Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e28081
Kills the following processes:
- kthreadd
- rcu_gp
- rcu_par_gp
- kworker/0:0
- kworker/0:0H
- kworker/u2:0
- mm_percpu_wq
- rcu_tasks_rude_
- rcu_tasks_trace
- ksoftirqd/0
- rcu_sched
- migration/0
- cpuhp/0
- kdevtmpfs
- netns
- kauditd
- khungtaskd
- oom_reaper
- writeback
- kcompactd0
- ksmd
- khugepaged
- kintegrityd
- kblockd
- blkcg_punt_bio
- edac-poller
- devfreq_wq
- kworker/0:1H
- kworker/0:2
- kswapd0
- kthrotld
- acpi_thermal_pm
- ipv6_addrconf
- kworker/u2:1
- kstrp
- zswap-shrink
- kworker/u3:0
- ata_sff
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- jbd2/sda1-8
- ext4-rsv-conver
- ttm_swap
- kworker/u2:4
- kworker/0:1
- 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##me.xyz
Sends data to the following servers:
- 45.###.232.208:33335
- 18#.##9.214.253:23
- 36.###.219.25:23
- 53.###.211.44:23
- 14#.##0.23.165:23
- 84.###.125.77:23
- 43.###.235.34:23
- 17#.##7.192.224:23
- 18#.#.223.143:23
- 4.###.4.122:23
- 11#.##7.192.136:23
- 16#.##1.196.19:23
- 67.###.85.204:23
- 17#.##8.184.243:23
- 64.##.217.151:23
- 70.##.44.194:23
- 24#.##.45.140:23
- 20#.##5.207.111:23
- 19#.##2.235.0:23
- 22#.##.115.224:23
- 91.###.196.38:23
- 19#.#.189.215:23
- 93.##.248.114:23
- 32.##6.39.28:23
- 18#.##6.208.175:23
- 24#.##.205.41:23
- 63.###.73.172:23
- 18#.##9.250.108:23
- 43.###.254.122:23
- 22#.##8.251.161:23
- 72.##7.146.9:23
- 21#.##.29.196:23
- 1.##.114.183:23
- 15#.#.22.131:23
- 57.##.251.132:23
- 12#.##.57.196:23
- 16.##.68.49:23
- 9.##.210.138:23
- 10#.#.226.181:23
- 22#.##.158.115:23
- 13#.##5.143.183:23
- 37.##.123.249:23
- 19.###.48.223:23
- 21#.##8.112.46:23
- 13#.##.22.120:23
- 47.##.61.11:23
- 11#.##.220.59:23
- 10#.##.150.183:23
- 15#.#.178.105:23
- 15#.#1.74.5:23
- 23#.##1.67.224:23
- 37.###.157.141:23
- 11#.##5.13.105:23
- 11#.##3.220.82:23
- 32.##3.9.52:23
- 15#.##5.35.116:23
- 17#.##5.220.197:23
- 19#.##.189.98:23
- 12#.##1.85.245:23
- 5.###.165.129:23
- 17#.##2.144.73:23
- 70.###.165.34:23
- 2.##.23.236:23
- 10#.##.162.41:23
- 20.###.64.149:23
- 13#.#.78.104:23
- 9.###.8.219:23
- 22#.##6.231.154:23
- 57.#.56.152:23
- 18#.##.188.214:23
- 10#.##0.204.70:23
- 12#.##0.212.173:23
- 20#.##.115.46:23
- 66.###.57.251:23
- 44.##8.83.6:23
- 63.##.149.228:23
- 21#.##4.159.132:23
- 1.##.153.142:23
- 12#.##0.215.204:23
- 15#.##.65.171:23
- 11#.#7.85.1:23
- 33.##.59.176:23
- 96.##.135.185:23
- 37.###.72.190:23
- 89.###.164.173:23
- 19.###.195.95:23
- 16.##.163.75:23
- 17#.##.190.132:23
- 22#.##4.253.82:23
- 11#.##7.248.146:23
- 12#.##.203.44:23
- 9.##.137.243:23
- 51.###.189.144:23
- 18#.##3.197.28:23
- 16#.##5.107.178:23
- 22#.##3.164.148:23
- 13#.##0.104.126:23
Receives data from the following servers:
- 45.###.232.208:33335
