Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
- (null)
Kills system processes:
- sshd
Kills the following processes:
- exim4
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:2174
Establishes connection:
- 8.#.8.8:53
- 13#.##.64.122:53
- 89.###.90.159:4444
- 19#.##.195.195:53
- 89.###.90.159:7122
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- na###ne.pirate
Sends data to the following servers:
- 89.###.90.159:4444
- 89.###.90.159:7122
- 9.###.110.67:23
- 19#.##1.128.72:23
- 22#.##3.51.65:23
- 18.##5.84.49:23
- 9.###.99.146:23
- 83.###.62.243:23
- 20#.##3.80.155:23
- 11#.##.107.169:23
- 18#.##3.122.157:23
- 21#.##9.191.180:23
- 10#.##5.128.16:23
- 18#.#43.70.3:23
- 15#.##5.254.137:23
- 40.##.127.156:23
- 18#.##7.243.223:23
- 10#.##.49.170:23
- 17#.##6.31.65:23
- 62.##.187.105:23
- 21#.##.154.134:23
- 71.##2.58.18:23
- 22#.##0.47.117:23
- 17#.##3.80.202:23
- 13#.##2.85.244:23
- 19.##.69.58:23
- 21#.##.131.100:23
- 90.##.249.225:23
- 84.##.62.123:23
- 87.###.29.168:23
- 15#.##6.62.67:23
- 89.###.108.247:23
- 13#.##.66.189:23
- 90.###.203.254:23
- 12#.##1.25.60:23
- 59.##.24.209:23
- 19#.##6.254.48:23
- 32.##5.59.48:23
- 47.##.123.76:23
- 21#.##9.202.46:23
- 14#.##.239.50:23
- 17#.##.75.134:23
- 17#.##2.178.172:23
- 97.##.202.167:23
- 5.###.179.56:23
- 2.###.221.231:23
- 19#.##8.17.125:23
- 52.##.190.33:23
- 18#.##9.38.191:23
- 82.##.135.121:23
- 22#.#9.12.90:23
- 82.###.158.175:23
- 10#.##0.38.71:23
- 10#.##9.47.43:23
- 10#.##5.90.250:23
- 9.###.39.192:23
- 17#.##0.27.131:23
- 76.###.194.42:23
- 90.###.76.148:23
- 19#.##9.21.92:23
- 17#.##6.132.128:23
- 50.##.26.176:23
- 15#.##.240.79:23
- 57.##.162.1:23
- 19#.##5.32.122:23
- 23.###.179.184:23
- 20#.##.164.162:23
- 13#.##6.133.70:23
- 39.###.246.67:23
- 19#.##.234.107:23
- 53.##.151.64:23
- 19#.#4.84.69:23
- 15#.##9.182.6:23
- 9.###.239.127:23
- 10#.#6.21.99:23
- 18#.##2.253.176:23
- 20#.#.225.10:23
- 65.##.101.74:23
- 21#.##.21.185:23
- 25.###.122.82:23
- 18#.##6.211.12:23
- 16#.##.211.67:23
- 18#.##.197.208:23
- 16#.##4.53.140:23
- 95.###.49.184:23
- 96.###.109.75:23
- 60.##.169.247:23
- 62.#.126.91:23
- 87.###.209.46:23
- 20#.##7.124.48:23
- 72.###.205.218:23
- 14#.##.234.11:23
- 20#.##7.14.109:23
- 27.##.56.132:23
- 17#.##9.203.202:23
- 49.##.103.38:23
- 17#.##7.108.219:23
- 98.###.162.20:23
- 91.###.253.107:23
- 17#.##9.142.86:23
- 19#.#3.94.13:23
- 95.###.39.205:23
- 21#.##8.220.199:23
- 23.##.184.35:23
- 16#.##4.47.148:23
- 50.##1.66.57:23
- 44.###.216.60:23
- 5.##.83.70:23
- 42.###.255.78:23
- 10#.#2.8.67:23
- 15#.##4.184.41:23
- 12#.##2.199.95:23
- 17#.##7.171.208:23
- 47.###.129.77:23
- 12#.##.141.115:23
- 41.###.14.217:23
- 16#.##5.22.221:23
