Technical Information
Malicious functions:
Substitutes application name for:
- b-scheduler
- b-http
- b-httpworker.0
- b-httpworker.1
- b-httpworker.2
- b-httpworker.3
- b-loadblk
- b-torcontrol
- b-net
- b-dnsseed
- b-addcon
- b-msghand
- b-opencon
Launches processes:
- tor -f -
Kills the following processes:
- /bin/tor
Performs operations with the file system:
Creates folders:
- /root/.bitcoin
- /root/.bitcoin/wallets
- /root/.bitcoin/blocks
- /root/.bitcoin/blocks/index
- /root/.bitcoin/chainstate
Creates or modifies files:
- /root/.bitcoin/settings.json.tmp
- /root/.bitcoin/71e3-2988-5c3f-d301
- /root/.bitcoin/.lock
- /root/.bitcoin/4e52-6462-c849-6a78
- /root/.bitcoin/bitcoind.pid
- /root/.bitcoin/debug.log
- /root/.bitcoin/.cookie.tmp
- /root/.bitcoin/banlist.520b
- /root/.bitcoin/blocks/index/LOCK
- /root/.bitcoin/blocks/index/MANIFEST-000001
- /root/.bitcoin/blocks/index/000001.dbtmp
- /root/.bitcoin/blocks/index/000003.log
- /root/.bitcoin/blocks/index/MANIFEST-000002
- /root/.bitcoin/blocks/index/000002.dbtmp
- /root/.bitcoin/blocks/blk00000.dat
- /root/.bitcoin/chainstate/LOCK
- /root/.bitcoin/chainstate/MANIFEST-000001
- /root/.bitcoin/chainstate/000001.dbtmp
- /root/.bitcoin/chainstate/000003.log
- /root/.bitcoin/chainstate/MANIFEST-000002
- /root/.bitcoin/chainstate/000002.dbtmp
- /root/.bitcoin/peers.5e96
Deletes files:
- /root/.bitcoin/71e3-2988-5c3f-d301
- /root/.bitcoin/4e52-6462-c849-6a78
- /root/.bitcoin/blocks/index/MANIFEST-000001
- /root/.bitcoin/chainstate/MANIFEST-000001
- /root/.bitcoin/tor/controlport.env
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:8332
- 0.0.0.0:8333
- 127.0.0.1:8334
Establishes connection:
- 127.0.0.1:9051
- <LOCAL_DNS_SERVER>
- 15#.##5.64.189:0
- 34.##.252.166:0
- 35.###.144.163:0
- 13#.##.171.241:0
- 34.##.116.89:0
- 54.##.14.235:0
- 52.###.150.101:0
- 12#.#99.13.22:0
- 17#.##8.128.10:0
- 3.###.71.208:0
- 10#.##6.250.138:0
- 34.##.36.169:0
- 34.###.247.173:0
- 16#.#72.5.199:0
- 17#.#1.18.122:0
- 13.##2.141.79:0
- 18#.##5.100.237:0
- 35.###.190.134:0
- 19#.##0.98.241:0
- 21#.##7.92.226:0
- 18.##4.54.86:0
- 46.##.166.125:0
- 17#.#2.0.7:0
- 34.##.54.59:0
- 15#.##.121.240:0
- [2######8:201:9082::2]:0
- [2##########55:4001:8d3c:c089:f9f2:be69]:0
- [2##########00:131:4b1f:f6fc:20f7:f99f]:0
- [2##########10:207:c4d6:4ef9:2faa:e13f]:0
- [2#####f9:4b:13a7::2]:0
- [2#######0:1619::a7a2:7e86]:0
- [2#######0:3:d0::e3b:5001]:0
- [2######8:200:6346::2]:0
- [2##########8f:5200:4118:a495:aa4b:f659]:0
- [2#####1d0:1:f2d4::1]:0
- [2######8:10b:19ca::2]:0
- [2##########001:306f:ec4:7aff:fe8f:66ec]:0
- 20#.##.212.156:0
- 19#.#06.30.90:0
- 18#.#26.5.195:0
- 18#.##6.208.163:0
- 18#.##3.106.63:0
- 18#.#5.35.39:0
- 17#.##3.147.12:0
