Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- (sd-pam)
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 19#.##8.217.50:3467
Establishes connection:
- 8.#.8.8:53
- 19#.##9.147.16:4321
- 37.##.150.53:7685
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##9.147.16:4321
- 37.##.150.53:7685
- 0.0.0.0:0
- 54.###.28.124:23
- 10#.#7.12.85:23
- 17#.##.117.33:23
- 17#.##0.137.246:23
- 15.###.90.177:23
- 18#.##7.20.33:23
- 50.###.209.170:23
- 10#.##.152.222:23
- 10#.##2.65.144:23
- 10#.##.169.88:23
- 18#.##2.197.63:23
- 93.##.99.3:23
- 53.###.85.187:23
- 19#.##.244.19:23
- 10#.##9.32.224:23
- 10#.##9.206.163:23
- 15#.##9.187.125:23
- 20#.##4.235.192:23
- 14.##.167.89:23
- 58.###.72.102:23
- 78.##8.83.18:23
- 24#.##.106.61:23
- 23#.##0.101.38:23
- 32.##.10.167:23
- 24#.##9.162.176:23
- 7.#.#44.145:23
- 78.###.78.206:23
- 10#.##.178.110:23
- 21#.##5.148.17:23
- 11#.##7.54.29:23
- 24#.##8.181.125:23
- 87.#.194.122:23
- 13#.#.225.93:23
- 11#.##.23.242:23
- 91.###.195.63:23
- 22#.##8.125.224:23
- 19#.#8.96.37:23
- 21#.##7.30.42:23
- 11#.##2.255.36:23
- 26.###.31.135:23
- 90.##3.69.3:23
- 19#.#2.40.44:23
- 20#.##8.163.39:23
- 52.###.127.161:23
- 14#.##3.37.153:23
- 19#.##.248.170:23
- 11.###.54.144:23
- 15#.##.177.161:23
- 16.###.219.143:23
- 13#.##5.214.229:23
- 11#.##.204.116:23
- 43.#.188.237:23
- 80.###.153.49:23
- 50.#.255.44:23
- 12#.##.234.67:23
- 23#.##1.3.192:23
- 14#.##.68.213:23
- 14#.#0.45.40:23
- 17#.##0.76.206:23
- 19#.##.247.56:23
- 18#.##.240.106:23
- 34.##9.77.99:23
- 22#.##6.162.172:23
- 67.##1.71.35:23
- 12#.##7.250.93:23
- 25#.##9.113.253:23
- 14#.#8.81.20:23
- 20#.##8.85.117:23
- 15#.##.200.157:23
- 91.##.40.231:23
- 7.###.29.29:23
- 19#.##0.185.7:23
- 36.###.107.13:23
- 79.##0.141.8:23
- 25#.##3.210.193:23
- 19#.#.170.0:23
- 10#.##.151.157:23
- 10#.##6.215.40:23
- 12#.##9.141.241:23
- 14#.##.39.135:23
- 25#.#3.8.159:23
- 99.##.194.56:23
- 17#.##8.197.242:23
- 15#.##.227.19:23
- 12#.##5.44.147:23
- 12#.##6.190.44:23
- 16#.##.121.17:23
- 76.#.229.45:23
- 12#.##1.205.38:23
- 6.###.218.227:23
- 13#.##0.24.172:23
- 23#.##.70.215:23
- 88.###.79.131:23
- 25#.##3.230.44:23
- 50.##6.98.36:23
- 23#.##.26.252:23
- 99.#.5.100:23
- 24.##.255.13:23
- 15.##.162.170:23
- 10#.##8.42.146:23
- 45.##.141.3:23
- 18#.##.136.170:23
- 24.###.15.112:23
- 76.###.172.129:23
- 15.##.81.109:23
- 21#.##3.34.158:23
- 68.###.69.102:23
- 23#.##6.149.126:23
- 81.###.52.161:23
- 24#.##.68.104:23
Receives data from the following servers:
- 37.##.150.53:7685
