Technical Information
Malicious functions:
Removes itself
Substitutes application name for:
- AAb771owWjclWa1dWpCAaaHB81NN4yoAuew3WKoeMjpaRAWWrj847Hu3wnbC8oMnQXnBWv1WwjpApt6KVvjK1opK7op8wnAoNbXNpvlA2KKxoAvNbANMANyrKpQHKnre2xAQvKo3njj17ndpjvKw1HxC61AAyd13ruAbuAK3A1pKCn1ap38nWW18ANadAXX3bpvyXyWrnplM3jMQBBWKlvArjBCMa11ndrxbpnAwWvv3rrQMpMwowvwNc6KKay8jyula1jAAAuHtpbvWe11MKWu74W3MoWvwanuKoMolroMv1tbtd1AoWC1xNAAANo8buM8AvQRRtXyWjXKNpn1oxWwrM3MbAvQa1p3AjWbAWjKaKbQMAxx1M2wbCKbvajjpRAWKW2WWA8Hwb1CAvbpuC4epHaj2poAvNHvAj82QVd2Wt6rueAMAjBtV381ad18NpajKXbA6AbAjuKN4CouANKxw1lW36jKaXv1AjwKlo1wWAWbj131ytcopCa1jAV7QAMwcwXAWcy1dptRM4Baev21v81K741M6v4bAcopdWAyjaNeVKaMplA86WwHvnpMWA8AcaC3jMv11aMVpKMoMjHbjlaM13loaKuMaKnjM1bA2ovxtp4RMC2oMWRjjjjaMQjtjbeojcjt7Ry1xbCoKM23upKMovootroAaotxtNvNdttA7MpdQbHodKxcAuRexANdwAy8Ajp4KnXwawAMAtax7raKMjbCWlvdooopxNWlvM6c2ujcajbNXQWWabKaVjx1oroj8ecjCMcjAuweapuMvKjMAvAjaxpjdAQAbboNAeXMpve1AjBC8wAWCcNaAvRecM3tj1A2naMb1wy4AnyW1r4nMouMMv4rQKA66KKH1MVcBjW1vMCAKcAtAo[rkmodule] [run.sh][PPID:0x217] [sleep][PID:0x21b] do_filp_open. Filename: "/usr/lib/locale/locale-archive"
Network activity:
Awaits incoming connections on ports:
- 19#.###.200.50:56242
Establishes connection:
- 8.#.8.8:53
- 23.###.227.58:34256
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- sm###.monster
Sends data to the following servers:
- 94.##3.64.33:23
- 21#.##.194.102:23
- 13#.##.179.212:23
- 98.###.148.222:23
- 36.##.246.35:23
- 19#.##3.211.47:23
- 19#.##3.7.123:23
- 60.###.119.232:23
- 17#.##.36.107:23
- 14#.##.139.233:23
- 10#.##.34.130:23
- 18#.##7.27.32:23
- 4.###.199.188:23
- 69.##.188.26:23
- 12#.#.177.61:23
- 50.##.219.208:23
- 16#.##.90.221:23
- 72.##.75.211:23
- 14#.##.213.67:23
- 20#.##4.118.252:23
- 19#.##8.55.125:23
- 10#.#1.99.73:23
- 83.##.141.211:23
- 58.##.49.36:23
- 19#.##9.49.254:23
- 18#.##.83.120:23
- 21#.##0.137.172:23
- 17#.##.155.243:23
- 10#.##.49.122:23
- 86.###.160.191:23
- 13.##.213.4:23
- 15#.##6.68.32:23
- 14#.##9.148.174:23
- 94.###.214.255:23
- 42.##6.52.79:23
- 22#.##.119.246:23
- 18#.##7.178.104:23
- 11#.##.16.139:23
- 19#.##.122.19:23
- 10#.##.181.110:23
- 69.##.9.9:23
- 22#.##3.96.130:23
- 57.###.66.173:23
- 19#.##0.253.211:23
- 32.###.15.209:23
- 13#.##5.133.25:23
- 21#.##9.51.144:23
- 17#.##5.208.30:23
- 10#.##.52.212:23
- 10#.##3.129.95:23
- 5.###.52.98:23
- 17#.##0.167.109:23
- 12#.##.240.23:23
- 21#.##.217.138:23
- 18#.##9.98.217:23
