Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e28081
Kills the following processes:
- kthreadd
- rcu_gp
- rcu_par_gp
- kworker/0:0
- kworker/0:0H
- kworker/u2:0
- mm_percpu_wq
- rcu_tasks_rude_
- rcu_tasks_trace
- ksoftirqd/0
- rcu_sched
- migration/0
- cpuhp/0
- kdevtmpfs
- netns
- kauditd
- khungtaskd
- oom_reaper
- writeback
- kcompactd0
- ksmd
- khugepaged
- kintegrityd
- kblockd
- blkcg_punt_bio
- edac-poller
- devfreq_wq
- kworker/0:1H
- kworker/0:2
- kswapd0
- kthrotld
- acpi_thermal_pm
- ipv6_addrconf
- kworker/u2:1
- kstrp
- zswap-shrink
- kworker/u3:0
- ata_sff
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- jbd2/sda1-8
- ext4-rsv-conver
- ttm_swap
- kworker/u2:4
- kworker/0:1
- kworker/0:3
- 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##me.xyz
Sends data to the following servers:
- 45.###.232.208:33335
- 20#.##0.55.122:23
- 10#.##9.54.12:23
- 69.###.20.110:23
- 18#.##3.233.174:23
- 21.#.161.24:23
- 18#.##.204.28:23
- 18#.##.158.150:23
- 38.###.163.209:23
- 6.###.217.192:23
- 91.###.179.74:23
- 1.###.73.9:23
- 14#.#2.0.79:23
- 15#.##1.187.103:23
- 12.###.106.16:23
- 25#.##.151.220:23
- 23#.##5.141.85:23
- 13.###.116.173:23
- 20#.##0.164.137:23
- 12#.##8.244.25:23
- 30.###.200.62:23
- 16#.#0.4.48:23
- 14#.##6.152.191:23
- 45.#.192.179:23
- 25#.##1.175.181:23
- 21#.##.36.236:23
- 21#.##1.193.220:23
- 13#.##4.128.142:23
- 76.###.163.60:23
- 18#.##.205.247:23
- 11#.##.118.41:23
- 22#.##2.44.130:23
- 20#.#.157.184:23
- 13#.##2.3.141:23
- 15#.##3.122.193:23
- 25#.##5.71.82:23
- 23#.##1.30.93:23
- 18#.##3.111.229:23
- 21#.##.72.254:23
- 95.###.55.144:23
- 31.###.158.138:23
- 12#.##2.230.27:23
- 92.##.184.108:23
- 17#.##2.242.173:23
- 11.##.208.156:23
- 47.##2.93.25:23
- 17#.##.212.220:23
- 12#.##7.115.38:23
- 23#.##7.29.148:23
- 33.###.107.18:23
- 82.###.116.20:23
- 16.##.57.147:23
- 14#.##1.19.35:23
- 22#.##2.7.115:23
- 18#.##6.145.28:23
- 69.##2.59.84:23
- 19.##.26.208:23
- 95.###.107.43:23
- 35.###.214.215:23
- 67.##.219.211:23
- 11#.##6.41.207:23
- 19#.##0.184.8:23
- 24#.##.108.237:23
- 21#.##.174.242:23
- 12#.##.167.10:23
- 27.##.171.11:23
- 12#.##7.53.42:23
- 23.###.178.224:23
- 23#.##7.11.218:23
- 11#.##2.50.13:23
- 24#.##9.187.214:23
- 23#.##.164.251:23
- 13#.##9.113.154:23
- 13#.##.38.122:23
- 14.##.46.119:23
- 92.###.180.138:23
- 9.###.45.19:23
- 65.###.105.126:23
- 42.###.21.156:23
- 12#.##.180.166:23