- 16#.#0.23.11:0
- 12#.#6.53.249:0
- 11#.#8.171.67:0
- 94.##.7.55:0
- 89.##0.96.42:0
- 80.###.165.132:0
- 80.##.213.205:0
- 69.##0.201.27:0
- 62.##1.50.135:0
- 62.###.240.122:0
- 21#.##5.11.163:0
- 21#.##.173.216:0
- 20#.#93.18.37:0
- 20#.##3.194.27:0
- [2##########087:aa00:bc6:9c33:a81d:2f6a]:0
- [2######:ffff:7368::2]:0
- [2##########a0:3b0:a221:e9f5:5658:27e5]:0
- [2#######:8785:cde5::1002]:0
- [2#########0:7:fc1b:ccff:fe8a:d822]:0
- [2#######0:af0e:3564::69:90]:0
- [2######8:2758:fb00::1]:0
- [2##########1b:7600:f053:aade:f47b:b701]:0
- [2#########84b:1:b123:6306:943a:f09b]:0
- [2######07:2026:6682::1]:0
- [2###########0:3b0:a221:e9f5:5658:27e5]:8333
- 19#.##6.30.90:8333
- 78.##.227.249:0
- 21#.##1.139.84:0
- 73.##.178.35:0
- 16#.##9.176.220:0
- 14#.##7.240.139:0
- 18#.##.216.134:0
- 12#.##5.42.249:0
- 15.###.146.144:0
- 21#.##.129.164:0
- 81.###.235.207:0
- 17#.##8.229.158:0
- 35.###.227.227:0
- 89.##2.29.23:0
- 17#.##.158.108:0
- 98.###.215.224:0
- 50.##.86.102:0
- 15#.##4.189.250:0
- 34.##.232.92:0
- 13#.#3.228.90:0
- 31.###.176.124:0
- 67.##.139.67:0
- 13#.#8.227.57:0
- 94.##.218.222:0
- 78.##.44.72:0
- 58.###.192.207:0
- [2##########22:60:281c:e890:de59:a6cf]:0
- [2######0:1f0a:15bc::2]:0
- [2##########08:b903:8ec6:4b66:7189:8660]:0
- [2######0:1f0a:89a::2]:0
- [2######f8:ad40:bc1::1]:0
- [2#####70:6e:7a5::2]:0
- [2#####70:8:217::20]:0
- [2##########5e:2a03:613f:af1f:9488:d72b]:0
- [2######8:3bec:100::1]:0
- [2##########74:51d8:ec48:d12a:e43:7c35]:0
- [2##########f8:a600:1e69:7aff:fe6f:200f]:0
- [2##########f5:9300:9df7:e5f8:b87a:f3f5]:0
- [2##########f1:f300:98a5:5e02:b6ee:9742]:0
- [2######c:26b4:ff00::44]:0
- 97.###.124.172:0
- 62.##7.200.30:0
- 17#.#9.6.226:0
- 10#.##.244.190:0
- 21#.##3.16.218:0
- 21#.#6.32.106:0
- 10#.##.252.172:0
- 21#.##3.121.169:0
- 18#.##.233.149:0
- 18#.#42.249.5:0
- 18#.#8.153.84:0
- 69.##.225.5:0
- 11#.##0.179.185:0
- 10#.##7.18.203:0
- 62.##6.54.174:0
- 21#.#5.178.7:0
- 94.##1.253.18:0
- 18#.##0.17.209:0
- 81.##.201.5:0
- 77.##2.84.34:0
- 12#.##.223.195:0
- [2######8:1f1:f0fe::2]:0
- [2##########900:5400:a099:e1ff:feb6:d0e]:0
- [2##########7:1282:d85c:c69c:2705:1871]:0
- [2#####080:0:f00::70]:0
- [2##########c02:5264:26e4:a825:a0:5e7f]:0
- [2##########401:b01:440b:4bff:fefb:8009]:0
- [2##########0:1df0:224:e8ff:fe1f:60d9]:0
- [2#########204:1149:133:125:50:180]:0
- [2#########46c5:0:8be:db06:9910:dda2]:0
- [2######0:1:1::517:10b6]:0
- 34.##.27.114:0
- 13#.##1.59.113:0
- 34.##.15.213:0
- 47.#.170.67:0
- 80.##1.217.54:0
- 10#.##.170.210:0
- 52.##.203.211:0
- 18#.#6.180.33:0
- 19#.##4.249.44:0
- 12#.##3.189.33:0
- 51.##9.57.97:0
- 13#.##0.143.19:0
- 12#.##2.83.191:0
- 10#.##.198.126:0
- 95.##.176.138:0
- 17#.##.195.232:0
- 75.##.8.111:0