- 97.###.224.41:23
- 43.##.220.234:23
- 51.##.204.175:23
- 19.##.244.205:23
- 61.##.101.39:23
- 31.###.114.98:23
- 14#.##0.224.47:23
- 11#.#.133.9:23
- 16#.##0.67.40:23
- 57.#.160.41:23
- 96.##.147.150:23
- 34.###.145.222:23
- 99.#.201.170:23
- 52.##0.63.93:23
- 12#.##.103.127:23
- 53.##.251.105:23
- 20#.##.120.140:23
- 10#.##.144.65:23
- 25.###.139.58:23
- 4.##.85.65:23
- 41.###.204.64:23
- 21#.##4.115.99:23
- 20#.##.75.157:23
- 21#.#.115.44:23
- 13#.##.156.53:23
- 17.###.119.117:23
- 25.##.33.183:23
- 72.##.242.12:23
- 54.##.35.183:23
- 13#.##.54.112:23
- 10#.##5.238.72:23
- 12#.##1.51.46:23
- 21#.##.139.171:23
- 36.###.202.159:23
- 79.##.48.132:23
- 11#.##.43.172:23
- 12.###.30.144:23
- 19#.##6.83.132:23
- 63.##.157.1:23
- 88.#.180.248:23
- 17#.##3.201.68:23
- 15#.##1.68.40:23
- 11#.##.165.240:23
- 39.##.166.217:23
- 14#.##.91.187:23
- 11#.##.163.29:23
- 44.###.178.100:23
- 65.##.97.52:23
- 97.##.183.227:23
- 49.###.221.25:23
- 36.###.231.46:23
- 12#.##.27.241:23
- 20#.##1.73.27:23
- 10#.##.113.46:23
- 20#.##4.8.196:23
- 11#.##4.100.140:23
- 12#.##2.167.186:23
- 51.###.233.79:23
- 35.##.73.41:23
- 19#.##9.82.229:23
- 84.###.240.230:23
- 17#.##6.99.66:23
- 10#.##.174.223:23
- 97.##.173.21:23
- 20#.##2.165.8:23
- 21#.##.148.177:23
- 20#.##.199.228:23
- 94.##4.54.52:23
- 1.###.60.38:23
- 74.###.78.215:23
- 14#.##.113.99:23
- 19#.##.105.156:23
- 16#.##.100.34:23
- 59.###.38.164:23
- 18#.#.127.236:23
- 19#.##3.23.234:23
- 14#.##6.143.139:23
- 5.##.100.43:23
- 84.###.135.30:23
- 96.###.61.125:23
- 11#.##.138.166:23
- 18#.##.48.111:23
- 12#.##6.34.53:23
- 11#.##1.121.74:23
- 8.##.9.15:23
- 45.###.40.120:23
- 40.##.181.65:23
- 47.##.212.116:23
- 19#.##.47.223:23
- 85.##.128.226:23
- 13#.##6.79.148:23
- 77.###.226.227:23
- 17#.##8.10.166:23
- 20#.##6.255.143:23
- 58.##.50.154:23
- 14#.##7.89.65:23
- 20.##7.4.253:23
- 78.###.183.218:23
- 21#.##1.37.254:23
- 15#.##.255.181:23
- 11#.##.158.252:23
- 19#.##.118.190:23
- 16#.##4.243.187:23
- 10#.#5.27.78:23
- 15#.##.31.195:23
- 82.##.82.183:23
- 12#.##9.77.11:23
- 20#.##4.186.234:23
- 73.##.162.101:23
- 13#.##3.187.124:23
- 18#.##.131.159:23
- 19#.##.158.98:23
- 83.###.204.55:23
- 19#.##3.127.211:23
- 21#.##6.193.88:23
- 22#.##7.197.145:23
- 17#.##.73.187:23
- 24.##.38.245:23
- 15#.##8.83.133:23
- 16#.##5.107.21:23
- 11#.#.131.211:23
- 15#.#1.89.76:23
- 16#.##3.151.59:23
- 15#.##9.73.177:23
- 10#.##3.231.226:23
