Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- EoExtxywDADpimjvbzgx
Launches processes:
- mount -o bind /tmp /proc/510
- mount -o bind /tmp /proc/517
- mount -o bind /tmp /proc/509
- mount -o bind /tmp /proc/524
- mount -o bind /tmp /proc/515
- mount -o bind /tmp /proc/522
Kills the following processes:
- kthreadd
- rcu_gp
- rcu_par_gp
- kworker/0:0H
- kworker/u2:0
- mm_percpu_wq
- rcu_tasks_rude_
- rcu_tasks_trace
- ksoftirqd/0
- rcu_sched
- migration/0
- kworker/0:1
- cpuhp/0
- kdevtmpfs
- netns
- kauditd
- khungtaskd
- oom_reaper
- writeback
- kcompactd0
- ksmd
- khugepaged
- kintegrityd
- kblockd
- blkcg_punt_bio
- edac-poller
- devfreq_wq
- kworker/0:1H
- kswapd0
- kthrotld
- acpi_thermal_pm
- ipv6_addrconf
- kstrp
- zswap-shrink
- kworker/u3:0
- ata_sff
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- kworker/u2:2
- kworker/0:3
- jbd2/sda1-8
- ext4-rsv-conver
- ttm_swap
- kworker/0:0
- 9bc2fd2a
Performs operations with the file system:
Creates or modifies files:
- /root/lets.lock
Locks files:
- /root/lets.lock
Mounts file systems:
- /tmp
Network activity:
Establishes connection:
- 8.#.8.8:53
- 18#.###.128.11:55650
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- cn#.wq.gy
Sends data to the following servers:
- 18#.###.128.11:55650
- 10#.###.203.116:2323
- 40.###.235.19:2323
- 10#.##.1.46:2323
- 22#.##.243.179:2323
- 54.##.57.130:2323
- 19#.###.201.189:2323
- 72.###.105.209:2323
- 13#.##.178.231:2323
- 80.##.163.130:2323
- 13#.###.181.191:2323
- 21#.###.227.188:2323
- 16#.##6.29.104:2323
- 21#.##1.9.154:2323
- 16#.##.250.242:2323
- 98.###.152.33:2323
- 71.###.208.98:2323
- 15#.##8.217.72:2323
- 19.###.37.143:2323
- 18#.#.190.1:2323
- 99.##.100.26:2323
- 91.##.63.153:2323
- 40.###.5.185:2323
- 40.###.206.252:2323
- 12#.##4.67.205:2323
- 13#.##2.25.101:2323
- 12#.###.230.219:2323
- 14#.##3.68.194:2323
- 76.###.155.210:2323
- 89.##.205.241:2323
- 13.###.163.146:2323
- 93.###.16.169:2323
- 14#.###.197.226:2323
- 19#.##2.82.13:2323
- 12#.#.44.93:2323
- 19#.##.177.18:2323
- 65.###.152.253:2323
- 20.###.3.85:2323
- 16#.###.180.130:2323
- 14#.##.164.214:2323
- 20#.##7.26.193:2323
- 72.##.106.234:2323
- 17#.##.73.203:2323
- 66.###.6.204:2323
- 20#.##9.225.3:2323
- 97.###.51.16:2323
- 39.#.#37.62:2323
- 78.###.119.142:2323
- 11#.###.155.167:2323
- 19#.##.63.207:2323
- 35.###.201.92:2323
- 16#.###.203.130:2323
- 82.###.21.89:2323
- 85.###.123.240:2323
- 15#.##0.223.71:2323
- 46.##.231.214:2323
- 17#.##2.88.185:2323
- 47.###.198.198:2323
- 98.##.220.130:2323
- 14.###.24.70:2323
- 18#.##.189.32:2323
- 17#.##.126.26:2323
- 68.##.30.203:2323
- 9.###.121.76:2323
- 57.###.47.246:2323
- 11#.##0.255.68:2323
- 92.##.125.226:2323
