Technical Information
Malicious functions:
Substitutes application name for:
- b-scheduler
- b-http
- b-httpworker.0
- b-httpworker.1
- b-httpworker.3
- b-httpworker.2
- b-loadblk
- b-torcontrol
- b-net
- b-dnsseed
- b-opencon
- b-addcon
- b-msghand
Launches processes:
- tor -f -
Kills the following processes:
- /bin/tor
Performs operations with the file system:
Creates folders:
- /root/.bitcoin
- /root/.bitcoin/wallets
- /root/.bitcoin/blocks
- /root/.bitcoin/blocks/index
- /root/.bitcoin/chainstate
Creates or modifies files:
- /root/.bitcoin/settings.json.tmp
- /root/.bitcoin/7594-ae4c-ece9-2896
- /root/.bitcoin/.lock
- /root/.bitcoin/6e91-09c6-bbcf-11e6
- /root/.bitcoin/bitcoind.pid
- /root/.bitcoin/debug.log
- /root/.bitcoin/.cookie.tmp
- /root/.bitcoin/banlist.080e
- /root/.bitcoin/blocks/index/LOCK
- /root/.bitcoin/blocks/index/MANIFEST-000001
- /root/.bitcoin/blocks/index/000001.dbtmp
- /root/.bitcoin/blocks/index/000003.log
- /root/.bitcoin/blocks/index/MANIFEST-000002
- /root/.bitcoin/blocks/index/000002.dbtmp
- /root/.bitcoin/blocks/blk00000.dat
- /root/.bitcoin/chainstate/LOCK
- /root/.bitcoin/chainstate/MANIFEST-000001
- /root/.bitcoin/chainstate/000001.dbtmp
- /root/.bitcoin/chainstate/000003.log
- /root/.bitcoin/chainstate/MANIFEST-000002
- /root/.bitcoin/chainstate/000002.dbtmp
- /root/.bitcoin/peers.f26a
Deletes files:
- /root/.bitcoin/7594-ae4c-ece9-2896
- /root/.bitcoin/6e91-09c6-bbcf-11e6
- /root/.bitcoin/blocks/index/MANIFEST-000001
- /root/.bitcoin/chainstate/MANIFEST-000001
- /root/.bitcoin/tor/controlport.env
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:8332
- 0.0.0.0:8333
- 127.0.0.1:8334
Establishes connection:
- 127.0.0.1:9051
- <LOCAL_DNS_SERVER>
- 58.###.228.180:0
- 79.###.236.153:0
- 13.##9.12.139:0
- 3.##.1.181:0
- 78.##.18.232:0
- 73.###.126.217:0
- 11#.#2.34.104:0
- 78.##.58.219:0
- 84.##.137.116:0
- 3.###.125.70:0
- 89.###.192.204:0
- 88.##.33.176:0
- 93.###.168.166:0
- 35.##7.109.49:0
- 18#.##3.168.98:0
- 12#.##6.133.100:0
- 13#.#6.170.96:0
- 14#.##0.157.215:0
- 11#.#9.241.85:0
- 49.##.240.25:0
- 79.###.132.162:0
- 13.##1.223.46:0
- 78.##.207.111:0
- [2#########8:6ab8:cfd:a78:9239:85d7]:0
- [2#######1:bb2:4300::4867]:0
- [2##########:79fb:2408:1ca7:9725:b8f2]:0
- [2#########8:6ab8:4aa:1bf1:fa42:a979]:0
- [2##########b2:ea01:fbda:d797:30c4:ea0e]:0
- [2#########8:6ab8:c24:1d67:d15a:d49e]:0
- [2#########8:6ab8:8f0:378a:fadc:b074]:0
