Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
Malicious functions:
Gains root privileges
Substitutes application name for:
- 83RDX2T57jdr
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:37215
Establishes connection:
- 12#.##9.100.170:1
- 1.#.1.1:53
Attacks using a special dictionary (brute-force technique) via the SSH protocol
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 12#.##9.100.170:1
- 16#.##.206.59:23
- 18#.##2.227.146:23
- 16#.##.206.59:23
- 12.###.35.145:23
- 69.###.241.204:23
- 39.###.213.56:23
- 12#.#9.69.67:23
- 12#.##.232.129:23
- 16#.##2.99.90:23
- 46.##.139.229:23
- 93.##.68.222:23
- 82.###.147.21:23
- 72.##.175.217:23
- 67.###.196.204:23
- 15#.##3.254.157:23
- 17.##.155.9:23
- 15#.##.233.19:23
- 96.##.239.117:23
Receives data from the following servers:
- 12#.##9.100.170:1
Other:
Collects information about network activity