- 4.###.63.254:23
- 54.###.227.129:23
- 11#.##.72.182:23
- 23.###.139.116:23
- 19#.##6.13.197:23
- 14#.##3.112.253:23
- 13#.##7.175.48:23
- 19#.##.110.93:23
- 89.###.246.101:23
- 75.###.142.221:23
- 15#.##7.133.25:23
- 21#.##.158.242:23
- 89.###.25.192:23
- 18#.##8.7.208:23
- 11#.#81.2.66:23
- 91.##.36.32:23
- 13#.##.155.59:23
- 21#.#.132.103:23
- 14#.##4.149.19:23
- 78.###.86.231:23
- 12#.##0.162.236:23
- 21#.##4.132.41:23
- 97.##.157.183:23
- 72.##.158.121:23
- 71.##2.96.52:23
- 5.###.194.170:23
- 11#.#5.163.2:23
- 5.###.254.17:23
- 19#.##.54.199:23
- 32.###.159.69:23
- 31.###.136.68:23
- 87.###.200.54:23
- 10#.#7.36.21:23
- 15#.##.87.218:23
- 10#.##1.160.19:23
- 46.##.219.27:23
- 11#.#7.99.4:23
- 13#.##8.153.63:23
- 67.##.7.217:23
- 11#.#.26.192:23
- 38.###.109.75:23
- 18#.##7.33.14:23
- 17#.##.109.161:23
- 14#.##0.105.250:23
- 19#.##.202.150:23
- 95.###.16.246:23
- 10#.##2.19.19:23
- 17#.#2.64.89:23
- 40.###.54.218:23
- 75.##9.86.58:23
- 12#.##.254.242:23
- 46.###.176.39:23
- 64.##.105.68:23
- 19#.##8.50.74:23
- 16#.##0.198.215:23
- 63.#.11.46:23
- 23.###.200.137:23
- 13#.##.246.143:23
- 18#.##.68.239:23
- 17#.#.38.202:23
- 14#.##9.27.28:23
- 69.###.214.226:23
- 18#.##0.110.241:23
- 20#.##5.129.65:23
- 21#.##.180.58:23
- 12#.#15.71.1:23
- 15#.##1.79.13:23
- 13#.##6.56.250:23
- 14#.#6.94.49:23
- 88.##.227.17:23
- 13.###.159.207:23
- 19#.#9.87.8:23
- 17#.##1.242.37:23
- 57.###.149.16:23
- 57.###.102.138:23
- 68.##.23.245:23
- 31.###.148.176:23
- 16#.##9.254.218:23
- 21#.##5.35.171:23
- 35.##.158.173:23
- 11#.#3.8.115:23
- 75.###.115.171:23
- 14#.##2.198.100:23
- 19#.##.105.23:23
- 10#.##.21.233:23
- 11#.##7.105.88:23
- 84.##6.82.90:23
- 90.##.48.30:23
- 22#.#4.94.31:23
- 85.##.104.240:23
- 19#.##4.204.53:23
- 22#.##5.235.5:23
- 12#.##.153.218:23
- 17#.##5.139.177:23
- 22#.##0.10.50:23
- 70.##.212.31:23
- 44.###.13.221:23
- 13#.##3.233.108:23
- 12#.##8.32.12:23
- 17#.##7.107.3:23
- 19#.##.145.95:23
- 93.##.167.106:23
- 37.##.150.191:23
- 11#.#5.73.22:23
- 17#.##.197.82:23
- 23.##.230.173:23
- 80.##.2.182:23
- 31.###.218.156:23
- 11#.##.72.120:23
- 21#.##1.132.59:23
- 66.###.110.175:23
- 18#.##4.154.148:23
- 13#.##3.49.218:23
- 11#.##1.194.176:23
- 46.###.218.159:23
- 17#.##.20.225:23
- 13#.##.227.205:23
- 19#.##3.233.253:23
- 81.##.56.204:23
- 15#.##6.205.8:23
- 11#.##4.16.22:23
- 49.##.125.26:23
- 16#.##.125.46:23
- 11#.##2.3.164:23
