Technical Information
Malicious functions:
Launches itself as a daemon
Kills system processes:
- sshd
Kills the following processes:
- cron
- atd
- systemd-logind
- rsyslogd
- dbus-daemon
- agetty
- exim4
- bash
- run.sh
- kworker/u2:1
- kworker/u2:2
- systemd
Network activity:
Establishes connection:
- 8.#.8.8:53
- 80.###.134.53:666
- 80.###.134.53:374
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 20#.##.130.108:23
- 9.###.229.37:23
- 12#.##.189.132:23
- 12#.##0.87.182:23
- 21#.##1.60.83:23
- 13#.##4.17.232:23
- 96.###.109.137:23
- 50.###.137.200:23
- 19#.#6.51.61:23
- 13#.#7.38.28:23
- 15#.##.188.145:23
- 15#.##7.229.188:23
- 31.###.151.170:23
- 14#.#.150.242:23
- 13#.##7.164.34:23
- 96.###.150.126:23
- 13#.##.104.99:23
- 15#.#.99.112:23
- 12#.##8.105.1:23
- 12.##.191.247:23
- 21#.##9.78.30:23
- 65.###.144.134:23
- 13#.##7.13.176:23
- 17#.##8.108.235:23
- 13#.##0.118.33:23
- 11#.##4.54.141:23
- 94.###.208.66:23
- 19#.##8.62.132:23
- 14#.##.139.133:23
- 12#.##3.222.72:23
- 12#.##.197.18:23
- 15#.##.126.29:23
- 18#.##.219.93:23
- 95.##9.18.63:23
- 14#.##.161.226:23
- 83.##7.83.11:23
- 22#.##3.244.123:23
- 70.#.75.66:23
- 13#.##.150.182:23
- 93.##.222.18:23
- 60.###.104.193:23
- 61.##5.9.123:23
- 15#.##4.15.52:23
- 14#.##.42.109:23
- 17#.##7.22.68:23
- 10#.##4.178.198:23
- 19#.##3.199.184:23
- 81.##.86.26:23
- 14#.##6.65.212:23
- 13#.#.165.120:23
- 16#.##.149.100:23
- 10#.##4.113.91:23
- 20#.##.157.133:23
- 87.###.208.220:23
- 13#.##9.97.18:23
- 19.###.200.89:23
- 50.###.205.113:23
- 8.###.130.48:23
- 36.###.223.130:23
- 20#.##6.98.45:23
- 47.##.127.49:23
- 45.##0.19.29:23
- 89.##.82.225:23
- 22#.##.139.37:23
- 14#.##.84.215:23
- 93.###.168.202:23
- 66.###.130.225:23
- 11#.##.104.44:23
- 17#.##6.209.225:23
- 15#.#5.32.51:23
- 18#.#1.35.44:23
- 15#.##.187.173:23
- 12.##.186.48:23
- 10#.##6.117.180:23
- 11#.##7.177.212:23
- 17#.##3.179.88:23
- 17#.##1.53.37:23
- 17#.##4.18.160:23
- 12#.##3.190.155:23
- 4.###.110.164:23
- 49.##7.84.66:23
- 10#.##.109.138:23
- 46.###.103.197:23
- 21#.##4.110.249:23
- 68.###.31.168:23
- 17#.##.78.150:23
- 14#.#1.57.88:23
- 18#.##.219.88:23
- 22#.##8.225.117:23
- 22#.##5.54.34:23
- 12#.##3.240.16:23
- 69.##.34.123:23
- 15#.##2.181.238:23
- 19#.#9.87.3:23
- 78.###.45.254:23
- 12#.##5.112.2:23
- 20#.##.165.84:23
- 14#.##2.242.204:23
- 15#.#06.4.83:23
- 12#.##9.58.106:23
- 36.##.47.30:23
- 11#.##3.122.33:23
