Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e28081
Kills the following processes:
- kthreadd
- rcu_gp
- rcu_par_gp
- kworker/0:0
- kworker/0:0H
- kworker/u2:0
- mm_percpu_wq
- ksoftirqd/0
- rcu_sched
- rcu_bh
- migration/0
- cpuhp/0
- kdevtmpfs
- netns
- kauditd
- khungtaskd
- oom_reaper
- writeback
- kcompactd0
- ksmd
- crypto
- kintegrityd
- kblockd
- ata_sff
- devfreq_wq
- watchdogd
- kworker/0:1H
- kswapd0
- kthrotld
- ipv6_addrconf
- kworker/u2:2
- kstrp
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- kworker/0:2
- kworker/u3:0
- jbd2/sda1-8
- ext4-rsv-conver
- kworker/0:1
- 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##me.xyz
Sends data to the following servers:
- 45.###.232.208:33335
- 10#.##.120.140:23
- 12#.#.2.169:23
- 24#.##6.89.212:23
- 15.##2.216.9:23
- 31.##.16.75:23
- 71.###.147.192:23
- 19#.##.117.135:23
- 12#.##9.142.128:23
- 12.###.35.223:23
- 11#.##5.218.246:23
- 19#.##0.211.129:23
- 15#.##2.245.149:23
- 19#.##.111.86:23
- 65.##.209.204:23
- 94.###.41.204:23
- 16#.#3.6.93:23
- 22#.##3.216.240:23
- 23#.##.241.115:23
- 13#.##.232.253:23
- 49.###.233.68:23
- 13#.#7.14.92:23
- 12#.#5.74.88:23
- 65.##.158.59:23
- 15#.##6.141.248:23
- 24#.##.121.65:23
- 21#.##8.197.33:23
- 13#.##1.152.95:23
- 94.###.60.144:23
- 18#.##1.42.38:23
- 11#.##.115.67:23
- 12#.#6.101.1:23
- 44.##9.51.20:23
- 21#.##7.112.228:23
- 12#.##.188.160:23
- 10#.##.144.155:23
- 10#.#.233.9:23
- 78.###.108.194:23
- 13#.##.146.122:23
- 50.##.151.113:23
- 24#.##2.30.147:23
- 32.##7.79.96:23
- 13#.##5.136.33:23
- 14#.##1.140.101:23
- 12#.##0.204.207:23
- 22#.##.237.57:23
- 12#.#6.60.42:23
- 22.###.174.167:23
- 19#.##9.7.114:23
- 52.##.140.115:23
- 24#.##.237.136:23
- 95.###.100.216:23
- 67.###.21.232:23
- 34.##5.108.2:23
- 13#.##8.239.66:23
- 6.###.105.233:23
- 40.##.49.71:23
- 93.##.44.152:23
- 75.##.167.125:23
- 16#.##.254.190:23
- 40.###.160.103:23
- 24#.#.231.216:23
- 41.###.103.50:23
- 36.###.223.244:23
- 10#.#58.7.13:23
- 79.###.241.162:23
- 38.##6.6.167:23
- 15#.##7.154.73:23
- 23#.##.181.58:23
- 24#.##.247.195:23
- 14#.##.194.148:23
- 66.###.26.140:23
- 17.###.127.34:23
- 22#.##.166.96:23
- 14#.##.224.109:23
- 14#.##.200.234:23
- 82.##.43.188:23
- 19#.##6.87.223:23
- 22#.##9.114.151:23
- 81.###.132.118:23
- 25#.##.89.111:23
- 99.###.107.115:23
- 84.##.140.228:23
- 16#.##0.242.5:23
- 15#.##.199.16:23
- 41.###.125.243:23
- 80.###.240.28:23
- 19#.##.23.158:23
- 18#.##5.211.9:23
- 17#.##1.86.185:23
- 83.##.76.59:23
- 19#.#3.62.17:23
- 5.#.#43.92:23
- 54.###.153.217:23
- 14#.##0.219.20:23
- 18#.##.146.216:23
- 19#.##.114.92:23
- 23#.##.74.138:23
- 13#.##9.68.157:23
- 17#.##1.34.21:23
- 4.###.43.135:23
- 17.##.23.247:23
- 22#.##.114.195:23
- 22#.#8.96.32:23
- 18#.##3.26.21:23
- 35.##3.43.23:23
- 87.##.57.136:23
- 23#.##2.197.221:23
- 53.##.245.217:23
- 73.###.221.21:23
- 61.##5.54.95:23
- 11#.##2.226.146:23
- 20#.##3.33.233:23
- 12#.##9.63.18:23
- 25#.##.81.166:23
- 11#.##.249.179:23
- 15#.##2.136.133:23
- 11#.##8.155.175:23
- 24#.##7.108.99:23
- 17#.##0.58.59:23
- 12#.##.155.69:23
- 97.###.224.12:23
- 17#.#85.30.6:23
- 2.###.122.49:23
- 18#.##4.220.253:23
- 18#.##0.226.174:23
- 24#.##.135.32:23
- 37.###.144.187:23
- 24#.#1.0.70:23
- 19#.##4.55.118:23
- 22#.##2.56.197:23
- 18#.##0.59.90:23
- 4.###.133.74:23
Receives data from the following servers:
- 45.###.232.208:33335
