Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- [kswapd0]
Kills the following processes:
- cmp
- cp
- dash
- apt-config
Performs operations with the file system:
Mounts file systems:
- /
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:46373
Establishes connection:
- 8.#.8.8:53
- 51.###.108.203:53
- 21#.##3.53.189:5667
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- LO####GBOATS.DYN
Sends data to the following servers:
- 21#.##3.53.189:5667
- 79.###.167.164:23
- 11#.##9.235.1:23
- 99.##.179.108:23
- 20#.##.24.252:23
- 10#.##0.235.129:23
- 23.###.204.140:23
- 19#.##7.18.53:23
- 12#.##.155.245:23
- 78.###.174.158:23
- 17#.##3.109.213:23
- 19#.##4.211.31:23
- 79.###.144.235:23
- 17#.##.186.107:23
- 20#.#.61.163:23
- 15#.##7.137.99:23
- 72.###.43.100:23
- 12#.##6.44.106:23
- 74.###.170.190:23
- 90.###.88.226:23
- 20#.##6.37.198:23
- 90.##1.73.33:23
- 19#.##.102.80:23
- 38.##.201.116:23
- 96.###.210.84:23
- 95.###.41.182:23
- 20#.##9.121.44:23
- 41.##.71.111:23
- 10#.##3.126.228:23
- 21#.##5.202.142:23
- 31.##.103.66:23
- 8.###.20.72:23
- 18#.##3.164.232:23
- 54.##.243.92:23
- 5.###.24.134:23
- 69.###.229.146:23
- 1.###.16.203:23
- 16#.##5.27.53:23
- 15#.##.210.235:23
- 19#.##8.17.134:23
- 18#.##7.149.178:23
- 20#.##3.121.240:23
- 13#.##7.214.46:23
- 62.#.147.112:23
- 10#.##2.85.58:23
- 39.#.133.184:23
- 43.##8.2.193:23
- 15#.##4.12.47:23
- 41.###.191.62:23
- 10#.##1.193.139:23
- 4.##.64.232:23
- 14#.#7.30.49:23
- 15#.##.228.173:23
- 54.###.240.223:23
- 8.##.184.186:23
- 14.##.150.100:23
- 11#.##5.35.211:23
- 17.###.173.20:23
- 63.#.87.100:23
- 18#.##2.47.44:23
- 80.###.86.211:23
- 19#.##.58.148:23
- 9.###.64.29:23
- 14#.##8.233.29:23
- 16#.##.252.227:23
- 66.###.95.229:23
- 19#.#.75.161:23
- 16#.##0.50.114:23
- 20#.##3.119.209:23
- 18#.#9.30.46:23
- 15#.##5.134.206:23
- 11#.##7.83.70:23
- 18#.##6.194.217:23
- 25.##.29.194:23
- 57.###.167.46:23
- 19#.##.246.120:23
- 17#.##1.172.251:23
- 88.###.166.222:23
- 90.##7.97.98:23
- 13#.##.163.76:23
- 16#.##4.64.116:23
- 16#.##.129.251:23
- 71.##.213.202:23
- 78.###.147.185:23
- 50.###.52.235:23
- 20#.##3.100.161:23
- 4.###.228.103:23
- 21#.##.86.105:23
- 10#.##.237.54:23
- 15#.##.255.140:23
- 4.##.93.145:23
- 84.###.83.235:23
- 1.###.227.51:23
- 17#.##5.97.123:23
- 16#.##7.178.110:23
- 13#.#0.56.73:23
- 53.##.31.111:23
- 21#.##1.31.237:23
- 19#.##.132.30:23
- 65.##7.90.69:23
- 16#.##.123.252:23
- 20#.##.124.165:23
- 19#.##.128.212:23
- 11#.##0.164.222:23
- 12#.##.55.114:23
- 17.##.19.30:23
- 14#.##9.135.30:23
- 18#.#5.24.80:23
- 13#.##5.10.233:23
- 63.###.177.12:23
- 75.###.19.223:23
- 17#.##.159.72:23
- 25.###.64.182:23
- 99.###.156.119:23
- 11#.##6.12.59:23
- 10#.##.30.210:23
- 41.###.213.238:23
- 15#.##9.31.143:23
- 14#.##2.244.95:23
- 92.##.21.233:23
- 16#.#14.6.87:23
- 14#.##.187.87:23
- 1.###.167.103:23
- 19#.##.54.201:23
- 13#.##.237.236:23
- 72.#.62.178:23
- 18#.##8.189.7:23
- 20#.##1.29.224:23
- 19#.##9.145.15:23
- 99.##.29.127:23
- 82.###.213.110:23
- 85.###.66.197:23
- 37.##7.61.81:23
- 42.###.12.211:23
- 20#.##3.226.6:23
- 16#.##4.26.188:23
- 17#.##6.158.32:23
