Technical Information
Malicious functions:
Launches processes:
- sh -c pgrep netwalker
- pgrep netwalker
- sh -c pidof netwalker
- pidof netwalker
- sh -c rm *.cpass
- rm *.cpass
Performs operations with the file system:
Deletes files:
- /proc/*.cpass
Network activity:
Establishes connection:
- <LOCAL_GATE>30:445
- <LOCAL_GATE>30:6379
- <LOCAL_GATE>45:445
- <LOCAL_GATE>45:6379
- <LOCAL_GATE>80:445
- <LOCAL_GATE>80:6379
- <LOCAL_GATE>0:445
- <LOCAL_GATE>0:6379
- <LOCAL_GATE>22:445
- <LOCAL_GATE>22:6379
- <LOCAL_GATE>70:445
- <LOCAL_GATE>70:6379
- <LOCAL_GATE>11:445
- <LOCAL_GATE>11:6379
- <LOCAL_GATE>3:445
- <LOCAL_GATE>3:6379
- <LOCAL_GATE>90:445
- <LOCAL_GATE>90:6379
- <LOCAL_GATE>64:445
- <LOCAL_GATE>64:6379
- <LOCAL_GATE>97:445
- <LOCAL_GATE>97:6379
- 19#.##8.211.222:445
- 19#.###.211.222:6379
- <LOCAL_GATE>79:445
- <LOCAL_GATE>79:6379
- 19#.##8.211.40:445
- 19#.##8.211.40:6379
- <LOCAL_GATE>52:445
- <LOCAL_GATE>52:6379
- 19#.##8.211.209:445
- 19#.###.211.209:6379
- <LOCAL_GATE>37:445
Attacks using a special dictionary (brute-force technique) via the SSH protocol
Other:
Collects CPU information
