Technical Information
Malicious functions:
Launches processes:
- <SAMPLE_FULL_PATH> \x0a
Network activity:
Establishes connection:
- 8.#.8.8:53
- 64.###.161.103:9
- 64.###.161.147:9
- 64.###.161.105:9
- 64.###.161.104:9
- 64.##3.161.99:9
- 64.###.161.106:9
- [2######50:4010:c08::69]:9
- [2######50:4010:c08::63]:9
- [2######50:4010:c08::93]:9
- [2######50:4010:c08::68]:9
- 5.###.101.109:60137
- 21#.###.57.141:22222
- 10#.##.37.195:222
- 94.###.132.81:222
- 94.###.137.201:222
- 11#.##8.99.220:2222
- 16#.##1.248.238:222
- 38.###.195.241:2222
- 14#.##7.91.255:2222
- 22#.###.247.47:22222
- 16#.##1.110.142:222
- 14#.##7.240.131:222
- 14#.##.198.68:222
- 45.##.207.167:2222
- 31.###.203.204:2222
- 16#.##1.109.238:222
- 11#.##3.228.236:222
- 95.##.94.172:222
- 15#.##6.145.234:222
- 18#.###.248.231:2222
- 20#.##.51.156:222
- 34.##.249.42:222
- 16#.##2.93.70:22222
- 69.###.13.10:22222
- 89.###.113.224:222
- 94.###.131.160:222
- 19#.##0.93.121:2222
- 15#.#.230.150:222
- 13#.##0.155.119:222
- 34.##.213.195:2222
- 14#.###.209.129:22222
- 77.##.181.101:222
- 16#.##.122.251:222
- 21#.##3.242.168:222
- 38.###.196.103:2222
- 95.##.115.84:222
- 10#.##1.208.244:222
- 19#.##0.90.214:222
- 31.###.215.134:22222
- 94.###.43.239:22222
- 10#.##.58.45:222
- 5.###.41.166:22222
- 5.###.210.172:222
- 10#.##.31.253:222
- 15#.##3.85.176:222
- 20#.##9.195.63:222
- 35.###.29.249:222
- 21#.##.107.107:222
- 34.###.158.92:22222
- 14#.##7.182.146:222
- 34.###.76.209:222
- 20#.#.138.208:222
- 45.###.255.135:222
- 13#.###.228.134:2222
- 15#.##6.15.38:22222
- 15.###.152.3:222
- 34.###.26.11:222
- 13.##.190.233:2222
- 15#.##.49.131:222
- 5.###.91.182:22222
- 15#.##0.82.128:222
- 34.##.18.116:2222
- 15#.###.135.187:22222
- 10#.##.32.71:222
- 38.###.94.19:222
- 15#.##6.146.30:222
- 13#.##2.31.94:222
- 10#.##.183.85:2222
- 10#.##8.47.24:22222
- 23.##.223.237:2222
- 96.###.47.122:222
- 83.##.194.131:22222
- 34.###.104.110:2222
- 94.##2.7.29:222
- 34.###.177.84:2222
- 16#.###.210.150:22222
- 15#.##.212.26:2222
- 14#.##7.55.32:22222
- 35.###.234.128:2222
- 10#.##.3.1:22222
- 22#.##8.235.201:222
- 10#.##.41.18:222
- 13#.###.137.147:2222
- 16#.###.94.110:22222
- 22#.##8.221.8:2222
- 35.###.213.235:222
- 17#.##.174.118:22222
- 14#.##.102.141:2222
- 89.##.84.196:22222
- 96.###.7.196:2222
- 83.##.20.2:222
- 10#.##2.213.163:222
- 5.###.180.58:2222
- 16#.###.16.177:22222
- 72.##.170.253:222
- 60.###.249.250:22222
- 10#.###.139.69:22222
- 89.###.109.158:222
- 31.###.226.248:222
- 15#.##8.12.81:2222
- 43.###.66.168:2222
- 78.###.167.112:2222
- 15.###.106.26:222
- 10#.##.32.92:222
- 21#.##3.54.56:2222
- 45.##.235.207:22222
- 96.###.47.153:222
- 10#.##6.10.105:222
- 34.##.86.122:22222
