Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e38387
Kills the following processes:
- systemd
- kthreadd
- ksoftirqd/0
- kworker/0:0H
- kworker/u2:0
- watchdog/0
- khelper
- kdevtmpfs
- netns
- khungtaskd
- writeback
- ksmd
- crypto
- kintegrityd
- bioset
- kblockd
- ata_sff
- kworker/0:1
- kswapd0
- fsnotify_mark
- kthrotld
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- ipv6_addrconf
- deferwq
- kworker/u2:2
- kworker/0:1H
- jbd2/sda3-8
- ext4-rsv-conver
- kauditd
- kworker/0:3
- systemd-journal
- systemd-udevd
- ttm_swap
- rpciod
- nfsiod
- systemd-logind
- kworker/0:0
- kworker/0:2
- dhclient
- 9bc2fd2a
- systemd-cgroups
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##me.xyz
Sends data to the following servers:
- 45.###.232.208:33335
- 13#.##1.188.10:23
- 68.##.202.190:23
- 16#.##1.42.48:23
- 82.###.167.216:23
- 98.###.192.127:23
- 17#.##1.248.183:23
- 58.##.41.196:23
- 14#.##6.149.150:23
- 17#.##.192.188:23
- 14#.##7.107.101:23
- 20#.##6.162.92:23
- 80.###.107.59:23
- 43.##2.154.6:23
- 73.##.67.81:23
- 72.##.235.76:23
- 89.#.223.205:23
- 13#.##3.190.1:23
- 21#.##2.119.7:23
- 95.###.143.125:23
- 25#.##5.176.22:23
- 88.##.7.178:23
- 70.###.175.212:23
- 24#.##8.206.174:23
- 43.###.166.124:23
- 16#.##1.169.212:23
- 10#.#0.56.3:23
- 14.###.49.218:23
- 14#.##1.165.85:23
- 91.##.173.232:23
- 53.###.108.30:23
- 11#.##8.186.25:23
- 93.###.238.188:23
- 75.##.174.230:23
- 85.###.102.130:23
- 76.###.31.146:23
- 22#.##7.183.99:23
- 39.###.28.199:23
- 19#.##2.82.145:23
- 40.##.73.156:23
- 19#.##8.240.160:23
- 23#.##7.54.173:23
- 23#.##6.15.37:23
- 21#.##9.193.103:23
- 10#.##2.84.29:23
- 16#.##9.247.41:23
- 16#.##0.139.162:23
- 18#.##6.45.23:23
- 10#.##6.255.168:23
- 10#.##6.200.32:23
- 22#.##8.142.34:23
- 24.##9.95.23:23
- 12#.##.89.159:23
- 53.###.249.137:23
- 12#.#.47.131:23
- 20#.##4.43.208:23
- 25#.##.41.216:23
- 19#.#.86.177:23
- 23#.##.40.127:23
- 23#.##2.30.105:23
- 44.##.51.72:23
- 22#.##.195.155:23
- 15#.##5.250.49:23
- 94.###.22.235:23
- 13#.##8.101.56:23
- 13#.##7.12.22:23
- 11#.##7.37.47:23
- 14#.#6.19.15:23
- 19#.##0.233.184:23
- 17#.##1.12.150:23
- 96.##.242.185:23
- 10#.##.87.104:23
- 74.##.130.243:23
- 18#.##2.10.156:23
- 15#.##4.76.214:23
- 14#.##.157.195:23
- 96.###.47.154:23
- 15#.##3.107.27:23
- 18#.##7.167.24:23
- 11.##.56.243:23
- 79.##6.239.1:23
- 19#.##1.157.85:23
- 70.###.65.110:23
- 35.##.134.53:23
- 11#.##0.167.176:23
- 29.##1.116.4:23
- 19#.##.182.247:23
- 14#.##.253.107:23
- 15#.#23.9.6:23
- 75.##.133.202:23
- 21#.##.165.86:23
- 20#.##5.115.65:23
- 19#.##5.127.105:23
- 21#.##1.189.43:23
- 57.##.76.121:23
- 13#.##9.237.129:23
- 25#.##.185.58:23
- 33.###.199.173:23
- 40.###.207.205:23
- 24#.##7.250.224:23
- 10#.##.246.179:23
- 28.##3.113.3:23
- 18#.##9.34.192:23
- 19#.##0.244.11:23
- 20#.##.120.15:23
- 58.#.215.40:23
- 17#.##.194.215:23
- 53.###.156.215:23
- 11#.##2.134.20:23
- 96.###.164.80:23
- 85.###.111.244:23
- 92.##.134.47:23
- 12#.##5.129.62:23
- 15#.##.218.190:23
- 24#.##5.26.100:23
- 10#.##5.134.13:23
- 24#.#.187.48:23
- 11#.##7.193.10:23
- 20#.##0.50.71:23
- 14#.##.55.181:23
- 13#.##3.10.63:23