- 19#.##8.22.179:23
- 16#.#.0.174:23
- 59.##.63.37:23
- 20#.##0.253.177:23
- 48.###.199.135:23
- 23.##.109.92:23
- 59.###.37.154:23
- 18#.##2.118.119:23
- 18#.##7.87.56:23
- 11#.##.237.114:23
- 93.###.173.10:23
- 46.##8.19.59:23
- 77.##.76.55:23
- 17#.##.143.227:23
- 21#.##.140.245:23
- 21#.##4.34.100:23
- 18#.##.89.135:23
- 93.##.35.191:23
- 81.###.239.39:23
- 20#.#3.51.32:23
- 10#.##4.229.188:23
- 17#.##2.121.46:23
- 40.###.96.228:23
- 21#.##1.33.177:23
- 25.##.218.222:23
- 77.###.252.211:23
- 19#.##8.201.1:23
- 19#.##.196.89:23
- 76.###.99.169:23
- 60.###.112.102:23
- 12#.##5.43.53:23
- 75.##.252.84:23
- 14#.##2.32.229:23
- 13#.##.121.120:23
- 82.###.238.151:23
- 14#.##3.124.135:23
- 88.##3.72.11:23
- 18#.#.194.22:23
- 18#.##2.98.244:23
- 10#.##.209.215:23
- 81.###.89.121:23
- 10#.##4.56.55:23
- 17#.##8.151.17:23
- 17#.##0.145.60:23
- 89.##.144.50:23
- 39.##.72.10:23
- 44.##.104.218:23
- 10#.##.194.203:23
- 65.##.227.247:23
- 77.###.187.101:23
- 47.###.123.115:23
- 16#.#2.83.52:23
- 88.###.23.232:23
- 17#.##.176.76:23
- 13#.##8.51.11:23
- 20#.##4.52.224:23
- 20#.##7.173.52:23
- 98.###.145.109:23
- 15#.##9.132.160:23
- 17#.##0.178.118:23
- 73.###.86.151:23
- 14#.##5.178.226:23
- 16#.##.242.11:23
- 91.##.82.97:23
- 47.##1.3.104:23
- 8.##.153.215:23
- 15#.##5.139.140:23
- 20#.##8.143.253:23
- 27.###.223.51:23
- 16#.#.108.77:23
- 40.##8.0.222:23
- 4.##.119.143:23
- 82.##.175.47:23
- 16#.#.10.46:23
- 21#.##8.70.203:23
- 18#.##4.152.180:23
- 10#.##7.216.164:23
- 11#.##6.1.234:23
- 14#.##.35.176:23
- 11#.##0.230.18:23
- 19#.##.37.229:23
- 13#.##4.239.173:23
- 94.##7.11.53:23
- 96.##.216.117:23
- 57.##.41.45:23
- 17#.##5.11.249:23
- 24.###.197.99:23
- 14#.##.232.53:23
- 79.###.186.41:23
- 37.##7.27.3:23
- 19#.##1.116.18:23
- 10#.#.9.182:23
- 46.##3.36.46:23
- 14.##8.17.52:23
- 23.###.152.130:23
- 34.###.64.110:23
- 45.##1.33.69:23
- 18.##.188.171:23
- 51.###.200.64:23
- 14#.##.145.63:23
- 69.##.173.230:23
- 20#.##9.182.219:23
- 10#.##5.213.112:23
- 24.###.204.16:23
- 12#.##1.13.22:23
- 19#.##1.25.247:23
- 80.###.155.135:23
- 18#.##3.127.251:23
- 57.##.15.79:23
- 10#.##.148.137:23
- 21#.##4.252.250:23
- 36.###.58.218:23
- 12#.##.22.119:23
- 14#.##.248.173:23
- 14#.##8.18.159:23
- 19#.#58.5.48:23
- 14#.#.159.57:23
- 12#.##4.240.145:23
- 12#.##4.143.175:23
- 22#.##3.96.201:23
- 37.###.220.89:23
- 10#.##6.25.254:23
- 13#.##5.30.206:23
- 12#.##7.152.162:23
- 13#.#.162.224:23
- 68.###.131.43:23
- 20#.##.147.80:23
- 12#.##2.74.39:23
- 12.#.207.98:23
- 14#.##.242.180:23
- 86.###.168.196:23
- 14#.##1.181.248:23
- 84.##1.17.23:23
- 20#.##5.45.225:23
- 14#.##7.134.102:23
- 14#.##.126.193:23
- 19#.##.115.101:23
- 20#.##9.160.135:23
- 45.###.56.171:23
- 19#.##4.117.139:23
- 9.###.181.251:23
- 21#.##3.83.132:23
- 20#.##5.218.194:23
- 21#.##.224.200:23
- 52.##.1.247:23
- 12#.##.204.72:23
- 5.###.78.128:23
- 12#.##4.201.17:23
- 89.##.133.222:23
- 10#.##4.119.229:23
- 22#.##8.238.90:23
- 79.###.12.191:23
- 89.##.223.76:23
- 21#.##.113.72:23
- 17#.##.218.150:23
- 14#.##3.184.185:23
- 45.###.132.126:23
- 89.###.25.171:23
- 39.###.146.201:23
