Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- 4rgvvn2o1jgwnppqtodti6ut
Kills system processes:
- sshd
Kills the following processes:
- systemd-journal
- systemd-udevd
- systemd-timesyn
- rsyslogd
- cron
- systemd-logind
- dbus-daemon
- agetty
- systemd
- (sd-pam)
- dhclient
- run.sh
- tmux: client
- bash
- sleep
- <SAMPLE>
- 4rgvvn2o1jgwnpp
- journalctl
Performs operations with the file system:
Creates or modifies files:
- /proc/487/cmdline
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:2842
Establishes connection:
- 8.#.8.8:53
- 17#.##.210.229:4466
Sends data to the following servers:
- 51.###.185.49:8080
- 11#.##8.238.49:8080
- 76.###.194.116:8080
- 10#.##.226.87:8080
- 12.##.133.205:8080
- 49.##.248.106:8080
- 80.###.64.164:8080
- 12.###.9.206:8080
- 14#.##6.11.166:8080
- 25.##.246.205:8080
- 15#.##.236.82:8080
- 39.###.56.54:8080
- 21#.###.146.229:8080
- 10#.##9.201.82:8080
- 22#.##.154.124:8080
- 87.##.233.134:8080
- 92.###.24.106:8080
- 16#.##2.189.22:8080
- 85.###.200.53:8080
- 10#.##0.44.153:8080
- 14#.###.178.140:8080
- 18#.##.214.250:8080
- 89.###.156.112:8080
- 17#.#.65.5:8080
- 51.##.77.62:8080
- 32.##.153.231:8080
- 22#.##5.85.56:8080
- 82.###.85.124:8080
- 72.###.22.236:8080
- 12#.##.174.112:8080
- 31.##.58.133:8080
- 43.##.222.62:8080
- 14#.###.210.199:8080
- 18#.###.222.145:8080
- 16#.##.203.249:8080
- 79.###.96.55:8080
- 15#.##8.187.64:8080
- 59.##.34.94:8080
- 11#.###.108.190:8080
- 36.###.29.59:8080
- 96.###.87.181:8080
- 91.##.183.210:8080
- 16#.##.35.135:8080
- 12#.##1.201.7:8080
- 14#.###.107.115:8080
- 14#.##6.45.225:8080
- 10#.##.219.217:8080
- 10#.##.101.198:8080
- 23.###.130.182:8080
- 13#.###.146.120:8080
- 16#.##3.54.176:8080
- 16#.##.228.143:8080
- 42.###.176.186:8080
- 15#.##9.216.61:8080
- 77.###.176.196:8080
- 19#.##.186.30:8080
- 38.###.195.198:8080
- 40.###.73.7:8080
- 17#.##.210.229:4466
- 12#.###.142.254:8080
- 18#.##8.41.127:8080
- 19#.##9.250.86:8080
- 13#.##5.163.21:8080
- 90.###.90.59:8080
- 19#.##1.215.63:8080
- 20#.##3.160.39:8080
- 17.###.13.250:8080
- 15#.##6.12.68:8080
- 11#.##3.54.78:8080
- 41.###.68.5:8080
- 81.##.72.20:8080
- 73.##.207.105:8080
- 95.###.39.157:8080
- 19#.##.9.11:8080
- 1.###.59.2:8080
- 11#.###.157.215:8080
- 13#.###.194.207:8080
- 14#.##0.49.217:8080
- 13#.###.159.239:8080
- 10#.###.227.156:8080
- 10#.###.239.114:8080
- 96.###.101.248:8080
- 19#.##5.32.47:8080
- 13#.###.134.249:8080
- 19#.##0.53.65:8080
- 19#.##.206.144:8080
- 24.##.143.7:8080
- 19#.###.106.217:8080
- 5.###.154.88:8080
- 1.###.76.29:8080
- 66.###.158.38:8080
- 22#.###.220.181:8080
- 44.###.13.138:8080
- 20#.###.145.134:8080
- 10#.##4.234.7:8080
- 20#.##9.96.242:8080
- 12#.##.129.249:8080
- 80.###.185.28:8080
- 10#.##9.186.2:8080
- 86.###.1.178:8080
- 39.##.173.200:8080
- 14.###.231.147:8080
- 57.##.224.107:8080
- 20#.##1.170.84:8080
- 15#.##.134.36:8080
- 87.###.186.61:8080
- 12#.###.166.248:8080
- 52.###.165.242:8080
- 16#.##1.0.179:8080
- 17#.##.54.143:8080
- 63.###.54.119:8080
- 11#.##4.120.96:8080
- 11#.##.228.229:8080
Receives data from the following servers:
- 17#.##.210.229:4466