- 15#.##.98.150:23
- 48.###.31.116:23
- 21#.##3.238.163:23
- 20#.##9.167.191:23
- 23#.##.129.214:23
- 18#.##2.55.72:23
- 43.###.104.200:23
- 55.##.54.106:23
- 55.##.29.139:23
- 15#.##.196.46:23
- 22#.##.174.36:23
- 13#.##.232.160:23
- 45.###.96.190:23
- 15#.##0.19.193:23
- 43.##4.111.5:23
- 20#.##7.57.216:23
- 19#.##3.122.36:23
- 13#.##.130.148:23
- 12#.##2.85.228:23
- 95.###.245.252:23
- 12#.##3.216.192:23
- 24#.##2.141.193:23
- 14.#.240.209:23
- 33.###.184.67:23
- 10#.##3.156.38:23
- 87.###.242.65:23
- 10#.##.171.238:23
- 45.###.245.119:23
- 10#.##0.247.229:23
- 12#.#0.9.135:23
- 12#.##.28.206:23
- 32.##.76.60:23
- 42.###.233.28:23
- 16#.##1.169.185:23
- 23#.##1.120.169:23
- 14.###.159.15:23
- 16#.##8.103.182:23
- 24#.##6.205.49:23
- 22#.##6.203.208:23
- 79.#.69.153:23
- 92.###.100.232:23
- 20#.#.13.18:23
- 21#.##.132.174:23
- 17#.##.195.240:23
- 44.##.158.16:23
- 21#.##.59.190:23
- 10#.##.144.57:23
- 33.##.17.3:23
- 10#.##.239.98:23
- 78.##0.71.78:23
- 20#.##9.148.95:23
- 59.###.201.151:23
- 13#.#5.31.33:23
- 24#.##4.112.253:23
- 74.###.107.64:23
- 10#.##.217.211:23
- 19#.##4.190.182:23
- 75.###.227.216:23
- 15#.##.10.124:23
- 39.##.10.216:23
- 12#.##5.186.68:23
- 20#.##.42.176:23
- 38.##.251.34:23
- 69.###.68.191:23
- 16#.##7.72.160:23
- 19#.##5.184.231:23
- 14#.##0.89.78:23
- 18#.##.241.49:23
- 61.###.106.66:23
- 19#.#2.4.82:23
- 15#.##7.51.145:23
- 14#.##4.35.132:23
- 25#.#.34.230:23
- 14#.##7.142.132:23
- 10#.##2.240.148:23
- 11#.##4.118.205:23
- 21#.##.135.101:23
- 34.###.52.130:23
- 56.##.77.183:23
- 23#.##9.176.22:23
- 21.###.187.33:23
- 29.##.48.99:23
- 14#.##6.123.226:23
- 20#.##.85.166:23
- 20#.##2.93.110:23
- 33.##.119.213:23
- 13#.##7.241.122:23
- 22#.##.131.18:23
- 40.###.245.92:23
- 18#.##3.217.228:23
- 89.###.105.115:23
- 96.###.232.41:23
- 18#.##.122.141:23
- 52.###.83.159:23
- 19#.##1.35.19:23
- 77.###.84.143:23
- 24#.##2.78.194:23
- 17#.##6.131.195:23
- 14#.##.193.206:23
- 57.##.113.220:23
- 21#.##8.54.18:23
- 10#.##3.142.133:23
- 16.##.182.128:23
- 65.###.238.233:23
- 21#.##.68.246:23
- 14#.##7.129.57:23
- 64.###.101.171:23
- 22#.#.131.62:23
- 99.###.26.220:23
- 49.##.34.177:23
- 21#.##0.51.103:23
- 17#.#3.17.88:23
- 21#.##5.224.216:23
- 37.##.126.161:23
- 19#.##2.75.146:23
- 21.##.101.175:23
- 16#.##.100.239:23
- 25#.##9.35.193:23
- 10#.#7.34.11:23
- 98.##.108.78:23
- 30.##.161.166:23
- 72.###.46.229:23
- 15.###.238.232:23
- 11#.##.178.132:23
- 21#.##.172.221:23
- 28.##.14.177:23
- 17#.##.154.162:23
- 20#.##7.250.142:23
- 79.##.114.156:23
- 20#.##7.53.237:23
- 3.###.68.36:23
- 22#.##6.26.138:23
- 12#.##3.239.107:23
- 24#.##.134.96:23
- 20#.#.118.216:23
- 72.##.234.18:23
- 24#.##2.121.43:23
- 10#.##2.111.101:23
- 21#.##.152.205:23
- 22#.##9.83.137:23
- 21#.##4.125.161:23
- 12#.##7.214.138:23
- 24#.##0.200.27:23
- 15#.##2.235.68:23
- 24#.##.181.165:23
- 16#.##0.126.21:23
- 20#.##9.187.198:23
- 24#.#.99.221:23
- 21#.##3.115.232:23
- 15#.##5.185.220:23
- 40.##.179.169:23
- 39.###.226.35:23
- 91.##2.51.3:23
- 10#.##8.162.32:23
- 17#.##2.167.6:23
- 88.##.42.20:23
- 72.#.135.65:23
- 56.###.189.195:23
- 51.###.237.33:23