- [2##########:79fb:3020:2c86:9d89:653b]:0
- [2##########:6ab8:1842:1c7b:ae94:92b4]:0
- [2#########7:9e76:c5e:3faf:4dad:70ca]:0
- [2##########:9e76:107d:2b96:2aa9:22dc]:0
- [2##########f0:9e:e665:dcdb:57cd:600a]:0
- [2#########8:6ab8:851:21ff:923c:c28]:0
- 79.###.236.153:8333
- 70.##.240.142:0
- 17#.##.132.123:0
- 91.##.35.46:0
- 15#.##.187.247:0
- 3.##.190.111:0
- 78.##1.225.96:0
- 15#.#5.130.79:0
- 73.##.183.172:0
- 5.###.189.151:0
- 99.##2.32.222:0
- 16#.##9.161.112:0
- 47.##.21.168:0
- 88.##.164.26:0
- 16#.#1.73.244:0
- 62.##.198.189:0
- 85.##.95.54:0
- 84.###.177.143:0
- 17#.##8.236.196:0
- 34.##.160.87:0
- 54.##2.5.201:0
- 17#.#.106.115:0
- 91.###.135.106:0
- 89.##.97.110:0
- 31.##.8.32:0
- 5.###.56.53:0
- 18#.#07.46.32:0
- 18#.##0.175.217:0
- 18#.##.170.113:0
- 17#.##3.217.236:0
- 16#.##9.88.174:0
- 15#.##6.211.78:0
- 15#.#6.228.40:0
- 10#.##8.220.199:0
- 10#.##1.245.164:0
- 94.###.238.212:0
- 91.##1.52.200:0
- 90.###.252.107:0
- 82.##.23.195:0
- 79.##.159.7:0
- 77.##1.24.146:0
- 74.###.232.237:0
- 72.###.162.178:0
- 65.##.71.6:0
- 34.##.225.151:0
- [2######4a:5e7f:8420::60]:0
- [2##########e27:e390:b669:21ff:fed0:ac46]:0
- [2######80:0:10b::3faf]:0
- [2#########4e3:1:c505:37a2:c953:2a55]:0
- [2##########232:1:741b:89f0:8b5c:83a7]:0
- [2##########aa:90:c78b:ecad:d575:db1b]:0
- [2##########f8:f200:11b1:397e:48a0:65f6]:0
- [2########2b0:db32:0:1:4953:674f]:0
- [2###########1501:200:5efe:166.111.28.254]:0
- [2######00:2a0a:1::102]:0
- 91.##0.183.14:0
- 45.##.244.58:0
- 31.##.193.243:0
- 66.###.209.243:0
- 8.###.41.142:0
- 11#.##4.190.203:0
- 64.###.122.244:0
- 19#.##.132.237:0
- 12#.#1.34.19:0
- 88.###.220.136:0
- 41.###.122.191:0
- 21#.##9.139.115:0
- 66.##.133.150:0
- 12#.##5.222.117:0
- 14#.##.167.208:0
- 17#.##8.233.34:0
- 17#.##5.42.126:0
- 18#.#32.52.55:0
- 79.###.248.130:0
- 89.##8.240.57:0
- [2######0:462:38f::1000]:0
- [2#########c0:827:225:90ff:fee3:34a6]:0
- [2##########3e1:4900:4024:c335:eff0:8719]:0
- [f##########b43:d090:d8f9:467f:cba9:10ac]:0
- [f##########b43:d963:3706:f751:947b:26ff]:0
- [2######80:5:c2::d329]:0
- [2######f0:6801:6ec:2::1]:0
- [2#######0:9100:f300::bcbc]:0
- [2##########103:5ecf:cc29:ccff:fe42:300c]:0
- [2#########3880:c:e5f0:227e:ae3e:d67]:0
- [2######d0:203:8f46::]:0
- [2##########37:4800:21e:67ff:fea8:d798]:0
- 39.##1.206.20:0
- 54.##8.129.38:0
- 17#.#3.223.91:0
- 3.###.222.89:0
- 18#.##1.120.21:0
- 34.##8.45.5:0
