Technical Information
Malicious functions:
Launches itself as a daemon
Kills system processes:
- sshd
Kills the following processes:
- rpc.idmapd
- cron
- atd
- systemd-logind
- rsyslogd
- dbus-daemon
- agetty
- exim4
- bash
- run.sh
- kworker/u2:1
Network activity:
Establishes connection:
- 80.###.134.53:666
- 8.#.8.8:53
- 80.###.134.53:374
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 54.###.171.118:23
- 19.###.178.21:23
- 91.###.246.10:23
- 76.##.134.126:23
- 75.##.65.157:23
- 11#.##6.169.245:23
- 19#.##4.69.43:23
- 21#.##0.174.209:23
- 13#.##.51.215:23
- 21#.##6.207.48:23
- 16#.##5.195.62:23
- 10#.##3.36.231:23
- 16#.##8.49.81:23
- 59.###.180.103:23
- 13#.##2.187.220:23
- 47.###.184.117:23
- 14#.##.75.170:23
- 20#.#1.25.51:23
- 88.##.191.17:23
- 80.##.32.202:23
- 36.###.218.56:23
- 11#.##.156.160:23
- 16#.##.178.43:23
- 19#.##.173.255:23
- 5.#.#37.62:23
- 12#.##4.218.38:23
- 25.##.84.239:23
- 18#.#27.6.33:23
- 83.##3.43.87:23
- 19#.##6.16.214:23
- 2.###.79.203:23
- 11#.##8.67.79:23
- 41.##9.70.20:23
- 32.###.189.134:23
- 47.###.81.157:23
- 20#.##7.199.132:23
- 79.##.226.80:23
- 41.##.0.209:23
- 40.##1.52.94:23
- 77.##9.31.1:23
- 54.###.113.93:23
- 16#.##1.179.50:23
- 14#.##9.59.180:23
- 8.###.192.102:23
- 25.##5.0.252:23
- 15#.#8.9.71:23
- 12#.##7.106.149:23
- 20#.##7.44.89:23
- 21#.##7.120.29:23
- 77.##.41.103:23
- 53.##0.2.17:23
- 74.##.232.246:23
- 13#.##6.41.251:23
- 11#.##.108.18:23
- 11#.##2.44.69:23
- 12#.##.16.170:23
- 19#.#4.153.4:23
- 10#.##.139.127:23
- 91.##.138.46:23
- 14#.##.143.216:23
- 63.###.107.242:23
- 27.###.185.73:23
- 80.###.219.87:23
- 59.#.223.17:23
- 76.##.252.197:23
- 11#.##8.171.1:23
- 14#.##2.79.187:23
- 15#.##1.32.196:23
- 83.###.118.200:23
- 87.#.37.144:23
- 13#.##6.210.91:23
- 53.##7.191.7:23
- 23.##.105.234:23
- 60.###.102.246:23
- 78.###.116.17:23
- 20#.##4.110.111:23
- 50.##.207.22:23
- 17#.##4.176.244:23
- 38.###.196.36:23
- 18#.##4.130.220:23
- 15#.##1.88.23:23
- 15#.##3.222.102:23
- 14#.##7.2.197:23
- 15#.#.34.121:23
- 14#.##.17.208:23
- 86.#.61.108:23
- 21#.##7.112.80:23
- 11#.##0.123.3:23
- 16#.##1.125.16:23
- 54.##1.96.83:23
- 13#.##.199.167:23
- 19#.##4.34.23:23
- 17#.##0.130.144:23
- 20#.##.165.198:23
- 20#.#.28.115:23
- 13#.##.214.229:23
- 12#.##4.198.166:23
- 20#.##8.94.136:23
- 16#.##.207.233:23
- 12#.##7.153.233:23
- 21#.##.188.199:23
- 45.###.120.44:23
- 12#.##3.171.7:23
- 17#.##3.130.252:23
- 48.##.42.133:23