- 86.##.252.150:23
- 87.###.18.199:23
- 20#.##6.74.116:23
- 19#.##.122.134:23
- 94.###.188.60:23
- 69.##1.59.45:23
- 32.##2.83.64:23
- 20#.##3.128.60:23
- 18#.##7.242.59:23
- 50.##.57.171:23
- 95.##.125.17:23
- 18#.##2.179.128:23
- 12#.##2.128.3:23
- 90.##4.163.4:23
- 11#.##.58.134:23
- 84.##.249.61:23
- 20#.##9.157.238:23
- 10#.#2.68.88:23
- 32.##.71.29:23
- 85.###.137.118:23
- 20#.##8.106.159:23
- 18#.##5.227.15:23
- 67.###.253.208:23
- 5.##.65.18:23
- 12.##7.48.16:23
- 75.#.87.203:23
- 16#.#8.29.31:23
- 16#.##.11.136:23
- 15#.##9.28.118:23
- 2.##.232.55:23
- 23.##.195.54:23
- 12#.##.167.95:23
- 16#.##4.51.229:23
- 15#.##2.132.217:23
- 99.###.108.97:23
- 16#.##7.224.208:23
- 20#.##.132.188:23
- 18#.##7.63.23:23
- 70.###.20.210:23
- 19#.##0.131.221:23
- 40.##.56.212:23
- 20#.##.63.156:23
- 20#.##7.186.96:23
- 13#.##2.100.162:23
- 19#.##.152.78:23
- 16#.#5.20.81:23
- 20#.#.124.235:23
- 12#.##2.12.216:23
- 10#.##2.214.247:23
- 61.##.105.52:23
- 11#.##.104.124:23
- 12#.##9.253.241:23
- 17#.##.52.186:23
- 17#.##.46.248:23
- 11#.##0.174.203:23
- 19#.##9.115.177:23
- 15#.#99.57.1:23
- 12#.#6.0.127:23
- 24.##.47.30:23
- 95.###.208.111:23
- 39.##.225.234:23
- 18#.##.141.119:23
- 69.###.14.141:23
- 57.###.246.50:23
- 12.###.134.142:23
- 17#.##3.185.184:23
- 68.###.204.84:23
- 18#.##.120.149:23
- 92.###.73.250:23
- 65.##.92.41:23
- 95.###.52.129:23
- 12#.##.77.238:23
- 12#.##8.152.167:23
- 14.##5.53.61:23
- 12#.##.250.34:23
- 17.###.171.160:23
- 14#.##2.28.104:23
- 22#.##7.125.217:23
- 12.##.173.129:23
- 35.##.155.48:23
- 9.###.234.221:23
- 90.###.71.162:23
- 19#.##3.166.144:23
- 1.###.84.251:23
- 9.###.144.105:23
- 11#.##.234.21:23
- 19#.##.29.239:23
- 10#.#.145.63:23
- 12#.##3.171.42:23
- 97.##4.87.78:23
- 11#.##.207.100:23
- 68.###.155.190:23
- 73.##1.5.111:23
- 61.##.195.165:23
- 91.###.23.243:23
- 19#.##6.77.88:23
- 19.##0.31.72:23
- 77.###.165.200:23
- 11#.##5.14.188:23
- 11#.#40.6.25:23
- 15#.##.201.155:23
- 12#.##7.85.128:23
- 11#.##2.206.69:23
- 17#.##9.142.42:23
- 20#.##1.201.12:23
- 68.###.169.35:23
- 15#.##6.93.125:23
- 16#.##.154.207:23
- 14#.##0.36.187:23
- 57.###.233.225:23
- 12#.##3.173.219:23
- 14.##.202.199:23
- 11#.##9.68.122:23
- 60.##.101.44:23
- 53.##.245.205:23
- 18#.##.96.247:23
- 12#.##1.49.213:23
- 11#.##2.43.247:23
- 59.##.142.188:23
- 15#.##0.14.71:23
- 17#.##.240.147:23
Receives data from the following servers:
- 23.###.227.58:34256