- 15#.##5.213.198:0
- 18.###.209.177:0
- 10#.##9.101.216:0
- 54.###.244.249:0
- 3.###.91.77:0
- 64.##.72.92:0
- 82.###.131.172:0
- 78.##.26.146:0
- 46.##.20.203:0
- 52.##.105.31:0
- 11#.##.122.174:0
- 18#.#.41.130:0
- 13.##4.74.157:0
- 34.##1.70.182:0
- 10#.#9.63.159:0
- 58.###.213.139:0
- 52.##4.211.45:0
- 10#.##2.104.227:0
- 47.##.247.22:0
- [2##########5:a270:f543:bec3:e577:cd38]:0
- [2######40:1::100:220]:0
- [2#####140::44:130]:0
- [2##########821:77:be76:4eff:fe10:c7f6]:0
- [2##########3:2301:219b:2e04:298c:bd77]:0
- [2##########64:fa42:824:7dff:fe2a:26ee]:0
- [2######8:151:2054::2]:0
- [2#####70:25:7c8::2]:0
- [2##########0e:e300:cea2:19ef:fa3a:e125]:0
- [2##########0:58f:8768:8283:1a62:bdc6]:0
- [2#######4:6a1:3800::aa13]:0
- [2##########0ad:53b0:280:64ff:fee2:9288]:0
- 18#.##.212.112:0
- 19#.##1.204.68:0
- 15#.##3.91.166:0
- 46.###.138.202:0
- 35.##5.143.50:0
- 34.##.152.209:0
- 35.###.103.242:0
- 15#.#30.1.157:0
- 11#.##2.51.176:0
- 3.###.212.89:0
- 3.##.232.168:0
- 66.##.128.146:0
- 89.###.224.112:0
- 18#.##3.103.156:0
- 91.##1.181.6:0
- 62.###.139.138:0
- 39.##.232.25:0
- 35.##1.9.3:0
- 5.#.37.73:0
- 5.###.92.183:0
- 17#.#.32.126:0
- 14#.##.202.234:0
- 16#.##7.180.166:0
- [2######8:161:214e::2]:0
- [2#####1d0:2:590f::1]:0
- [2######c0:3:e0::31:a001]:0
- [2######d0:303:a309::]:0
- [2#####70:8:7b3::9]:0
- [2##########75:6c03:823:e720:1500:3258]:0
- [2#######:96a:9300::ad:ae2c]:0
- [2##########55:4001:8d52:ae42:b79f:b5b1]:0
- [2##########010:3662:79de:e9ce:8e9a:a81b]:0
- [2#######d:91a9::5dbd:91a9]:0
- [2##########010:3662:ed6c:fcb8:b2ab:6168]:0
- [2#########9d4:10:385b:8cc:144f:6118]:0
- [2##########de:600:1e69:7aff:fe6f:200f]:0
- 70.##.174.212:0
- 42.###.161.193:0
- 23.##.85.16:0
- 13.###.203.245:0
- 8.###.82.155:0
- 47.##7.1.5:0
- 46.##3.211.21:0
- 35.###.216.185:0
- 31.##.191.54:0
- 13.##2.96.45:0
- 13.###.122.226:0
- 10#.##3.166.43:0
- 16#.#72.5.199:0
- 98.##8.129.16:0
- 82.##1.143.75:0
- 71.##.253.7:0
- 19#.#45.61.76:0
- 81.##6.63.70:0
- 47.##.76.141:0
- 34.##.70.59:0
- 11#.#02.56.80:0
- 87.##3.107.20:0
- 18#.#8.209.27:0
- 21#.#4.48.89:0
- 34.###.179.213:0
- [2######8:200:94d4::2]:0
- [2#####1d0:602:b1a::]:0
- [2##########:c38c:3c30:729e:43d7:dcf0]:0
- [2##########9:b000:4c1d:75d6:f396:c5a5]:0
- [2######00:1:34c::2:1002]:0
- [2######8:cc8::1:10:88]:0
- [2##########8f:5200:a5c4:486e:5f71:a331]:0
- [2######d0:700:3020::]:0