- 17#.##.11.134:23
- 17#.##.164.51:23
- 12#.##9.61.229:23
- 37.###.201.141:23
- 17#.##.142.91:23
- 24#.##9.192.168:23
- 11#.##5.109.196:23
- 33.###.55.201:23
- 14.##.247.76:23
- 19#.##9.233.155:23
- 18#.##9.226.100:23
- 25.##.83.47:23
- 33.##.141.94:23
- 18#.##.94.143:23
- 67.###.199.193:23
- 20#.##7.137.59:23
- 13#.##8.123.109:23
- 10#.#6.58.80:23
- 96.##8.34.45:23
- 12#.##2.40.98:23
- 11#.##8.250.17:23
- 25#.##2.54.81:23
- 28.##.24.35:23
- 4.###.76.104:23
- 17#.##9.124.78:23
- 47.###.183.61:23
- 23#.##6.45.254:23
- 12#.##3.197.231:23
- 20#.##2.59.237:23
- 49.###.224.69:23
- 20#.#.90.54:23
- 2.###.121.105:23
- 87.#.42.210:23
- 12#.##5.6.212:23
- 15#.##.204.244:23
- 25#.##5.25.239:23
- 18#.#47.81.7:23
- 83.###.245.186:23
- 17#.##.43.222:23
- 16#.##5.179.35:23
- 21#.##7.235.150:23
- 18#.##5.176.159:23
- 77.##.52.14:23
- 14#.##2.139.151:23
- 24#.##3.196.68:23
- 7.###.161.37:23
- 20#.##.115.228:23
- 22#.##5.173.199:23
- 14.#.64.104:23
- 70.###.190.148:23
- 23#.#2.186.1:23
- 15#.#.74.159:23
- 89.##2.121.7:23
- 5.##.157.214:23
- 96.###.174.47:23
- 22#.##5.45.186:23
- 95.##.197.236:23
- 21#.##1.155.249:23
- 10#.#7.91.80:23
- 12#.##1.76.185:23
- 11#.##4.48.219:23
- 87.###.133.61:23
- 18#.##.90.176:23
- 23#.##8.4.137:23
- 77.###.39.187:23
- 51.###.246.221:23
- 53.###.92.124:23
- 51.###.174.197:23
- 13.###.233.156:23
- 18#.##5.230.36:23
- 13#.##7.144.112:23
- 19#.##1.221.82:23
- 18#.##6.111.74:23
- 24#.##1.11.20:23
- 25#.##3.135.194:23
- 81.##.104.21:23
- 15#.##.105.216:23
- 18#.#.20.126:23
- 98.###.72.172:23
- 21#.##2.100.58:23
- 18.###.87.154:23
- 23#.##2.140.241:23
- 11#.##0.110.37:23
- 17#.##.42.127:23
- 75.##.61.217:23
- 13#.##.182.177:23
- 21#.#.192.74:23
- 77.##.201.67:23
- 87.###.212.209:23
- 23#.##2.100.132:23
- 12#.##2.169.236:23
- 10#.##.249.235:23
- 76.###.204.85:23
- 15#.##2.97.234:23
- 15#.##7.6.165:23
- 16#.##.111.142:23
- 10#.##.174.19:23
- 4.##.29.101:23
- 17#.##.153.166:23
- 35.###.30.186:23
- 24.##.97.165:23
- 85.##.48.120:23
- 41.###.95.206:23
- 11#.#9.194.9:23
- 46.###.165.14:23
- 89.###.244.241:23
- 97.###.92.125:23
- 15#.##.183.105:23
- 66.##.230.128:23
- 54.##3.133.2:23
- 92.##.30.83:23
- 97.###.117.151:23
- 13#.##1.30.64:23
- 48.##.220.112:23
- 33.##.44.251:23
- 19#.##5.176.145:23
- 17#.##.205.30:23
- 22#.##2.134.246:23
- 23#.##7.187.16:23
- 20#.##.148.80:23
- 22#.##3.196.24:23
- 20#.##7.13.74:23
- 36.##.20.84:23
- 23.###.169.39:23