- 24.###.135.132:2323
- 19#.##8.119.80:2323
- 10#.#.97.211:2323
- 22#.##.49.245:2323
- 78.###.137.29:2323
- 22#.##.134.218:2323
- 19#.##.13.196:2323
- 11#.##2.119.47:2323
- 13#.##8.120.15:2323
- 17#.##.197.243:2323
- 89.###.208.6:2323
- 41.##.208.242:2323
- 14#.##.253.141:2323
- 61.###.195.115:2323
- 18#.#.198.205:2323
- 15#.##5.64.25:2323
- 21#.##.104.178:2323
- 17#.##8.37.18:2323
- 18.###.117.83:2323
- 19#.##.89.206:2323
- 11#.###.220.179:2323
- 21#.##7.4.234:2323
- 14.##.12.200:2323
- 72.###.87.207:2323
- 86.###.126.90:2323
- 98.###.19.254:2323
- 89.###.107.246:2323
- 82.###.45.236:2323
- 76.###.218.155:2323
- 65.###.213.255:2323
- 15#.#.36.117:2323
- 58.##.47.227:2323
- 18#.##0.152.63:2323
- 85.###.62.194:2323
- 46.##.229.87:2323
- 83.##.189.27:2323
- 16#.##.152.1:2323
- 35.##.192.149:2323
- 42.###.239.88:2323
- 16#.###.202.102:2323
- 16#.##.136.36:2323
- 4.###.174.164:2323
- 16#.##.39.10:2323
- 11#.##6.40.227:2323
- 18#.###.180.248:2323
- 19#.###.105.245:2323
- 20#.##6.112.25:2323
- 12#.#.70.200:2323
- 22#.###.145.127:2323
- 16#.##.88.238:2323
- 76.##.68.137:2323
- 14#.###.204.201:2323
- 68.##.102.148:2323
- 4.#.#4.140:2323
- 68.###.202.52:2323
- 19#.###.117.141:2323
- 34.##.97.119:2323
- 88.##.61.25:2323
- 65.###.121.130:2323
- 38.##.76.111:2323
- 19#.##.121.107:2323
- 20#.##.40.174:2323
- 17#.##.162.168:2323
- 16#.###.155.209:2323
- 24.##.192.252:2323
- 14#.##2.8.191:2323
- 12#.###.154.238:2323
- 11#.##.211.218:2323
- 12#.##2.119.37:2323
- 95.###.122.66:2323
- 22#.##.172.61:2323
- 13.##.18.156:2323
- 16#.##.4.59:2323
- 20#.##.78.101:2323
- 13#.##.43.74:2323
- 13#.###.193.199:2323
- 14#.##.171.247:2323
- 90.###.136.47:2323
- 80.##.97.54:2323
- 13#.##.112.154:2323
- 21#.###.252.208:2323
- 36.###.42.158:2323
- 36.###.20.200:2323
- 1.##.#25.190:2323
- 19#.##.145.170:2323
- 11#.##.58.222:2323
- 10#.##1.24.160:2323
- 41.##.42.171:2323
- 78.###.157.83:2323
- 69.##.42.156:2323
- 21#.##4.93.51:2323
- 86.###.60.1:2323
- 19#.##.76.123:2323
- 43.###.81.94:2323
- 16#.##.235.248:2323
- 60.##.13.158:2323
- 14#.##.231.113:2323
- 63.###.137.3:2323
- 17#.##.124.246:2323
- 13#.###.216.128:2323
- 19#.###.117.226:2323
- 11#.##.187.187:2323
- 16#.#.209.158:2323
- 54.##.49.39:2323
- 11#.##9.205.96:2323
- 90.###.48.159:2323
- 19.##.113.26:2323
- 15#.##.104.123:2323
- 14#.###.163.196:2323
- 69.###.143.200:2323
- 14#.##7.226.60:2323
- 14#.##.175.17:2323
- 20#.##.13.224:2323
- 15#.##4.77.197:2323
- 88.##.42.12:2323
- 86.###.102.11:2323
- 22#.##4.6.21:2323
- 15#.##1.71.176:2323
- 11#.##.225.108:2323
- 9.###.40.32:2323
- 11#.#.137.15:2323
- 20#.##0.120.25:2323
- 20#.##.31.182:2323
- 86.###.237.166:2323
- 19#.##9.176.34:2323
- 75.##.181.105:2323