- [2##########7b:3c00:13eb:588c:fbd2:d46f]:0
- [2##########3e1:4900:75a8:fa61:788f:5fc]:0
- [2#####f8:211:a58::4]:0
- [2##########564:0:9c1c:cc31:9fe8:5505]:0
- [2#####1d0:1:b40d::1]:0
- [2#######0:100:d0::a56:c001]:0
- 74.###.124.243:0
- 95.##6.53.163:0
- 95.##6.76.224:0
- 85.##4.136.45:0
- 16#.##9.165.226:0
- 5.#.#7.183:0
- 13.###.218.145:0
- 18.##3.100.62:0
- 5.#.#04.197:0
- 19#.##6.103.234:0
- 18#.##4.39.181:0
- 10#.##.168.100:0
- 52.##.229.86:0
- 19#.##4.116.20:0
- 83.##0.52.153:0
- 3.##.88.180:0
- 24.##6.152.6:0
- 66.##1.201.18:0
- 13.##4.29.164:0
- 18#.#91.0.203:0
- 51.###.126.177:0
- 52.###.156.205:0
- 73.##6.48.212:0
- [2########a000:4140::ffff:191]:0
- [2##########27f:fbd8:b8b4:3394:6d52:7d31]:0
- [2##########c1:20:92e2:baff:fe30:1f8e]:0
- [2##########2a:5703:5183:c603:9aaa:f74e]:0
- [2#########379:1:7b70:e228:17fe:1d47]:0
- [2####470:1b55::]:0
- [2#####70:1aa1:30::3]:0
- [2#####70:28:88::100]:0
- [2#########:99d:1c34:5022:ce52:9ee6]:0
- [2#####70:a:c13::2]:0
- [2#########00:7:d6a9:fcf4:e78d:2d82]:0
- [2#######0:100:d0::a49:a001]:0
- [2##########1b:7600:cc4e:d565:8422:5a3b]:0
- 16#.##2.61.154:0
- 50.##.191.88:0
- 46.##.2.220:0
- 46.##1.238.40:0
- 67.##1.0.111:0
- 17#.#3.241.24:0
- 3.###.19.130:0
- 95.###.180.216:0
- 16#.##.117.111:0
- 16#.##.112.247:0
- 14#.#6.138.23:0
- 92.##1.20.232:0
- 86.##0.16.248:0
- 3.###.33.179:0
- 74.###.175.108:0
- 35.##4.108.75:0
- 14#.#78.64.10:0
- 78.##.151.58:0
- 49.##7.215.43:0
- 34.##.148.44:0
- 16#.#1.57.166:0
- 73.##.70.127:0
- 2.###.66.182:0
- 54.##3.12.170:0
- 81.##.130.127:0
- [2##########69f:7900:211:32ff:fe9f:64ab]:0
- [2##########72:5620:cc52:7b64:ffe2:3704]:0
- [2######b6:5e4e:1::1007]:0
- [2#####f9:2a:9e7::4]:0
- [2######d0:303:68cd::]:0
- [2##########:3400:947b:1bfe:206e:8bdd]:0
- [2#########3564:0:88e:b4ff:2ad0:699b]:0
- [2#######0:cad:d0::d86:1001]:0
- [2######8:151:8041::2]:0
- [2#######0:700:253e::beef]:0
- [2######a:252:6bd0::2]:0
- [2#########dc0:51:216:3eff:fe72:2b13]:0
- [2#####1d0:8:d644::1]:0
- [2##########d3:2401:a00a:3a94:d26b:99e1]:0
- [2######0:28:88::100]:8333
- 5.###.92.183:8333
- 52.###.211.45:8333
DNS ASK:
- x9.####.##tcoin.jonasschnelli.ch
- x9.####.btc.petertodd.org
- x9.####eed.bluematt.me
- x9.####.bitcoin.wiz.biz
- x9.####.bitcoinstats.com
- x9.######d.bitcoin.dashjr.org
- x9.####.bitcoin.sipa.be
- x9.####.#itcoin.sprovoost.nl
- x9.###seed.emzy.de
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
