Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Network activity:
Awaits incoming connections on ports:
- 19#.###.218.50:23952
- 0.0.0.0:10000
Establishes connection:
- 8.#.8.8:53
- 20#.###.126.254:5714
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 20#.###.126.254:5714
- 11#.##9.199.27:23
- 22#.##1.136.149:23
- 20#.##3.97.235:23
- 93.###.75.200:23
- 42.###.246.129:23
- 11#.##.16.182:23
- 97.##.33.182:23
- 15#.##4.193.48:23
- 46.###.221.156:23
Receives data from the following servers:
- 20#.###.126.254:5714
