Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- nfgf0i6ln5p6o
Performs process tracing:
- swapper/0
Performs operations with the file system:
Deletes folders:
- <SAMPLE_FULL_PATH>
Creates or modifies files:
- <SAMPLE_FULL_PATH>
Deletes files:
- <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:13289
Establishes connection:
- 8.#.8.8:53
- 5.###.227.65:2231
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 60.###.235.71:23
- 10.###.42.139:23
- 63.###.158.56:23
- 23#.##0.183.37:23
- 22#.##9.191.172:23
- 5.###.246.72:23
- 14#.##8.233.181:23
- 22#.##.243.17:23
- 17#.#.164.69:23
- 10#.##4.214.254:23
- 18#.##8.188.149:23
- 24#.##2.113.21:23
- 22#.#8.90.39:23
- 20#.##6.149.78:23
- 18#.##5.231.121:23
- 14#.##1.234.28:23
- 23.##.249.182:23
- 26.##.185.157:23
- 24#.##0.42.34:23
- 66.###.102.50:23
- 7.###.21.219:23
- 77.##.84.184:23
- 24#.##4.171.194:23
- 3.##.128.169:23
- 18.##.112.111:23
- 20#.##9.126.221:23
- 23#.##6.40.48:23
- 14#.##.93.125:23
- 22#.#.119.208:23
- 17#.##5.47.249:23
- 18#.##8.144.215:23
- 18#.##3.1.183:23
- 22#.##2.169.197:23
- 10#.##3.230.17:23
- 17#.##.231.23:23
- 13#.##.105.18:23
- 39.##.203.6:23
- 20.###.154.171:23
- 11#.##1.124.107:23
- 20#.##6.18.246:23
- 10#.##5.222.96:23
- 18#.##3.119.22:23
- 22#.##3.231.88:23
- 24#.#.57.48:23
- 16#.#9.211.4:23
- 24#.##.184.157:23
- 97.###.221.244:23
- 22#.##2.73.181:23
- 18#.#.214.222:23
- 22#.#.141.166:23
- 11.###.150.252:23
- 18#.##.97.180:23
- 14#.##.130.208:23
- 18#.##.160.216:23
- 53.###.210.14:23
- 12#.##4.205.47:23
- 52.###.219.210:23
- 12.###.171.146:23
- 21#.##9.180.226:23
- 24#.##8.89.252:23
- 27.###.154.81:23
- 10#.##0.179.120:23
- 17.##.156.67:23
- 23.###.91.231:23
- 33.##.72.93:23
- 19#.#5.7.119:23
- 17#.##.180.199:23
- 12#.##.58.161:23
- 33.###.169.150:23
- 17#.##4.84.54:23
- 71.#.118.38:23
- 86.##.217.156:23
- 25#.#6.1.251:23
- 19#.##.123.183:23
- 21#.##9.181.100:23
- 15#.##.223.70:23
- 12#.##4.176.42:23
- 17#.##2.44.26:23
- 45.##.2.115:23
- 12#.##.108.253:23
- 20#.##.245.26:23
- 64.##.6.102:23
- 21#.##.177.44:23
- 6.###.100.189:23
- 18.###.189.90:23
- 20#.##3.212.184:23
- 97.###.66.245:23
- 23#.##0.71.49:23
- 11#.##7.132.165:23
- 18#.##.158.154:23
- 14#.##2.155.252:23
- 19#.##8.242.248:23
- 19.##.65.72:23
- 31.##.248.125:23
- 22#.##.253.218:23
- 10#.##5.167.147:23
- 11#.#.79.107:23
- 11#.##.82.232:23
- 21#.##1.100.230:23
- 54.###.168.64:23
- 53.###.135.39:23
- 68.##4.92.68:23