- 15#.##3.206.27:23
- 11#.##.205.124:23
- 17#.#0.85.14:23
- 10#.##6.84.255:23
- 39.###.186.88:23
- 95.###.182.92:23
- 19#.##3.69.190:23
- 15#.##6.141.115:23
- 18#.##8.158.126:23
- 19#.##.61.122:23
- 89.##.22.181:23
- 15#.#2.90.6:23
- 50.##6.36.11:23
- 15#.##5.138.27:23
- 39.##.245.30:23
- 21#.##9.25.135:23
- 94.###.253.112:23
- 19#.##2.196.21:23
- 21#.##8.65.99:23
- 15#.#3.95.82:23
- 51.##.42.46:23
- 11#.##.223.53:23
- 70.###.240.11:23
- 14#.##.150.29:23
- 74.###.230.80:23
- 13#.##8.7.181:23
- 14.##4.243.8:23
- 12#.##1.89.21:23
- 21#.##.101.99:23
- 10#.##.125.181:23
- 75.###.76.137:23
- 15#.##0.44.114:23
- 46.##.203.31:23
- 13#.##.18.202:23
- 41.##.195.171:23
- 16#.##3.250.173:23
- 25.##.102.194:23
- 21#.##8.135.110:23
- 21#.##7.253.5:23
- 15#.##4.228.51:23
- 69.###.169.170:23
- 5.###.28.225:23
- 8.###.136.254:23
- 10#.##3.197.188:23
- 16#.##.38.144:23
- 10#.##.255.65:23
- 14#.##.118.64:23
- 75.###.160.170:23
- 32.##1.99.85:23
- 17#.##.205.14:23
- 12#.##3.212.32:23
- 14#.##4.110.227:23
- 88.##.57.33:23
- 15#.##2.132.118:23
- 17#.##7.175.175:23
- 12#.##.58.108:23
- 10#.##5.98.176:23
- 58.##.218.227:23
- 73.##.114.101:23
- 20#.##9.246.205:23
- 5.##.110.222:23
- 16#.##.41.118:23
- 40.###.51.187:23
- 14.##.168.246:23
- 20#.##.37.146:23
- 93.###.190.246:23
- 13#.##1.20.41:23
- 2.###.198.231:23
- 14#.##4.166.17:23
- 20#.##5.169.164:23
- 65.##.220.144:23
- 53.###.126.101:23
- 39.###.248.69:23
- 15#.##.133.79:23
- 16#.##.192.43:23
- 16#.##4.170.114:23
- 11#.##8.226.218:23
- 44.###.234.162:23
- 52.###.101.238:23
- 79.##.80.77:23
- 16#.##.251.237:23
- 12.##1.57.83:23
- 46.###.203.231:23
- 15#.##.100.139:23
- 19#.##2.119.203:23
- 15#.##7.139.11:23
- 18#.##5.75.89:23
- 12#.##2.216.157:23
- 19#.#4.80.87:23
- 89.##.26.160:23
- 84.##.237.6:23
- 22#.#0.75.76:23
- 9.###.240.47:23
- 53.##2.17.11:23
- 1.###.50.187:23
- 13#.##8.125.187:23
- 66.###.192.64:23
- 15#.##8.72.102:23
- 60.###.227.108:23
- 12#.##.241.52:23
- 16#.##.229.129:23
- 99.###.177.52:23
- 10#.##0.187.14:23
- 60.###.145.43:23
- 12#.##.255.139:23
- 12#.#7.79.0:23
- 17#.##.33.217:23
- 99.###.191.226:23
- 22#.##2.215.247:23
- 84.##.118.86:23
- 14#.##.222.50:23
- 14#.#.118.205:23
- 19#.##6.177.109:23
- 19#.##.232.69:23
- 10#.##.56.181:23
- 13#.##.63.213:23
- 58.###.15.159:23
- 16#.##.207.143:23
- 46.###.186.135:23
- 20#.##1.213.195:23
- 53.###.39.139:23
- 14#.##6.114.1:23
- 25.##.9.20:23
- 27.#.71.205:23
- 17#.#.3.228:23
- 59.###.213.239:23
- 27.##.139.150:23
- 21#.##.189.54:23
- 84.###.118.92:23
- 16#.##.53.153:23
- 20#.##.158.187:23
- 21#.##9.65.222:23
- 34.##.38.149:23
- 87.##.86.80:23
- 11#.#.76.228:23
- 13#.##1.218.226:23
- 14#.##0.192.128:23
- 75.##.169.134:23
- 64.##7.2.26:23
- 37.###.219.170:23
