Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- e38387
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:33337
Establishes connection:
- 8.#.8.8:53
- 10#.#00.5.10:24
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- ro##y.shop
Sends data to the following servers:
- 10#.#00.5.10:24
- 15#.##5.121.40:23
- 99.##.161.126:23
- 24#.#.153.5:23
- 19.###.199.251:23
- 67.###.28.250:23
- 20.##.88.137:23
- 20#.##7.242.186:23
- 22#.##0.110.165:23
- 22#.##.108.12:23
- 18#.##.236.247:23
- 16#.##.215.254:23
- 15#.##5.97.44:23
- 13#.##1.166.87:23
- 18#.##8.105.186:23
- 13#.#69.2.97:23
- 21#.##9.102.192:23
- 50.###.19.205:23
- 90.###.163.204:23
- 86.###.158.133:23
- 80.###.184.189:23
- 11#.##.182.98:23
- 79.###.181.47:23
- 85.###.79.221:23
- 24#.##1.12.250:23
- 15#.##.122.42:23
- 24#.##.223.121:23
- 24#.##6.153.70:23
- 25#.##9.92.254:23
- 21#.##2.248.244:23
- 14#.#9.86.29:23
- 23#.##7.114.170:23
- 23#.##.104.121:23
- 23#.##9.71.116:23
- 21#.##8.16.65:23
- 64.###.111.255:23
- 19#.##.228.120:23
- 15#.##5.132.35:23
- 17#.##.153.180:23
- 18#.#3.42.0:23
- 24#.##5.156.23:23
- 20#.##0.66.151:23
- 54.##.135.125:23
- 17#.##1.125.6:23
- 70.##.38.192:23
- 89.###.131.104:23