- 17#.##4.24.146:23
- 20#.#27.53.8:23
- 19#.##3.235.56:23
- 12#.##9.161.89:23
- 24#.##.254.202:23
- 20#.##1.239.46:23
- 33.###.18.220:23
- 63.###.217.76:23
- 17.###.218.33:23
- 18#.##.191.233:23
- 41.##.217.99:23
- 23#.##8.173.228:23
- 14#.#2.13.45:23
- 11#.##2.88.244:23
- 11#.##1.10.18:23
- 13#.##7.222.136:23
- 29.##.57.185:23
- 18#.##.81.216:23
- 21#.##6.20.33:23
- 19#.##4.27.62:23
- 85.###.160.145:23
- 17#.##9.201.240:23
- 14.##.163.205:23
- 13.#.104.92:23
- 10#.##.127.247:23
- 83.##.178.15:23
- 16#.#38.5.52:23
- 9.###.221.136:23
- 25#.##.230.27:23
- 22#.#.119.117:23
- 16#.##0.41.50:23
- 71.###.189.167:23
- 11#.##1.142.76:23
- 20#.##6.122.103:23
- 22#.##3.205.18:23
- 15#.##2.218.33:23
- 11#.##6.111.226:23
- 81.###.147.162:23
- 79.##.109.43:23
- 23#.##4.153.151:23
- 11#.##1.125.150:23
- 73.##.240.87:23
- 24#.##6.149.242:23
- 14#.##5.108.125:23
- 33.##.41.5:23
- 79.###.139.205:23
- 42.###.112.176:23
- 78.###.29.127:23
- 13#.##0.239.85:23
- 13.###.217.155:23
- 34.###.234.67:23
- 43.##.250.233:23
- 22#.##.188.222:23
- 17#.##2.30.132:23
- 50.###.62.203:23
- 21#.##0.122.234:23
- 21#.#.0.48:23
- 23#.##5.221.4:23
- 25#.##7.157.115:23
- 65.###.229.213:23
- 36.###.164.19:23
- 13#.##4.134.47:23
- 37.###.108.216:23
- 22#.##3.212.22:23
- 20#.##.27.143:23
- 4.##.85.199:23
- 68.##.164.185:23
- 16#.##5.76.210:23
- 46.###.149.128:23
- 19#.##.10.112:23
- 13#.#8.97.77:23
- 29.#.17.78:23
- 17#.#3.16.50:23
- 22#.##3.253.251:23
- 13#.#42.4.56:23
- 88.##9.90.3:23
- 20#.##6.83.206:23
- 25#.##9.12.123:23
- 24#.#0.185.0:23
- 58.##.227.251:23
- 23#.#1.33.0:23
- 24#.##9.229.107:23
- 87.###.223.28:23
- 17#.##3.46.179:23
- 13#.#1.151.7:23
- 33.###.114.37:23
- 22#.##.158.58:23
- 21#.##.97.208:23
- 11#.##4.10.78:23
- 66.###.212.46:23
- 12#.##3.95.50:23
- 36.###.144.76:23
- 19#.##2.230.205:23
- 18#.##.56.252:23
- 56.##4.3.75:23
- 23#.##.225.72:23
- 25.##.115.243:23
- 19.###.216.135:23
- 16#.##.195.126:23
- 5.###.114.89:23
- 15#.##3.6.191:23
- 24#.#9.7.188:23
- 59.##.33.213:23
- 89.##1.4.170:23
- 14#.##3.91.183:23
- 11#.##3.95.91:23
- 20.###.43.189:23
- 19#.##.193.187:23
- 14#.##.47.140:23
- 19#.#.223.56:23
- 14#.#0.152.0:23
- 13#.#46.5.93:23
- 24#.##.248.84:23
- 84.##1.61.91:23
- 6.###.120.246:23
- 18#.##4.226.229:23
- 29.##.201.254:23
- 9.##.216.153:23
- 88.###.197.56:23
- 25#.##.198.251:23
- 23#.##5.100.229:23
- 19#.##8.132.102:23
- 20.###.26.227:23
- 52.###.172.186:23