- 15#.#9.98.116:0
- 16#.##8.230.158:0
- 18#.##8.204.135:0
- 35.##7.99.153:0
- 89.##6.21.96:0
- 62.##2.8.207:0
- [2##########e1:f001:1312:e40f:3d0f:2ebe]:0
- [2##########c66:8380:15fc:42ea:d014:7c4f]:0
- [2##########7c1:b500:dea6:32ff:fee7:7acd]:0
- [2##########2a:5703:5c98:f48d:abf1:3206]:0
- [2#######0:edac::42f0:edac]:0
- [2#####1d0:403:c02::]:0
- [2#########005:0:529a:4cff:fe87:d851]:0
- [2#####1d0:a:7bb7::]:0
- [2######a0:babe:584::1]:0
- [2##########c1:20:2092:d0ff:fee4:e0b3]:0
- [2##########ada:e472:1d73:93ca:cdce:ef3b]:0
- [2##########55:4003:6523:50a1:152:e88c]:0
- 34.##.233.167:0
- 34.##.127.26:0
- 47.##.230.171:0
- 35.###.155.181:0
- 47.###.153.169:0
- 3.##.49.147:0
- 50.#.13.164:0
- 3.##.174.43:0
- 95.###.105.108:0
- 88.##4.12.148:0
- 40.##.41.208:0
- 17#.##.167.212:0
- 15#.##1.114.27:0
- 70.##.194.32:0
- 34.###.132.198:0
- 17#.#.101.75:0
- 85.###.233.220:0
- 35.###.200.254:0
- 54.##.158.137:0
- 13.##.31.194:0
- 77.##4.218.93:0
- [2#########:8800:211:32ff:fe9c:e46d]:0
- [2######0:5:41e::3001]:0
- [2######d0:403:3d61::]:0
- [2##########35:b603:6c22:528b:12be:19a6]:0
- [2##########72:9200:ef3d:83a2:49df:dc2d]:0
- [2######07:3002:8456::1]:0
- [2##########482:9200:491a:358c:d8f7:1da]:0
- [2#########:bd3:459f:8fe8:444d:baf1]:0
- [2#######0:400:d0::1d44:e001]:0
- [2##########0e:e303:e7da:af24:21a9:6f1a]:0
- [2#####70:a:c13::2]:0
- [2##########3e1:4900:4883:632a:f42e:5f9d]:0
- [2#####f9:4a:4320::2]:0
- 23.##8.248.66:0
- 68.##3.75.251:0
- 62.##2.83.41:0
- 47.##5.53.163:0
- 16#.#0.151.31:0
- 88.##8.219.5:0
- 21#.##3.83.251:0
- 14#.##5.136.53:0
- 18.###.250.178:0
- 3.###.35.22:0
- 10#.##2.227.107:0
- 13#.#9.92.87:0
- 94.##.128.204:0
- 47.##3.11.63:0
- 3.###.122.100:0
- 78.##8.99.186:0
- 24.##7.106.85:0
- 45.##.61.233:0
- 82.##5.241.50:0
- 51.##9.38.93:0
- 18#.#2.79.170:0
- 21#.##4.128.84:0
- 67.##1.0.111:0
- 86.###.255.117:0
- 19#.#45.62.75:0
- [2######9:c010:cbdf::1]:0
- [2#########101:99:20c:29ff:fe29:d03f]:0
- [2#########a34:2:a804:86ff:fec2:863a]:0
- [2######d0:1008:b86::]:0
- [2##########2a:5701:dc20:d4b8:b5d0:dba9]:0
- [2######02:3980:3250::47]:0
- [2##########35:b603:b5e8:7570:be85:8ea1]:0
- [2######9:8ce4::509:8ce4]:0
- [2##########819:74:b745:b9d5:ff10:aaec]:0
- [2##########b1:6c00:1cd5:bad3:c7e2:f2fa]:0
- [2######8:160:5388::2]:0
- [2##########7b:3c00:2d50:3236:f226:f15f]:0
- [2##########7b:3c03:b98b:8bd0:a6e0:42b5]:0
DNS ASK:
- x9.####.bitcoinstats.com
- x9.####eed.bluematt.me
- x9.######d.bitcoin.dashjr.org
- x9.####.bitcoin.sipa.be
- x9.####.##tcoin.jonasschnelli.ch
- x9.####.bitcoin.wiz.biz
- x9.####.#itcoin.sprovoost.nl
- x9.####.btc.petertodd.org
- x9.###seed.emzy.de
- dn#####.bitcoin.dashjr.org
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
