Техническая информация
Вредоносные функции:
Запускает себя в качестве демона
Подменяет имя приложения на:
- /bin/busybox
Запускает процессы:
- /bin/sh -c export PATH=/root:$PATH
- /bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/.bash_profile
Завершает системные процессы:
- sshd
Завершает следующие процессы:
- dhclient
- rpcbind
- rpc.statd
- rpc.idmapd
- cron
- atd
- systemd-logind
- Unknown process with PID: 726
- Unknown process with PID: 731
- Unknown process with PID: 734
- Unknown process with PID: 738
- systemd
Выполняет операции с файловой системой:
Создает или модифицирует файлы:
- <SAMPLE_FULL_PATH>
- /root/.bash_profile
Сетевая активность:
Устанавливает соединение:
- 19#.##.97.85:9090
- 15#.###.254.253:37215
- 19#.###.254.253:37215
- 15#.###.175.62:37215
- 15#.###.147.253:37215
- 41.###.14.239:37215
- 19#.###.112.12:37215
- 41.##.123.126:37215
- 19#.###.237.12:37215
- 19#.##.3.151:37215
- 41.###.66.142:37215
- 15#.##.68.238:37215
- 41.##.130.186:37215
- 15#.##.230.158:37215
- 15#.###.238.229:37215
- 15#.##.64.149:37215
- 41.##.228.127:37215
- 41.###.125.52:37215
- 15#.###.201.11:37215
- 15#.##.159.45:37215
- 41.##.124.99:37215
- 41.##.38.152:37215
- 41.##.173.249:37215
- 41.###.110.241:37215
- 41.##.152.108:37215
- 15#.###.35.220:37215
- 19#.###.116.61:37215
- 41.###.119.77:37215
- 19#.##.103.176:37215
- 15#.###.90.173:37215
- 41.###.93.13:37215
- 15#.###.196.221:37215
- 41.##.36.3:37215
- 41.###.2.86:37215
- 41.###.15.63:37215
- 41.##.122.226:37215
- 19#.#.84.119:37215
- 19#.#.40.42:37215
- 41.##.185.167:37215
- 15#.###.120.215:37215
- 19#.###.222.153:37215
- 19#.###.86.249:37215
- 19#.##.10.116:37215
- 41.###.130.30:37215
- 15#.##.146.173:37215
- 41.##.154.125:37215
- 41.#.#3.180:37215
- 19#.###.95.240:37215
- 19#.###.162.175:37215
- 15#.###.173.142:37215
- 19#.##.8.74:37215
- 19#.##.189.18:37215
- 41.###.24.56:37215
- 15#.##.199.216:37215
- 41.###.83.112:37215
- 41.###.35.252:37215
- 19#.###.196.71:37215
- 19#.###.61.212:37215
- 19#.###.167.186:37215
- 19#.##.223.218:37215
- 15#.##.43.184:37215
- 15#.##.44.108:37215
- 41.###.180.44:37215
- 19#.#.127.98:37215
- 15#.##4.9.11:37215
- 19#.##5.19.43:37215
- 41.###.92.112:37215
- 19#.#.165.173:37215
- 15#.##.228.102:37215
- 41.##.207.176:37215
- 15#.##.176.177:37215
- 15#.##.71.153:37215
- 41.###.81.91:37215
- 15#.#.87.62:37215
- 15#.###.30.129:37215
- 15#.##5.37.4:37215
- 15#.##.64.22:37215
- 41.###.200.232:37215
- 19#.##.189.150:37215
- 15#.###.161.188:37215
- 41.###.5.23:37215
- 19#.##.123.10:37215
- 41.###.166.119:37215
- 19#.##.190.93:37215
- 15#.###.127.185:37215