- 13#.##2.138.23:2222
- 38.###.195.127:222
- 13#.###.110.217:2222
- 35.###.192.238:2222
- 14#.##.86.184:2222
- 38.##.192.203:2222
- 83.##.195.87:2222
- 96.###.7.33:2222
- 19#.##.16.188:222
- 34.##.76.16:222
- 45.##.95.167:222
- 15#.##.28.172:2222
- 31.###.226.155:222
- 38.###.22.138:222
Attacks using a special dictionary (brute-force technique) via the SSH protocol
Sends data to the following servers:
- 8.#.8.8:53
- 5.###.101.109:60137
- 16#.##2.93.70:22222
- 11#.##3.228.236:222
- 13.##.190.233:2222
- 10#.##.183.85:2222
- 72.##.170.253:222
- 38.##.192.203:2222
Receives data from the following servers:
- 8.#.8.8:53
- 5.###.101.109:60137
- 14#.##.198.68:222
- 31.###.203.204:2222
- 45.##.207.167:2222
- 14#.##7.240.131:222
- 14#.##7.91.255:2222
- 16#.##2.93.70:22222
- 21#.###.57.141:22222
- 34.##.249.42:222
- 95.##.94.172:222
- 34.##.213.195:2222
- 13#.##0.155.119:222
- 22#.###.247.47:22222
- 77.##.181.101:222
- 11#.##8.99.220:2222
- 19#.##0.93.121:2222
- 11#.##3.228.236:222
- 89.###.113.224:222
- 38.###.195.241:2222
- 69.###.13.10:22222
- 15#.#.230.150:222
- 14#.###.209.129:22222
- 20#.##.51.156:222
- 15#.##6.145.234:222
- 10#.##.37.195:222
- 18#.###.248.231:2222
- 16#.##.122.251:222
- 21#.##3.242.168:222
- 38.###.196.103:2222
- 31.###.215.134:22222
- 95.##.115.84:222
- 19#.##0.90.214:222
- 10#.##1.208.244:222
- 10#.##.58.45:222
- 5.###.41.166:22222
- 10#.##.31.253:222
- 5.###.210.172:222
- 20#.##9.195.63:222
- 21#.##.107.107:222
- 34.###.158.92:22222
- 35.###.29.249:222
- 34.###.76.209:222
- 20#.#.138.208:222
- 45.###.255.135:222
- 34.###.26.11:222
- 15.###.152.3:222
- 34.##.18.116:2222
- 15#.##0.82.128:222
- 5.###.91.182:22222
- 13.##.190.233:2222
- 15#.##6.15.38:22222
- 15#.##.49.131:222
- 10#.##.32.71:222
- 10#.##.183.85:2222
- 23.##.223.237:2222
- 10#.##8.47.24:22222
- 96.###.47.122:222
- 15#.##6.146.30:222
- 15#.###.135.187:22222
- 38.###.94.19:222
- 13#.##2.31.94:222
- 34.###.177.84:2222
- 34.###.104.110:2222
- 16#.###.210.150:22222
- 35.###.213.235:222
- 15#.##.212.26:2222
- 10#.##.41.18:222
- 35.###.234.128:2222
- 14#.##7.55.32:22222
- 22#.##8.221.8:2222
- 13#.###.137.147:2222
- 10#.##.3.1:22222
- 89.##.84.196:22222
- 96.###.7.196:2222
- 5.###.180.58:2222
- 72.##.170.253:222
- 31.###.226.248:222
- 43.###.66.168:2222
- 60.###.249.250:22222
- 10#.###.139.69:22222
- 89.###.109.158:222
- 78.###.167.112:2222
- 10#.##.32.92:222
- 34.##.86.122:22222
- 96.###.47.153:222
- 45.##.235.207:22222
- 10#.##6.10.105:222
- 35.###.192.238:2222
- 13#.##2.138.23:2222
- 13#.###.110.217:2222
- 38.##.192.203:2222
- 96.###.7.33:2222
- 38.###.195.127:222
- 19#.##.16.188:222
- 34.##.76.16:222
- 45.##.95.167:222
- 31.###.226.155:222