- 21#.##5.188.84:23
- 12.##.246.131:23
- 43.##.200.1:23
- 51.###.83.119:23
- 19#.##3.128.42:23
- 38.###.212.176:23
- 17.##.3.175:23
- 82.###.242.138:23
- 18#.##.190.119:23
- 17#.##6.26.154:23
- 14#.##0.52.51:23
- 76.##.123.37:23
- 20#.##0.54.234:23
- 20#.##.180.161:23
- 70.#.2.110:23
- 15#.#.185.238:23
- 20#.##.212.112:23
- 11#.##8.224.219:23
- 34.###.87.158:23
- 45.##.43.77:23
- 22#.##4.38.32:23
- 18.###.65.205:23
- 19#.##1.50.186:23
- 13#.##5.240.105:23
- 97.##.201.13:23
- 71.##.119.232:23
- 10#.##.241.65:23
- 86.##.63.158:23
- 14#.##.84.126:23
- 91.###.169.67:23
- 54.##.175.216:23
- 14.##.229.171:23
- 17#.##4.75.71:23
- 13#.##7.147.151:23
- 19.###.176.154:23
- 95.##9.189.4:23
- 25.##.16.151:23
- 95.##.211.145:23
- 93.##.69.166:23
- 21#.##0.69.220:23
- 13#.##.14.165:23
- 17#.##2.224.202:23
- 16#.##.195.118:23
- 1.###.190.10:23
- 21#.##.165.44:23
- 14.##.111.161:23
- 21#.##.131.209:23
- 97.##.225.28:23
- 41.###.155.231:23
- 11#.#0.74.90:23
- 16#.##.167.254:23
- 20#.##2.17.231:23
- 18#.#3.69.24:23
- 12#.##1.118.191:23
- 20#.##9.209.245:23
- 23.##.202.99:23
- 36.###.78.157:23
- 19#.##.253.91:23
- 12#.##0.63.131:23
- 12#.##4.15.143:23
- 17.###.118.218:23
- 18#.##.167.100:23
- 71.###.96.243:23
- 23.###.24.196:23
- 36.##.138.130:23
- 13#.##8.130.212:23
- 11#.##5.57.154:23
- 35.##.61.28:23
- 14#.##2.102.79:23
- 12#.##.112.162:23
- 15#.##6.103.12:23
- 12#.##8.162.159:23
- 21#.##.162.61:23
- 15#.##8.207.178:23
- 10#.##2.27.240:23
- 41.###.177.154:23
- 15#.##6.183.40:23
- 72.###.240.192:23
- 10#.##.157.110:23
- 87.###.37.241:23
- 11#.##6.211.247:23
- 17.##.224.240:23
- 65.##.193.89:23
- 19#.##7.14.108:23
- 13#.##.220.45:23
- 12#.##6.250.151:23
- 18#.##.64.194:23
- 84.###.76.110:23
- 9.##.144.67:23
- 16#.##7.208.234:23
- 18#.##3.196.132:23
- 64.###.22.101:23
- 71.###.167.43:23
- 19#.##0.242.245:23
- 20#.##3.97.83:23
- 21#.##9.5.231:23
- 45.##.168.62:23
- 15#.##1.38.161:23
- 21#.##.241.229:23
- 91.#.250.23:23
- 18#.##9.0.200:23
- 70.###.178.121:23
- 17#.##.114.71:23
- 63.###.149.68:23
- 64.###.78.182:23
- 14#.##.136.181:23
- 62.##.54.13:23
- 50.##.69.0:23
- 20#.##6.97.159:23
- 14#.##.230.238:23
- 39.###.175.178:23
- 14#.##0.83.16:23
- 13#.##.37.192:23
- 13#.##3.148.204:23
- 17#.##5.0.178:23
- 11#.#3.73.61:23
- 17#.##1.203.44:23
- 13.#.227.19:23
- 13#.##.254.212:23
- 16#.##7.254.157:23
- 67.###.14.122:23
- 4.###.230.38:23
- 15#.##.249.89:23
- 22#.##6.150.250:23