- 23#.##8.61.177:23
- 21#.##.129.122:23
- 16.##.169.41:23
- 5.#.#5.183:23
- 20#.##.17.104:23
- 75.##.15.124:23
- 17#.##3.178.142:23
- 3.###.82.64:23
- 15#.#63.54.3:23
- 18#.##5.138.24:23
- 21#.##.77.151:23
- 19#.##4.189.56:23
- 21#.##.219.109:23
- 21#.##8.57.67:23
- 14.##5.18.87:23
- 2.##.70.227:23
- 77.##.3.198:23
- 13#.##1.33.198:23
- 17#.##.149.118:23
- 10#.##.205.92:23
- 35.##.210.189:23
- 13#.##.184.71:23
- 16#.##.255.172:23
- 48.###.44.197:23
- 14#.##9.194.15:23
- 12.##.214.133:23
- 21#.#0.23.37:23
- 10#.##7.19.32:23
- 67.##2.162.3:23
- 15#.##.220.250:23
- 14#.##1.240.141:23
- 12#.##.184.174:23
- 23#.##6.251.6:23
- 16#.##6.148.31:23
- 80.##2.50.42:23
- 19.##.70.230:23
- 61.##7.87.2:23
- 21#.##.198.109:23
- 59.##.176.42:23
- 21#.##1.55.51:23
- 27.##.183.180:23
- 93.###.69.136:23
- 15#.##.193.137:23
- 19#.#4.12.33:23
- 43.###.158.243:23
- 10#.##4.48.195:23
- 84.###.90.247:23
- 38.##.117.83:23
- 15#.##.161.128:23
- 14#.##2.65.232:23
- 45.#.177.186:23
- 17#.##6.128.246:23
- 23#.#13.67.3:23
- 15#.##8.226.127:23
- 72.###.183.27:23
- 23#.##.250.69:23
- 15#.##.252.250:23
- 44.###.239.252:23
- 39.###.56.136:23
- 24#.#3.84.75:23
- 73.##.229.136:23
- 16#.##5.203.180:23
- 21.###.132.196:23
- 10#.##2.128.188:23
- 21#.##6.66.229:23
- 17#.##.199.226:23
- 16.##.59.89:23
- 91.##.53.168:23
- 17#.##0.93.120:23
- 25#.##4.250.100:23
- 22#.##.51.242:23
- 89.##.165.139:23
- 20#.##1.38.227:23
- 20#.##.185.165:23
- 89.###.219.182:23
- 21#.##6.45.63:23
- 91.##.159.26:23
- 19#.##6.31.231:23
- 24.###.165.150:23
- 15#.##.173.143:23
- 51.###.137.207:23
- 14#.##.221.198:23
- 67.##.221.134:23
- 20#.##0.253.129:23
- 45.#.186.139:23
- 94.##.174.13:23
- 20#.#.39.42:23
- 79.##.91.121:23
- 22#.#2.15.38:23
- 19#.#.216.3:23
- 46.##4.27.10:23
- 18#.#3.34.33:23
- 17#.##.223.90:23
- 13#.#.255.47:23
- 17#.##6.85.61:23
- 11#.##.198.141:23
- 21#.##.106.44:23
- 14#.##9.114.159:23
- 23#.##1.136.25:23
- 14#.##5.76.168:23
- 56.##4.37.23:23
- 18#.##5.183.43:23
- 12.###.165.31:23
- 19#.##6.126.33:23
- 10#.##0.183.242:23
- 15.##.132.7:23
- 92.##0.97.89:23
- 15#.##6.171.239:23
- 13#.##8.126.243:23
- 16#.##3.223.152:23
- 21.##.143.198:23
- 13#.##6.157.28:23
- 35.##.74.103:23
- 20#.##1.117.8:23
- 17#.##9.133.239:23
- 20.##.163.81:23
- 15#.##.72.135:23
- 33.###.149.231:23
- 65.###.15.255:23
- 16#.##4.71.111:23
- 16#.##.138.178:23
- 11#.#2.43.76:23
- 20#.##9.79.121:23
- 18#.##1.201.161:23
