Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- i7C2UDMCAnJ0
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:23
- 0.0.0.0:22
- 0.0.0.0:443
- 0.0.0.0:81
- 0.0.0.0:8080
Establishes connection:
- 8.#.8.8:53
- 16#.##.227.111:721
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 10#.##.100.169:23
- 23.##2.36.18:23
- 18#.##8.12.90:23
- 19#.##7.86.64:23
- 16#.##8.224.179:23
- 15#.##7.211.135:23
- 20#.##.165.133:23
- 21#.##0.90.168:23
- 16#.##7.250.0:23
- 43.###.113.97:23
- 21#.##0.82.209:23
- 34.##.75.56:23
- 10#.##6.227.254:23
- 61.##.183.167:23
- 15#.##8.128.226:23
- 20#.##.72.249:23
- 12#.##8.226.151:23
- 12#.##.138.33:23
- 8.##.221.166:23
- 19.###.116.153:23
- 70.#.238.180:23
- 11#.##6.67.68:23
- 94.##.2.132:23
- 12#.##.39.241:23
- 21#.##9.44.49:23
- 11#.##5.254.145:23
- 11#.##4.237.227:23
- 19#.##8.132.76:23
- 17.###.205.125:23
- 34.##.205.15:23
- 61.###.112.83:23
- 11#.##.153.66:23
- 68.#.225.139:23
- 19#.##.189.185:23
- 91.##0.97.20:23
- 36.###.85.210:23
- 20#.##5.62.85:23
- 13#.#3.30.0:23
- 65.##.58.75:23
- 14#.##.250.56:23
- 87.##.109.155:23
- 78.###.178.115:23
- 21#.#54.3.33:23
- 17#.##0.96.29:23
- 39.##.253.121:23
- 74.###.90.229:23
- 9.###.250.21:23
- 19#.##.55.217:23
- 97.###.205.177:23
- 21#.##.170.248:23
- 16#.#34.65.2:23
- 11#.##.101.47:23
- 35.##.199.10:23
- 12#.##.209.230:23
- 15#.##.80.122:23
- 11#.##.102.215:23
- 16#.#5.64.4:23
- 20#.##8.221.136:23
- 24.##.165.8:23
- 15#.##8.32.104:23
- 13#.##1.40.143:23
- 20#.##6.224.201:23
- 15#.##8.233.196:23
- 24.##.136.237:23
- 19#.##9.44.192:23
- 79.###.206.88:23
- 19#.##.148.199:23
- 18#.##.238.62:23
- 14#.##.143.108:23
- 18#.#.17.103:23
- 13#.##9.186.232:23
- 19#.##2.189.94:23
- 27.##.165.29:23
- 11#.##3.129.187:23
- 58.###.227.253:23
- 21#.##4.12.161:23
- 9.###.108.239:23
- 11#.##9.161.215:23
- 16#.##.206.39:23
- 10#.##.176.145:23
- 15#.#.100.105:23
- 71.##.14.76:23
- 54.###.84.212:23
- 17#.#.182.81:23
- 11#.##.168.77:23
- 19#.##.16.108:23
- 44.##.150.109:23
- 21#.##.79.201:23
- 68.#.131.121:23
- 17.###.218.46:23
- 19#.##4.12.173:23
- 90.##5.0.79:23
- 15#.##.65.105:23
- 18#.##.104.160:23
- 59.###.64.157:23
- 69.##.213.91:23
- 15#.##4.210.150:23
- 15#.##.205.226:23
- 62.###.64.230:23
- 75.##8.20.56:23
- 11#.##0.32.245:23
- 58.##.185.2:23
- 98.##.227.31:23
- 15#.##1.79.110:23
- 17#.##9.133.36:23
- 13#.##4.215.129:23
- 20#.##8.178.164:23
- 17#.#08.4.63:23
- 11#.##.227.183:23
- 17#.##.124.157:23
- 32.##.238.24:23
- 10#.##.212.77:23
- 71.###.137.108:23
- 18.###.97.247:23
- 44.##.65.194:23
- 20#.##.170.181:23
- 2.###.7.142:23
- 96.##.104.62:23
- 36.##4.52.47:23
- 19#.##5.99.137:23
- 21#.##1.252.0:23
- 63.##.153.157:23
- 99.###.109.114:23
- 16#.##6.58.180:23
- 10#.##0.106.123:23
- 18#.##5.116.206:23
- 87.###.79.215:23
- 18#.##4.67.116:23
- 21#.##0.30.114:23
- 8.##.219.193:23
- 17#.##.140.113:23
- 8.##.223.213:23
- 19#.##.219.61:23
- 21#.#.18.98:23
- 15#.##.245.190:23
- 57.##8.27.85:23
- 18#.##.38.230:23
- 15#.##.32.204:23
- 22#.##5.205.66:23
- 16#.##1.121.255:23
- 19#.##7.144.227:23
- 20#.##3.104.227:23
Receives data from the following servers:
- 16#.##.227.111:721
