Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e28081
Kills the following processes:
- systemd
- kthreadd
- ksoftirqd/0
- kworker/0:0H
- kworker/u2:0
- watchdog/0
- khelper
- kdevtmpfs
- netns
- khungtaskd
- writeback
- ksmd
- crypto
- kintegrityd
- bioset
- kblockd
- ata_sff
- kworker/0:1
- kswapd0
- fsnotify_mark
- kthrotld
- scsi_eh_0
- scsi_tmf_0
- scsi_eh_1
- scsi_tmf_1
- ipv6_addrconf
- deferwq
- kworker/u2:2
- kworker/0:1H
- jbd2/sda3-8
- ext4-rsv-conver
- kauditd
- kworker/0:3
- systemd-journal
- systemd-udevd
- ttm_swap
- rpciod
- nfsiod
- systemd-logind
- kworker/0:0
- kworker/0:2
- dhclient
- 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##me.xyz
Sends data to the following servers:
- 45.###.232.208:33335
- 14#.##6.89.115:23
- 29.##.169.207:23
- 5.##.22.7:23
- 97.##.214.169:23
- 16#.##.214.157:23
- 11#.##.58.252:23
- 78.###.232.22:23
- 23#.##8.164.248:23
- 15#.##.142.191:23
- 24.###.130.243:23
- 49.###.159.226:23
- 20#.##.43.223:23
- 18#.##0.125.177:23
- 12#.##6.238.175:23
- 23#.##.108.243:23
- 72.##.192.114:23
- 49.##.184.133:23
- 2.#.#2.118:23
- 91.##.79.182:23
- 19#.#3.8.23:23
- 60.###.37.249:23
- 19.##.59.62:23
- 19#.##4.245.232:23
- 87.##7.47.52:23
- 13.##.130.116:23
- 13#.##2.149.49:23
- 16#.##6.113.73:23
- 18#.##7.161.110:23
- 20#.##.123.238:23
- 17#.#.45.14:23
- 50.#.4.93:23
- 20.##.225.242:23
- 68.#.214.202:23
- 24#.##.223.222:23
- 23#.##2.5.166:23
- 49.#.31.15:23
- 93.##1.193.0:23
- 38.##0.79.89:23
- 22#.##9.150.146:23
- 17#.##6.221.107:23
- 15#.##.190.195:23
- 14#.#4.16.60:23
- 22#.##9.16.100:23
- 19#.##7.79.26:23
- 38.##4.45.55:23
- 18#.##8.174.95:23
- 16#.#9.34.73:23
- 24#.##.155.171:23
- 14#.##4.236.95:23
- 23#.##4.212.120:23
- 10#.#31.40.1:23
Receives data from the following servers:
- 45.###.232.208:33335