- 20#.###.201.234:2323
- 1.###.215.187:2323
- 79.##.30.93:2323
- 10#.##.94.242:2323
- 13.###.30.159:2323
- 88.###.121.215:2323
- 17#.##.132.176:2323
- 5.##.#54.203:2323
- 10#.###.148.157:2323
- 67.##.108.243:2323
- 15#.##.115.154:2323
- 61.##.254.89:2323
- 87.##.225.16:2323
- 69.##.128.151:2323
- 15#.###.223.222:2323
- 10#.##.136.127:2323
- 10#.###.214.195:2323
- 19#.##.133.23:2323
- 8.##.#82.124:2323
- 35.###.105.201:2323
- 83.##.112.24:2323
- 43.##.242.89:2323
- 80.##.70.70:2323
- 45.###.237.38:2323
- 17#.##7.163.2:2323
- 15#.##2.79.39:2323
- 88.##.115.120:2323
- 17#.##1.204.52:2323
- 15#.##1.71.100:2323
- 18#.##.88.36:2323
- 89.##.228.178:2323
- 21#.##.5.128:2323
- 14#.##.191.76:2323
- 92.###.20.14:2323
- 17#.##.14.23:2323
- 10#.##2.156.34:2323
- 59.###.236.146:2323
- 21#.##.23.141:2323
- 87.##.116.247:2323
- 16#.###.135.175:2323
- 10#.##7.114.49:2323
- 13#.##5.246.14:2323
- 19#.##5.175.26:2323
- 12#.##8.85.47:2323
- 15#.##.88.114:2323
- 76.###.109.28:2323
- 81.##.139.7:2323
- 20.##.29.106:2323
- 11#.##.233.147:2323
- 94.###.183.190:2323
- 19#.#.155.25:2323
- 12#.##2.39.10:2323
- 23.##.226.38:2323
- 73.##.62.66:2323
- 10#.##2.37.147:2323
- 18#.##.108.158:2323
- 20#.#.93.193:2323
- 80.##.102.72:2323
- 12#.###.139.100:2323
- 10#.##.214.177:2323
- 8.###.127.219:2323
- 21#.###.211.182:2323
- 17#.##4.237.63:2323
- 18#.##.169.161:2323
- 91.##.242.34:2323
- 18#.##.130.165:2323
- 13#.##0.96.76:2323
- 20#.##0.34.186:2323
- 20#.##.98.21:2323
- 10#.##2.45.247:2323
- 36.###.43.173:2323
- 67.###.22.9:2323
- 20#.##3.59.152:2323
- 12#.##.26.216:2323
- 15#.###.173.255:2323
- 65.##.28.41:2323
- 17.###.113.9:2323
- 38.###.35.200:2323
- 75.##.199.161:2323
- 15#.###.191.247:2323
- 94.###.51.93:2323
- 20#.###.250.148:2323
- 61.###.211.158:2323
- 42.###.18.139:2323
- 5.##.#68.79:2323
- 19#.##.209.46:2323
- 19#.###.176.134:2323
- 19.###.18.222:2323
- 18#.##.74.135:2323
- 9.###.182.249:2323
- 19#.##.241.126:2323
- 11#.##.246.177:2323
- 19#.##.64.137:2323
- 67.##.14.74:2323
- 63.###.134.168:2323
- 46.##.63.130:2323
- 11#.##4.28.90:2323
- 35.###.168.204:2323
- 15#.##2.119.14:2323
- 80.##.255.253:2323
- 13#.###.201.197:2323
- 14#.###.165.242:2323
- 15#.##1.42.188:2323
- 19#.##.78.68:2323
- 10#.##.40.23:2323
- 16#.##1.175.81:2323
- 70.###.94.145:2323
- 43.###.63.42:2323
- 88.###.52.116:2323
- 18.###.225.40:2323
- 14#.###.111.217:2323
- 19#.###.206.153:2323
- 10#.##4.135.79:2323
- 14#.##4.25.9:2323
- 20#.##1.69.152:2323
- 14#.###.141.145:2323
- 91.##.23.26:2323
- 14#.##6.0.245:2323
- 10#.##.249.23:2323
- 12#.##.138.58:2323
- 16#.##.29.0:2323
- 18#.##.34.92:2323
- 15#.##8.134.79:2323
- 13#.##.189.3:2323
- 20#.##2.28.0:2323
- 45.##.86.166:2323
- 74.##.176.232:2323