- 22#.##3.62.127:23
- 11#.#.62.44:23
- 21#.##1.54.68:23
- 59.###.183.29:23
- 17#.#4.32.71:23
- 70.###.73.239:23
- 13#.##8.31.141:23
- 66.#.217.149:23
- 19#.##3.151.99:23
- 18#.##5.216.22:23
- 17#.##2.13.124:23
- 60.###.63.206:23
- 68.###.177.188:23
- 84.##.90.71:23
- 11#.##.103.158:23
- 16#.##4.219.241:23
- 14#.#2.19.28:23
- 20#.##.218.244:23
- 5.##.114.3:23
- 14#.##.238.58:23
- 13.##2.238.6:23
- 60.###.227.210:23
- 71.##.108.123:23
- 18#.##4.153.225:23
- 51.##.70.160:23
- 16#.#.125.223:23
- 65.##.186.47:23
- 15#.##5.150.248:23
- 19.###.105.107:23
- 93.##8.114.1:23
- 10#.#.49.164:23
- 11#.##6.118.98:23
- 16#.##8.94.72:23
- 34.###.110.32:23
- 12#.##4.244.184:23
- 10#.##.138.107:23
- 68.##.146.230:23
- 18#.##.232.36:23
- 16#.#77.39.4:23
- 12#.##.124.228:23
- 12#.##5.251.217:23
- 16#.##4.142.24:23
- 51.##9.94.37:23
- 78.##.216.174:23
- 60.##.188.30:23
- 10#.##3.167.35:23
- 20#.##.191.246:23
- 20#.##9.71.198:23
- 10#.##.18.169:23
- 16#.##5.214.68:23
- 98.###.219.121:23
- 52.###.133.193:23
- 12#.##6.202.77:23
- 87.###.46.101:23
- 15#.##7.246.95:23
- 13#.#1.73.36:23
- 58.###.87.107:23
- 20#.##6.246.147:23
- 19#.##9.67.71:23
- 57.##.75.163:23
- 92.###.54.120:23
- 18.##6.46.92:23
- 11#.##2.196.33:23
- 70.##8.5.122:23
- 11#.#.191.244:23
- 95.###.173.118:23
- 10#.##.142.52:23
- 10#.##.29.187:23
- 47.###.245.111:23
- 18#.##5.247.3:23
- 17#.#6.250.7:23
- 14#.##1.60.239:23
- 80.##.200.141:23
- 90.##2.3.129:23
- 13#.##.33.203:23
- 21#.##.82.111:23
- 48.##.255.251:23
- 17#.##1.104.115:23
- 13#.#23.71.2:23
- 77.##6.90.19:23
- 17#.##4.182.155:23
- 25.###.10.178:23
- 45.##9.72.55:23
- 16#.##1.210.235:23
- 74.###.76.232:23
- 14#.##.85.187:23
- 79.##.148.37:23
- 19#.##.133.133:23
- 12#.##8.2.126:23
- 14#.##3.26.205:23
- 14#.##.140.24:23
- 48.##0.59.44:23
- 74.##.68.104:23
- 44.##.37.164:23
- 67.##.11.66:23
- 59.###.165.147:23
- 15#.#6.56.56:23
- 24.##.7.151:23
- 18#.##7.206.169:23
- 18#.##3.44.170:23
- 77.###.233.37:23
- 21#.#3.58.21:23
- 11#.##4.154.252:23
- 14#.##6.68.25:23
- 11#.##0.163.190:23
- 12#.#0.95.26:23
- 62.###.44.127:23
- 42.##.13.122:23
- 77.##.32.140:23
- 15#.##.202.163:23
- 22#.#1.90.44:23
- 13#.##2.250.109:23
- 9.###.249.196:23
- 22#.#5.40.71:23
- 72.##.229.114:23
- 13#.##.183.235:23
- 13#.##8.140.223:23
- 12#.##4.155.87:23
- 14#.##3.206.144:23
- 16#.##4.239.132:23
- 65.###.238.235:23
- 19#.##2.255.41:23
- 67.##6.76.50:23
- 21#.##1.95.105:23
- 24.###.157.148:23
