Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- [md]
Kills the following processes:
- atd
- cron
- rpc.idmapd
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:55321
Establishes connection:
- 19#.###.239.183:3000
- 19#.##0.239.183:335
- 8.#.8.8:53
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##0.239.183:0
- 19#.##0.239.183:335
- 53.###.68.207:23
- 31.###.222.91:23
- 17#.##.103.87:23
- 14#.##5.63.182:23
- 14#.##3.38.78:23
- 17#.##.206.229:23
- 18#.##.218.229:23
- 21#.##0.91.192:23
- 44.###.48.178:23
- 14#.#45.6.68:23
- 13#.##1.148.184:23
- 68.#.221.16:23
- 98.##.131.116:23
- 47.###.243.29:23
- 15#.##.122.65:23
- 12#.##9.153.99:23
Receives data from the following servers:
- 19#.##0.239.183:335