- 11#.##.112.17:23
- 71.###.98.207:23
- 13.###.156.127:23
- 45.##.100.2:23
- 20#.##0.116.0:23
- 23#.##.237.251:23
- 13#.##9.111.193:23
- 64.###.135.29:23
- 16#.##.62.135:23
- 23#.##9.70.29:23
- 10#.##.167.37:23
- 16#.##6.54.100:23
- 12#.##.70.149:23
- 20#.##1.139.248:23
- 17#.##3.130.163:23
- 16.###.69.119:23
- 11#.##6.45.84:23
- 12#.##1.196.236:23
- 24#.##.167.33:23
- 31.###.150.146:23
- 24#.##.178.137:23
- 73.###.122.111:23
- 15#.##2.200.244:23
- 16#.##1.225.151:23
- 21#.##.164.58:23
- 32.#.101.145:23
- 22#.##0.24.123:23
- 12#.##3.80.226:23
- 21#.##0.91.224:23
- 19#.##.175.51:23
- 23#.##.89.129:23
- 19#.##8.59.152:23
- 20#.##1.115.161:23
- 18#.##7.197.245:23
- 35.##.189.68:23
- 96.##.130.90:23
- 16#.##.99.228:23
- 40.##0.83.14:23
- 19#.##3.24.127:23
- 23#.##.152.57:23
- 21.###.152.85:23
- 17#.##8.241.192:23
- 17#.##.79.132:23
- 12#.##.115.152:23
- 17#.##.57.206:23
- 15#.##.176.73:23
- 14.##.180.28:23
- 77.##4.1.212:23
- 21.##.6.16:23
- 20#.##.119.32:23
- 82.##2.7.22:23
- 15.###.103.139:23
- 14#.##4.29.213:23
- 16#.##1.190.128:23
- 24#.##.129.199:23
- 21#.##.148.13:23
- 15#.##7.194.9:23
- 14#.##8.189.219:23
- 11#.##.208.201:23
- 13#.##1.29.157:23
- 72.##1.39.29:23
- 19#.##3.87.70:23
- 21#.#.158.95:23
- 72.###.119.162:23
- 89.##.50.243:23
- 69.###.191.133:23
- 19#.#3.65.80:23
- 10#.##3.94.211:23
- 61.##8.5.236:23
- 24#.##0.150.191:23
- 12#.##0.52.75:23
- 83.###.87.100:23
- 18#.#4.155.5:23
- 22#.##.107.204:23
- 13#.##0.83.252:23
- 46.##.12.19:23
- 82.##.22.90:23
- 15#.##0.145.68:23
- 44.##.113.16:23
- 18#.##3.92.95:23
- 13#.##1.104.8:23
- 24#.##0.181.49:23
- 22#.##1.131.191:23
- 16#.##.204.212:23
- 85.###.169.67:23
- 20#.##3.65.157:23
- 25#.##1.117.205:23
- 19#.##9.120.26:23
- 19#.##.33.255:23
- 24#.##5.40.19:23
- 16#.#4.52.16:23
- 93.##.161.7:23
- 22#.##9.85.164:23
- 70.##.197.99:23
- 29.##.116.74:23
- 92.##.128.227:23
- 17#.##0.233.70:23
- 73.##.85.164:23
- 13#.##5.139.45:23
- 19#.##0.84.65:23
- 17#.##2.68.115:23
- 14#.##1.109.118:23
- 50.###.244.42:23
- 74.##.224.80:23
- 18#.##0.252.46:23
- 93.##1.3.98:23
- 21#.##.181.228:23
- 43.###.117.182:23
- 13#.##9.12.89:23
- 15#.##.98.139:23
- 17#.##2.110.183:23
- 18#.##5.136.11:23
- 57.##.254.64:23
- 13#.##4.93.253:23
- 21#.##.161.118:23
- 7.##.62.246:23
- 20#.##0.197.123:23
- 13#.##2.167.190:23
- 89.##6.33.92:23
- 16#.##2.93.144:23
- 57.###.40.227:23
- 88.##.75.234:23
- 24#.##3.32.158:23
- 17#.#3.92.81:23
- 83.###.54.135:23
- 25#.##5.14.43:23
- 13#.##.168.18:23
- 21#.##8.113.181:23
- 11#.##7.37.38:23
- 96.###.174.31:23
- 20#.##.188.162:23
- 86.###.167.111:23
- 22#.##3.170.214:23
- 16#.#26.85.5:23
- 25#.##5.123.209:23
- 14#.##6.138.168:23
- 46.###.103.19:23
- 16#.##8.98.238:23
- 23#.##.237.171:23
- 21#.##6.28.200:23
- 10#.##3.15.33:23
- 12#.##.140.53:23
- 20#.##.25.127:23
- 20#.##5.179.109:23
- 11#.##.47.231:23
- 24#.##9.49.103:23
- 60.###.78.156:23
- 68.##.39.142:23
- 33.##.254.65:23
- 23#.##.180.133:23
- 16.##0.4.195:23
- 73.##.165.105:23
- 22#.##.242.121:23
- 14#.##2.233.101:23
- 61.##.86.4:23
- 15#.##.129.42:23
- 17#.##9.3.187:23
Receives data from the following servers:
- 45.###.232.208:33335