- 21#.##.38.171:2323
- 10#.###.201.188:2323
- 16#.##.38.193:2323
- 82.###.67.89:2323
- 14#.###.199.129:2323
- 21#.##.38.178:2323
- 21#.##0.116.22:2323
- 98.#.#50.169:2323
- 78.##.103.55:2323
- 17#.##.127.172:2323
- 40.###.204.73:2323
- 38.###.155.56:2323
- 42.##.187.35:2323
- 19#.##1.121.11:2323
- 14#.##8.85.236:2323
- 17#.###.183.207:2323
- 20#.##.27.125:2323
- 21#.###.158.109:2323
- 61.###.163.245:2323
- 14#.##8.83.204:2323
- 91.###.228.205:2323
- 68.##.173.152:2323
- 12#.##2.9.59:2323
- 66.##.71.86:2323
- 20#.###.129.212:2323
- 12#.##7.158.20:2323
- 17#.###.165.130:2323
- 79.###.200.244:2323
- 15#.###.150.159:2323
- 95.###.243.229:2323
- 48.###.112.233:2323
- 13#.##3.223.51:2323
- 4.##.#34.131:2323
- 4.###.2.172:2323
- 10#.##8.159.9:2323
- 86.##.42.212:2323
- 13#.##8.113.48:2323
- 17#.##9.51.6:2323
- 22#.##7.221.73:2323
- 14#.###.166.140:2323
- 16#.##6.104.32:2323
- 43.###.164.11:2323
- 32.###.165.195:2323
- 14#.##.184.185:2323
- 18.###.188.112:2323
- 20#.##0.12.14:2323
- 21#.##.169.202:2323
- 90.##.14.83:2323
- 19#.#.21.180:2323
- 15#.#.5.10:2323
- 70.###.11.194:2323
- 13.##.178.152:2323
- 5.###.127.149:2323
- 17#.##.27.67:2323
- 12#.##.238.174:2323
- 19#.###.211.187:2323
- 15#.##1.154.8:2323
- 12#.##8.4.80:2323
- 78.###.56.195:2323
- 16#.##5.66.20:2323
- 12#.##5.26.68:2323
- 17#.##.171.219:2323
- 72.#.#52.51:2323
- 87.###.18.69:2323
- 17#.###.159.182:2323
- 13#.##6.3.37:2323
- 14#.##1.92.190:2323
- 19#.##.55.18:2323
- 12#.#.121.94:2323
- 21#.###.134.155:2323
- 14#.###.236.131:2323
- 12#.##.161.167:2323
- 95.###.63.213:2323
- 81.##.173.237:2323
- 22#.##.244.78:2323
- 8.###.18.202:2323
- 19#.##.96.43:2323
- 92.#.#90.240:2323
- 13#.#.103.55:2323
- 12.###.54.74:2323
- 21#.###.110.103:2323
- 13#.###.191.146:2323
- 14#.##6.182.98:2323
- 20#.##4.102.48:2323
- 71.###.151.94:2323
- 64.##.244.163:2323
- 20#.##9.163.12:2323
- 15#.###.165.252:2323
- 57.###.79.139:2323
- 18#.##.237.108:2323
- 20#.###.120.182:2323
- 57.##.46.244:2323
- 14#.##.136.189:2323
- 14#.##.149.124:2323
- 41.###.58.190:2323
- 16#.##2.92.32:2323
- 45.###.231.33:2323
- 82.##.9.237:2323
- 22#.##2.142.67:2323
- 10#.##6.172.90:2323
- 17#.##0.44.149:2323
- 18#.###.236.163:2323
- 15#.##.127.229:2323
- 17#.##3.4.254:2323
- 67.###.223.3:2323
- 92.##.153.213:2323
- 39.#.#4.195:2323
- 16.##.19.202:2323
- 12#.###.131.167:2323
- 17.##.185.210:2323
- 12#.##.17.191:2323
- 21#.##.25.5:2323
- 19#.##.174.199:2323
- 18#.##.119.132:2323
- 10#.##3.17.55:2323
- 61.###.97.213:2323
- 20#.##9.200.94:2323
- 78.###.156.212:2323
- 15#.##5.92.113:2323
- 87.###.158.97:2323
- 20#.##0.17.107:2323
- 76.##.152.126:2323
- 86.###.248.184:2323
Receives data from the following servers:
- 18#.###.128.11:55650