- 24.##.214.26:23
- 13#.##.183.61:23
- 65.##.28.42:23
- 38.###.115.210:23
- 66.###.231.17:23
- 16#.#.189.181:23
- 41.###.109.232:23
- 18#.##7.163.168:23
- 15#.##.106.167:23
- 17.###.251.52:23
- 17#.##2.50.70:23
- 67.###.164.120:23
- 12#.##4.98.224:23
- 14#.##.148.18:23
- 12#.##4.107.127:23
- 34.###.77.145:23
- 17#.##.15.125:23
- 16#.#1.22.59:23
- 25.##.163.50:23
- 20.##.65.255:23
- 12#.##1.187.248:23
- 10#.##.225.146:23
- 57.##.52.125:23
- 12#.##2.186.47:23
- 18#.##.248.40:23
- 91.##.173.99:23
- 12.##.218.165:23
- 68.###.26.224:23
- 15#.##.198.211:23
- 19#.##5.242.40:23
- 13#.#27.62.4:23
- 76.###.96.210:23
- 22#.##2.144.222:23
- 40.##.36.152:23
- 14#.##9.231.43:23
- 16#.##.112.18:23
- 17#.##5.174.211:23
- 14#.##6.215.234:23
- 81.###.202.124:23
- 20.#.178.10:23
- 17.###.112.196:23
- 17#.##6.165.178:23
- 81.###.120.105:23
- 21#.##.228.55:23
- 21#.##1.203.252:23
- 9.###.2.208:23
- 15#.##.17.235:23
- 42.###.139.44:23
- 12#.##.152.233:23
- 42.###.92.125:23
- 2.#.#56.170:23
- 13#.##8.118.252:23
- 44.###.57.233:23
- 15#.##.33.136:23
- 57.###.193.134:23
- 17#.##.160.54:23
- 71.###.168.192:23
- 40.###.152.144:23
- 21#.##.44.187:23
- 11#.##.100.244:23
- 17#.##3.127.87:23
- 16#.##.237.91:23
- 17#.#.107.245:23
- 16#.##2.74.231:23
- 17#.##3.71.137:23
- 42.##.36.164:23
- 72.###.126.114:23
- 5.##.202.13:23
- 19.##.91.62:23
- 40.##.31.101:23
- 20#.##8.57.152:23
- 18#.##5.40.221:23
- 19#.#.122.213:23
- 21#.##6.120.225:23
- 96.###.28.139:23
- 19#.##1.11.110:23
- 16#.##7.194.117:23
- 17.##0.1.157:23
- 21#.##.163.40:23
- 53.##.145.113:23
- 37.##0.134.3:23
- 47.###.122.17:23
- 8.##.240.34:23
- 10#.##3.58.213:23
- 10#.##.120.240:23
- 14#.##8.19.177:23
- 97.###.241.226:23
- 89.##.45.237:23
- 20#.##.115.148:23
- 9.##.43.2:23
- 16#.##5.226.230:23
- 71.###.153.32:23
- 94.##.41.113:23
- 80.###.216.248:23
- 98.##.192.223:23
- 15#.##8.112.133:23
- 60.##.184.168:23
- 25.##.22.237:23
- 87.##2.27.68:23
- 20#.##3.71.30:23
- 53.##.222.49:23
- 11#.##7.254.162:23
- 17#.##9.89.151:23
- 17#.##3.173.115:23
- 20#.##0.246.48:23
- 13#.##.52.224:23
- 20#.##0.144.7:23
- 90.##.247.70:23
- 14#.##7.49.59:23
- 20#.#.118.252:23
- 47.#.127.49:23
- 12#.##4.138.156:23
- 20#.#.92.106:23
- 14#.##7.12.217:23
- 19.###.37.140:23
- 36.###.219.230:23
- 11#.##.41.132:23
- 15#.##8.89.228:23
- 49.##.108.167:23
- 11#.##9.188.101:23
- 15#.##8.64.162:23
- 19#.##0.166.158:23
- 19#.##6.196.254:23
- 20#.##.175.247:23
- 64.##.59.134:23