- 19#.##.110.191:23
- 43.###.144.45:23
- 88.###.140.155:23
- 18#.##4.185.179:23
- 14#.##3.232.212:23
- 21#.##3.244.230:23
- 47.###.169.209:23
- 88.###.118.20:23
- 94.###.189.208:23
- 71.###.62.114:23
- 14#.##4.190.157:23
- 20#.#7.59.44:23
- 10#.#47.9.7:23
- 19#.##9.189.43:23
- 16#.##.58.144:23
- 88.#.232.86:23
- 58.##.75.221:23
- 15#.##6.189.225:23
- 12#.##1.13.77:23
- 19#.##4.164.251:23
- 13#.##.240.240:23
- 48.##.139.168:23
- 14#.##7.144.36:23
- 19#.##.66.179:23
- 14.##.233.126:23
- 20#.##.161.245:23
- 18#.##2.79.157:23
- 43.##.82.84:23
- 15#.##9.47.151:23
- 19#.##.135.120:23
- 13#.##7.204.115:23
- 12#.##.173.33:23
- 39.##.82.204:23
- 14.##.220.208:23
- 11#.##8.17.239:23
- 18#.#8.30.27:23
- 13#.##.160.203:23
- 10#.#6.18.42:23
- 85.###.243.64:23
- 18#.##3.26.227:23
- 14#.##3.163.111:23
- 11#.##4.127.76:23
- 10#.##6.154.160:23
- 92.##5.220.9:23
- 13#.##3.109.129:23
- 62.###.162.217:23
- 24.#.97.78:23
- 17#.##0.39.84:23
- 94.###.209.63:23
- 13#.##2.201.158:23
- 21#.##.205.178:23
- 42.###.233.249:23
- 20#.##.93.165:23
- 14#.##4.116.126:23
- 88.##.175.154:23
- 17#.##7.42.206:23
- 49.###.103.24:23
- 44.##.199.74:23
- 10#.##1.254.227:23
- 16#.##2.102.176:23
- 14#.#5.8.99:23
- 23.###.61.101:23
- 85.###.10.195:23
- 90.#.166.69:23
- 93.###.56.107:23
- 96.##.48.158:23
- 11#.##.41.101:23
- 5.###.75.217:23
- 22#.##8.169.65:23
- 18#.##.109.27:23
- 5.##.67.45:23
- 79.###.114.195:23
- 14#.##.74.105:23
- 20#.##7.142.35:23
- 16#.##9.127.33:23
- 21#.##.141.88:23
- 81.###.248.178:23
- 17#.##6.194.77:23
- 16#.#0.35.41:23
- 31.##.195.23:23
- 19#.##5.170.56:23
- 21#.##.190.75:23
- 16#.##.129.101:23
- 17#.##6.13.119:23
- 73.##.197.190:23
- 19#.##.100.87:23
- 45.###.72.103:23
- 80.##.43.222:23
- 14#.##.228.72:23
- 19#.##2.55.124:23
- 93.#.234.82:23
- 13#.##6.82.182:23
- 11#.##.96.244:23
- 49.##.220.76:23
- 40.##.225.11:23
- 64.###.107.11:23
- 88.#.219.107:23
- 15#.##3.147.218:23
- 13#.#8.7.6:23
- 72.###.67.188:23
- 17#.##0.58.70:23
- 20.#.138.141:23
- 21#.##.24.140:23
- 87.###.55.255:23
- 10#.#6.2.130:23
- 21#.##1.71.167:23
- 59.##4.67.78:23
- 12#.##4.172.40:23
- 20#.##8.207.95:23
- 22#.##.159.81:23
- 10#.##6.151.234:23
- 16#.##.198.183:23
- 17#.##.22.148:23
- 18#.##8.55.206:23
- 89.##6.45.14:23
- 12#.##.229.163:23
- 47.###.102.173:23
- 49.###.145.220:23
- 43.##.51.70:23
- 17#.##.189.183:23
- 62.###.84.189:23
- 49.##.240.126:23
- 18#.##8.121.141:23
- 15#.##2.6.215:23