- 10#.##9.40.165:23
- 17.##4.95.10:23
- 17#.##.142.185:23
- 20#.##3.225.21:23
- 80.##.34.93:23
- 11#.##.106.103:23
- 32.###.232.174:23
- 47.###.143.129:23
- 13#.##9.206.181:23
- 16#.##6.23.197:23
- 19#.##2.108.202:23
- 16#.##4.206.87:23
- 92.###.233.207:23
- 17#.##0.205.233:23
- 18.##.251.78:23
- 13#.##0.28.21:23
- 18#.##2.41.93:23
- 15#.##8.209.59:23
- 18#.##.194.16:23
- 44.###.134.54:23
- 18.###.173.199:23
- 52.#.54.123:23
- 51.###.157.156:23
- 77.###.222.176:23
- 13#.##5.133.233:23
- 90.##.145.70:23
- 17#.##5.204.140:23
- 90.###.98.223:23
- 98.###.101.222:23
- 89.###.169.116:23
- 12#.##.213.207:23
- 27.##6.193.3:23
- 8.###.134.27:23
- 17#.##2.151.250:23
- 14#.##4.2.233:23
- 11#.##9.136.204:23
- 16#.##5.132.40:23
- 86.##5.23.5:23
- 21#.##6.181.111:23
- 10#.##.107.62:23
- 58.##.163.239:23
- 72.###.143.207:23
- 65.###.187.216:23
- 21#.##1.9.194:23
- 74.###.158.239:23
- 20#.##.112.154:23
- 16#.##.225.86:23
- 12#.##6.116.202:23
- 15#.##9.251.171:23
- 14#.##.218.70:23
- 20#.##1.117.0:23
- 11#.##5.11.10:23
- 18#.##.172.238:23
- 24.###.135.101:23
- 72.###.206.235:23
- 35.###.68.112:23
- 17#.##1.31.84:23
- 11#.##7.83.19:23
- 11#.##3.209.80:23
- 18#.##.171.168:23
- 20#.##6.29.228:23
- 94.#.182.232:23
- 21#.##1.114.131:23
- 20#.##4.87.75:23
- 80.##.39.49:23
- 20#.##.36.141:23
- 21#.##.247.188:23
- 20#.##3.154.82:23
- 63.###.202.94:23
- 63.###.163.208:23
- 74.##8.38.48:23
- 14#.##1.79.215:23
- 18#.##7.114.30:23
- 42.###.222.184:23
- 13#.##.165.212:23
- 64.#.27.152:23
- 46.##5.2.29:23
- 10#.##2.214.246:23
- 19#.##1.178.34:23
- 21#.##.31.170:23
- 13#.##.239.167:23
- 17#.##.139.211:23
- 14#.##8.92.169:23
- 17#.##7.232.134:23
- 21#.##5.12.246:23
- 89.###.157.197:23
- 17#.##.165.104:23
- 69.##.101.67:23
- 64.#.244.202:23
- 40.###.170.39:23
- 10#.#.35.97:23
- 99.#.214.226:23
- 57.###.82.161:23
- 17#.##3.235.131:23
- 42.###.153.113:23
- 11#.##.200.29:23
- 62.##2.58.23:23
- 79.##1.106.6:23
- 13#.##8.76.27:23
- 17#.##.34.255:23
- 11#.##.41.143:23
- 18#.##4.75.198:23
- 18#.##4.25.144:23
- 10#.##.97.182:23
- 1.##.224.219:23
- 98.###.131.97:23
- 16#.##5.217.230:23
- 13#.##.227.83:23
- 39.###.186.143:23
- 16#.##9.67.37:23
- 14#.##8.82.67:23
- 14#.##8.135.234:23
- 21#.##3.177.16:23
- 60.##.235.36:23
- 18.##.147.196:23
- 14#.#.3.187:23
- 13.###.246.39:23
- 14#.##.52.227:23
- 12#.##.180.202:23
- 15#.##9.47.202:23
- 85.###.103.14:23
- 15#.##.15.154:23
- 37.###.69.213:23
- 79.###.45.209:23
- 17#.##3.127.88:23
- 14#.##.199.225:23
- 17#.##1.146.75:23
- 14#.##6.237.33:23
- 14#.##3.163.239:23
- 21#.##9.25.222:23
- 14#.##1.62.182:23
- 11#.##.131.131:23
- 13#.##.180.31:23
Receives data from the following servers:
- 89.###.90.159:4444
- 89.###.90.159:7122
