Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- ZIGRuxpxnp4mpmGZVxeEIEpupnY2eZmepGn4E2VnzD4EEM
Kills the following processes:
- exim4
Network activity:
Establishes connection:
- 8.#.8.8:53
- 95.###.228.205:63042
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- sw##vin.xyz
Sends data to the following servers:
- 95.###.228.205:63042
- 17#.##0.150.122:23
- 12#.##2.117.176:23
- 11#.##.132.18:23
- 91.###.147.191:23
- 11#.##2.120.138:23
- 82.###.76.248:23
- 13#.##.112.116:23
- 32.###.179.76:23
- 22#.##6.197.32:23
- 49.###.10.176:23
- 10#.##2.37.84:23
- 90.##5.103.3:23
- 69.##.158.112:23
- 96.###.31.225:23
- 11#.##3.3.104:23
- 11#.##3.203.160:23
- 20#.##2.176.144:23
- 13#.##8.68.33:23
- 91.##.151.83:23
- 11#.##4.38.84:23
- 10#.##.205.236:23
- 20#.##1.178.33:23
- 81.###.249.71:23
- 21#.##.169.98:23
- 18#.##0.135.19:23
- 99.###.58.230:23
- 59.##.76.216:23
- 77.##.136.66:23
- 10#.##.214.138:23
- 18#.##8.98.27:23
- 16#.##.58.208:23
- 79.###.229.233:23
- 78.##.143.173:23
- 18#.##4.22.133:23
- 53.###.110.253:23
- 51.###.224.252:23
- 16#.##6.149.179:23
- 11#.##.15.233:23
- 14#.##.242.171:23
- 14#.##4.248.186:23
- 84.##.6.118:23
- 17.#.170.212:23
- 12#.##8.64.113:23
- 19#.##.147.34:23
- 13#.##.216.52:23
- 22#.##1.82.77:23
- 69.##.244.8:23
- 13.#.69.117:23
- 15#.##8.16.146:23
- 41.###.193.183:23
- 76.###.60.104:23
- 5.###.3.71:23
- 17#.##.131.241:23
- 16#.#4.41.26:23
- 24.##4.15.70:23
- 20#.##.219.215:23
- 32.###.169.214:23
- 12#.##8.198.103:23
- 17.###.205.200:23
- 12.##.135.174:23
- 12#.##2.114.33:23
- 95.###.50.237:23
- 17#.##.105.159:23
- 18.###.37.130:23
- 39.###.112.177:23
- 15#.##3.187.58:23
- 89.##.30.225:23
- 13#.##2.122.121:23
- 16#.##.184.166:23
- 40.##.165.66:23
- 11#.##.188.212:23
- 17#.##7.150.220:23
- 14#.##8.36.161:23
- 10#.##3.180.96:23
- 13#.##.36.244:23
- 21#.##4.17.89:23
- 45.##.233.38:23
- 35.###.184.93:23
- 41.###.172.254:23
- 20#.##6.71.84:23
- 17.#.12.75:23
Receives data from the following servers:
- 95.###.228.205:63042