- 10#.##1.64.99:23
- 15#.##9.180.31:23
- 67.##1.42.32:23
- 10#.##2.122.7:23
- 55.###.249.62:23
- 16.#.174.27:23
- 1.###.186.221:23
- 16#.#.132.78:23
- 17#.##.28.176:23
- 23#.##5.202.178:23
- 22#.##.205.106:23
- 20#.##.32.185:23
- 12#.#.16.113:23
- 13#.##4.206.181:23
- 52.###.182.35:23
- 35.##.95.236:23
- 65.##.213.139:23
- 24#.##5.183.28:23
- 13#.##.165.202:23
- 99.###.130.92:23
- 6.###.239.23:23
- 74.###.174.124:23
- 22#.#1.237.4:23
- 69.##.219.64:23
- 51.###.130.207:23
- 45.##.188.58:23
- 70.###.210.167:23
- 15#.##5.57.166:23
- 24#.##8.207.239:23
- 11#.##1.129.83:23
- 25#.##4.131.171:23
- 32.##.3.41:23
- 55.###.33.111:23
- 20#.##.170.29:23
- 25#.##6.220.38:23
- 51.##.111.25:23
- 84.###.218.204:23
- 21#.##.195.190:23
- 35.###.42.170:23
- 25.##.39.220:23
- 21#.##.150.31:23
- 17#.##2.210.232:23
- 17#.##8.42.121:23
- 74.###.101.135:23
- 15#.##1.211.217:23
- 13.#.144.118:23
- 24#.##.105.69:23
- 16#.##5.31.92:23
- 21.##.94.119:23
- 23#.##2.145.247:23
- 81.##.167.234:23
- 21#.##2.254.204:23
- 21#.##2.177.66:23
- 52.#.89.66:23
- 11#.##.181.102:23
- 57.##.33.78:23
- 10#.##7.129.194:23
- 23#.##5.76.157:23
- 80.##1.78.29:23
- 24#.##6.212.63:23
- 16#.##.97.194:23
- 47.##.252.148:23
- 51.###.64.165:23
- 22#.##9.10.120:23
- 21#.##1.190.87:23
- 22#.##4.36.99:23
- 25#.#3.96.63:23
- 66.###.57.101:23
- 15#.##5.144.207:23
- 23#.#2.84.17:23
- 75.###.243.166:23
- 31.##.129.167:23
- 31.###.152.108:23
- 11#.##.156.193:23
- 14#.##.57.119:23
- 19#.##0.104.41:23
- 20#.##3.180.154:23
- 67.###.162.195:23
- 19#.##.140.227:23
- 54.###.198.158:23
- 22#.##.217.119:23
- 33.##.185.89:23
- 12#.##.252.140:23
- 24#.##8.21.66:23
- 17#.##.13.190:23
- 19#.##.187.241:23
- 12#.##5.245.194:23
- 62.###.117.113:23
- 14#.#33.9.4:23
- 18#.##.48.156:23
- 11#.##.210.253:23
- 15#.##7.153.126:23
- 42.##.100.94:23
- 61.###.84.141:23
- 15#.##5.151.14:23
- 15#.#73.33.5:23
- 17#.##.93.250:23
- 20#.##0.50.108:23
- 23#.##.193.175:23
- 23#.##0.70.142:23
- 21#.##.126.134:23
- 85.##.53.151:23
- 68.##.48.231:23
- 17#.##.194.10:23
- 22#.##9.79.88:23
- 2.##.248.172:23
- 15.###.197.233:23
- 28.##.161.88:23
- 20.##.123.230:23
- 17#.##5.69.186:23
- 62.##6.117.1:23
- 31.###.173.15:23
- 20#.##4.11.140:23
- 23#.##4.244.253:23
- 21#.##6.68.22:23
- 23#.##8.165.13:23
- 18#.##3.113.169:23
- 66.###.227.154:23
- 25#.##5.197.166:23
- 21.##.12.81:23
Receives data from the following servers:
- 45.###.232.208:33335
