- 10#.##8.175.137:23
- 13.##9.173.6:23
- 76.###.163.70:23
- 45.###.169.43:23
- 52.##.36.160:23
- 83.##.206.79:23
- 62.##.125.59:23
- 17#.#39.4.85:23
- 18#.##0.242.126:23
- 27.#.129.54:23
- 27.#.179.169:23
- 56.##.226.198:23
- 19#.##2.144.33:23
- 22.##.108.90:23
- 27.#.196.135:23
- 60.###.179.219:23
- 16#.##.233.140:23
- 60.##3.14.93:23
- 60.###.177.188:23
- 12#.##.174.108:23
- 11#.##8.65.248:23
- 60.###.159.126:23
- 24.##.135.237:23
- 23#.##0.140.231:23
- 52.##0.1.45:23
- 11#.##9.82.198:23
- 20#.##.111.178:23
- 19#.#.129.172:23
- 60.##3.51.8:23
- 18#.##2.174.155:23
- 18#.##1.118.253:23
- 76.###.196.218:23
- 27.#.228.148:23
- 27.#.38.166:23
- 17.##0.34.79:23
- 11#.##8.238.37:23
- 19#.##4.186.192:23
- 43.###.168.158:23
- 11#.#1.37.43:23
- 15.###.16.134:23
- 17#.##6.181.219:23
- 22#.##2.168.93:23
- 19#.##0.225.136:23
- 70.##.52.0:23
- 20#.##2.108.100:23
- 18#.##5.208.143:23
- 14#.#.7.163:23
- 12#.##4.102.226:23
- 20#.##2.26.217:23
- 27.#.138.78:23
- 27.#.77.107:23
- 27.#.198.254:23
- 16#.##1.130.228:23
- 27.#.170.92:23
- 60.###.199.107:23
- 24#.##1.17.182:23
- 60.###.117.205:23
- 22.###.117.22:23
- 46.###.205.43:23
- 27.#.85.73:23
- 27.#.145.5:23
- 93.##.223.212:23
- 88.###.230.59:23
- 3.##.104.231:23
- 11#.##8.101.194:23
- 98.##.196.170:23
- 18#.##2.245.186:23
- 60.###.95.247:23
- 20#.##2.252.112:23
- 21#.##2.62.240:23
- 15#.##.252.99:23
Receives data from the following servers:
- 23.###.165.119:1024