- 41.##.29.156:37215
- 19#.##.118.13:37215
- 41.##.220.180:37215
- 19#.##.84.216:37215
- 41.###.201.203:37215
- 19#.##.230.0:37215
- 19#.##9.13.6:37215
- 19#.###.42.143:37215
- 19#.###.11.213:37215
- 15#.###.251.158:37215
- 41.###.17.82:37215
- 15#.###.231.160:37215
- 41.###.119.223:37215
- 19#.##.0.196:37215
- 19#.###.230.137:37215
- 15#.###.52.145:37215
- 41.##.89.3:37215
- 15#.##.8.104:37215
- 41.###.246.137:37215
- 41.#.5.16:37215
- 19#.##.62.147:37215
- 41.###.243.179:37215
- 19#.##.19.234:37215
- 15#.###.71.152:37215
- 41.###.32.62:37215
- 41.##.128.238:37215
- 41.##.114.150:37215
- 15#.###.183.189:37215
- 19#.###.159.232:37215
- 41.##.232.42:37215
- 19#.##.97.139:37215
- 15#.##.110.43:37215
- 19#.##.41.175:37215
- 15#.##.6.10:37215
- 15#.##.135.28:37215
- 15#.###.148.176:37215
- 41.##.114.17:37215
- 19#.###.185.181:37215
- 19#.##.207.210:37215
- 15#.###.123.171:37215
- 41.##.109.60:37215
- 15#.###.15.179:37215
- 15#.##.175.13:37215
- 19#.##.56.138:37215
- 19#.##.154.191:37215
- 19#.###.120.125:37215
- 15#.###.223.202:37215
- 15#.###.51.245:37215
- 41.###.113.239:37215
- 19#.##.231.201:37215
- 15#.###.58.123:37215
- 15#.###.214.59:37215
- 15#.###.232.197:37215
- 15#.###.246.81:37215
- 15#.##7.80.79:37215
- 41.##.208.220:37215
- 41.###.13.90:37215
- 19#.##.36.104:37215
- 19#.##.91.199:37215
- 19#.###.255.84:37215
- 41.###.28.239:37215
- 41.###.191.224:37215
- 15#.##3.170.6:37215
- 41.##.251.136:37215
- 19#.##.191.59:37215
- 19#.##.32.196:37215
- 41.###.139.115:37215
- 19#.##.193.171:37215
- 15#.##.161.200:37215
- 41.##.64.114:37215
- 19#.##8.207.5:37215
- 41.###.171.97:37215
- 15#.###.227.17:37215
- 19#.##.150.54:37215
- 41.##.205.241:37215
- 19#.###.112.110:37215
- 15#.##.119.20:37215
- 15#.##0.5.140:37215
- 19#.###.241.213:37215
- 15#.###.99.201:37215
- 41.###.239.111:37215
- 19#.###.180.49:37215
- 41.##.26.54:37215
- 41.###.31.29:37215
- 15#.##8.46.95:37215
- 15#.##.103.236:37215
- 41.##.6.236:37215
- 19#.###.162.140:37215
- 15#.##2.81.61:37215
- 19#.##9.95.61:37215
- 19#.##.162.194:37215
- 15#.##1.1.229:37215
- 19#.##.36.165:37215
- 15#.##.128.128:37215
- 19#.###.34.230:37215
- 19#.##.41.51:37215
- 15#.##.159.104:37215
- 41.###.60.228:37215
- 19#.##1.91.97:37215
- 15#.##.168.67:37215
- 15#.##1.161.3:37215
- 41.###.216.32:37215
- 19#.###.160.206:37215
- 19#.###.105.63:37215
- 15#.##.156.0:37215
- 15#.###.219.128:37215
- 19#.###.45.175:37215
- 41.###.16.67:37215
- 15#.##.217.100:37215
- 15#.##.68.213:37215
- 15#.###.253.110:37215
- 41.##.140.166:37215
- 19#.##.37.135:37215
- 19#.###.119.254:37215
- 41.##.175.61:37215
- 19#.##.207.53:37215