- 14#.##.175.185:23
- 14#.##.41.202:23
- 16#.##4.239.87:23
- 47.##.158.249:23
- 74.###.253.148:23
- 12#.##5.249.109:23
- 12#.##6.112.203:23
- 10#.##3.91.181:23
- 16#.##.125.110:23
- 16#.##7.152.229:23
- 21#.##.208.82:23
- 20.##4.25.79:23
- 17#.##0.140.181:23
- 19.#.167.166:23
- 63.##.132.213:23
- 17#.##9.168.142:23
- 17#.##.208.39:23
- 12#.##4.82.176:23
- 61.###.121.21:23
- 15#.##0.254.165:23
- 68.###.117.133:23
- 15#.##8.204.0:23
- 67.##.121.73:23
- 90.###.204.81:23
- 18#.##1.134.71:23
- 43.##.119.14:23
- 20#.##4.125.240:23
- 75.#.254.89:23
- 14#.#2.26.81:23
- 43.###.234.126:23
- 10#.##0.96.197:23
- 34.###.199.128:23
- 10#.##9.68.237:23
- 15#.##0.165.98:23
- 14#.##.158.236:23
- 18#.##7.57.34:23
- 12#.#.171.133:23
- 77.###.187.32:23
- 20#.##7.54.167:23
- 16#.##.241.33:23
- 74.###.205.214:23
- 57.##.155.216:23
- 90.###.184.153:23
- 15#.##0.73.182:23
- 19#.#.82.227:23
- 42.###.220.230:23
- 18#.#1.8.220:23
- 11#.##8.62.114:23
- 10#.##8.219.38:23
- 39.##.251.133:23
- 98.##.238.80:23
- 16#.##5.248.22:23
- 19#.##6.71.103:23
- 17#.##0.221.193:23
- 11#.##.251.71:23
- 17#.##2.221.42:23
- 17#.#17.5.5:23
- 11#.##2.179.205:23
- 38.##.8.203:23
- 10#.##4.52.226:23
- 12#.##.143.210:23
- 12#.##.249.179:23
- 36.###.101.126:23
- 17#.##3.12.46:23
- 59.###.39.175:23
- 21#.##.223.112:23
- 36.###.20.213:23
- 81.##.205.156:23
- 15#.##8.246.175:23
- 10#.##4.132.251:23
- 19#.##.194.235:23
- 18#.##7.245.20:23
- 13#.##8.110.193:23
- 15#.##0.91.90:23
- 15#.##1.109.204:23
- 10#.##.172.225:23
- 37.##2.4.60:23
- 13#.##.201.114:23
- 27.###.242.208:23
- 68.###.165.218:23
- 20#.##.105.212:23
- 45.###.155.152:23
- 18#.##5.145.255:23
- 17#.##3.100.236:23
- 10#.#.94.23:23
- 68.##.140.217:23
- 20#.##5.188.226:23
- 86.###.133.173:23
- 16#.#2.44.58:23
- 4.##.97.188:23
- 57.##.78.221:23
- 44.###.101.117:23
- 18#.##.92.183:23
- 13#.#.73.189:23
- 15#.##9.121.181:23
- 13#.##0.241.219:23
- 13#.##7.228.175:23
- 46.###.13.180:23
- 13#.##9.133.125:23
- 11#.##2.229.238:23
- 57.##.252.91:23
- 15#.##2.207.68:23
- 22#.##.177.165:23
- 74.##.102.88:23
- 14#.##9.79.204:23
- 18.###.160.186:23
- 97.##.193.223:23
- 15#.##1.221.145:23
- 42.##.223.156:23
- 72.###.210.35:23
- 14#.##8.173.208:23
- 82.###.142.71:23
- 13#.##7.70.114:23
- 15#.#.202.47:23
- 13#.##6.176.2:23
- 73.##5.7.179:23
- 16#.##8.202.41:23
- 50.##.50.95:23
- 13#.##3.98.119:23
- 13#.##1.133.231:23
- 57.##.54.23:23
- 70.###.210.58:23
- 86.###.150.191:23
- 35.#.242.209:23
- 20#.#.120.53:23
- 13#.##.15.141:23
- 20#.##.221.31:23
- 20#.##7.45.200:23
- 15#.##.150.103:23
- 14#.##8.216.53:23
- 89.###.250.181:23
- 8.###.212.235:23
- 31.###.148.62:23
- 10#.##.248.244:23
- 21#.#.201.201:23
- 17#.#1.68.51:23
- 80.###.226.248:23
- 57.###.106.163:23
- 20#.##4.148.82:23
- 16#.##8.184.18:23
- 58.##.145.73:23
- 72.##.236.215:23
- 18#.#.114.130:23
- 14#.##.254.13:23
- 80.##.182.146:23
- 13#.##.88.239:23
- 51.##.248.82:23
- 11#.#.117.92:23
- 51.##.164.77:23
- 94.###.63.241:23
- 82.##.84.224:23
- 18#.##1.7.195:23
- 22#.##5.151.57:23
Receives data from the following servers:
- 21#.##3.53.189:5667
Other:
Collects information about network activity