- 15#.##2.69.13:37215
- 41.##.193.66:37215
- 41.##.8.186:37215
- 41.##.129.87:37215
- 41.##.62.225:37215
- 19#.##4.57.75:37215
- 41.#.#35.170:37215
- 41.##.69.169:37215
- 19#.##.12.123:37215
- 15#.##8.87.84:37215
- 19#.##.45.94:37215
- 19#.###.77.198:37215
- 41.###.201.66:37215
- 41.###.28.46:37215
- 15#.###.141.75:37215
- 41.###.14.214:37215
- 41.##.135.207:37215
- 15#.###.64.198:37215
- 41.##.109.91:37215
- 41.#.#4.38:37215
- 15#.##.2.119:37215
- 15#.###.170.93:37215
- 19#.###.179.37:37215
- 41.##.73.124:37215
- 41.###.155.51:37215
- 19#.##0.48.37:37215
- 15#.##.141.218:37215
- 15#.###.249.250:37215
- 15#.###.162.155:37215
- 19#.###.198.38:37215
- 15#.##6.14.39:37215
- 41.###.5.143:37215
- 19#.##.86.117:37215
- 41.###.23.233:37215
- 41.###.130.159:37215
- 15#.###.135.162:37215
- 19#.##.155.36:37215
- 41.###.81.230:37215
- 41.##.130.209:37215
- 41.##.155.73:37215
- 41.###.222.76:37215
- 41.###.119.100:37215
- 19#.##.168.130:37215
- 15#.###.233.42:37215
- 19#.###.219.201:37215
- 41.###.28.216:37215
- 41.##.91.107:37215
- 19#.##.99.183:37215
- 19#.###.231.234:37215
- 19#.###.49.204:37215
- 19#.###.207.186:37215
- 15#.###.41.118:37215
- 19#.##.231.161:37215
- 41.##.47.251:37215
- 15#.###.195.67:37215
- 41.#.#6.225:37215
- 41.###.197.236:37215
- 41.##.48.108:37215
- 19#.###.124.210:37215
- 41.##.140.12:37215
- 19#.###.160.31:37215
- 41.###.8.71:37215
- 19#.##.9.168:37215
- 15#.###.181.42:37215
- 41.###.26.79:37215
- 19#.###.207.108:37215
- 15#.##.0.92:37215
- 15#.##.253.150:37215
- 19#.###.234.245:37215
- 41.###.0.111:37215
- 15#.##.133.237:37215
- 19#.##.233.84:37215
- 41.###.212.43:37215
- 19#.###.156.42:37215
- 15#.###.100.248:37215
- 19#.###.218.127:37215
- 15#.###.179.245:37215
- 19#.##.76.4:37215
- 19#.###.130.151:37215
- 41.##.176.60:37215
- 19#.##.214.55:37215
- 19#.###.31.249:37215
- 19#.##.226.37:37215
- 41.###.230.102:37215
- 19#.###.45.140:37215
- 41.##.153.174:37215
- 41.##.186.32:37215
- 19#.###.237.128:37215
- 41.###.4.113:37215
- 15#.##4.31.92:37215
- 19#.##.23.149:37215
- 41.###.103.4:37215
- 15#.###.224.210:37215
- 19#.##2.77.96:37215
- 19#.#.203.49:37215
- 19#.###.97.198:37215
- 41.###.191.215:37215
- 15#.##1.0.247:37215
- 19#.##.223.206:37215
- 15#.##.83.207:37215
- 15#.##.11.107:37215
- 15#.###.123.75:37215
- 15#.###.243.112:37215
- 15#.##8.1.200:37215
- 15#.##.90.192:37215
- 15#.###.75.192:37215
Проводит атаку перебором по словарю (брутфорс) по протоколу Telnet.
Посылает данные следующим серверам:
- 19#.##.97.85:9090
Получает данные от следующих серверов:
- 19#.##.97.85:9090
Прочее:
Собирает информацию о сетевой активности
