Linux.Mirai.3086

Техническая информация

Вредоносные функции:

Запускает себя в качестве демона

Подменяет имя приложения на:

/bin/busybox

Запускает процессы:

/bin/sh -c cd /bin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
cat tftp
cat <SAMPLE_FULL_PATH>
/bin/sh -c cd /bin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
cat rm
/bin/sh -c cd /bin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
cat kill
/bin/sh -c cd /bin/; cat cd > cd-cpy; cat <SAMPLE_FULL_PATH> > cd
cat cd
/bin/sh -c cd /sbin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
/bin/sh -c cd /sbin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
/bin/sh -c cd /sbin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
/bin/sh -c cd /sbin/; cat cd > cd-cpy; cat <SAMPLE_FULL_PATH> > cd
/bin/sh -c export PATH=/root:$PATH
/bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/.~/.bash_profile
/bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/.~/.bashrc
/bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/./root/.bash_profile
/bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/./root/.bashrc

Завершает системные процессы:

sshd

Завершает следующие процессы:

dhclient
rpcbind
rpc.statd
rpc.idmapd
atd
cron

Выполняет операции с файловой системой:

Создает или модифицирует файлы:

/bin/tftp-cpy
/bin/tftp
/bin/rm-cpy
/bin/rm
/bin/kill-cpy
/bin/kill
/bin/cd-cpy
/bin/cd
/sbin/tftp-cpy
/sbin/tftp
/sbin/rm-cpy
/sbin/rm
/sbin/kill-cpy
/sbin/kill
/sbin/cd-cpy
/sbin/cd
<SAMPLE_FULL_PATH>
/root/.~/.bash_profile
/root/.~/.bashrc
/root/./root/.bash_profile
/root/./root/.bashrc

Сетевая активность:

Устанавливает соединение:

19#.##.97.85:9090
15#.#.92.254:37215
19#.##.92.254:37215
15#.##.208.45:37215
15#.##.29.24:37215
41.###.8.199:37215
19#.###.199.145:37215
41.###.245.206:37215
19#.##.130.95:37215
19#.###.98.121:37215
41.###.86.213:37215
15#.###.61.181:37215
41.##.66.107:37215
15#.##.159.56:37215
15#.###.140.62:37215
15#.###.69.103:37215
41.##.92.178:37215
41.###.57.194:37215
15#.##4.66.79:37215
15#.###.116.117:37215
41.##.155.102:37215
41.##.19.166:37215
41.###.163.152:37215
41.##.53.229:37215
41.#.#89.190:37215
15#.###.165.90:37215
19#.##.104.62:37215
41.###.250.21:37215
19#.##.41.92:37215
15#.##.185.176:37215
41.###.209.217:37215
15#.##.183.122:37215
41.##.137.165:37215
41.##.145.68:37215
41.##.227.220:37215
41.###.21.241:37215
19#.##0.79.25:37215
19#.##.11.89:37215
41.###.230.56:37215
15#.##4.245.3:37215
19#.###.200.97:37215
19#.###.224.115:37215
19#.###.99.180:37215
41.###.40.4:37215
15#.##.199.177:37215
41.##.120.31:37215
41.##.113.189:37215
19#.###.237.129:37215
19#.###.112.183:37215
15#.##.54.42:37215
19#.###.114.75:37215
19#.###.202.68:37215
41.###.117.238:37215
15#.###.128.88:37215
41.##.112.199:37215
41.###.13.168:37215
19#.###.153.162:37215
19#.###.145.125:37215
19#.##9.72.32:37215
19#.###.145.74:37215
15#.###.226.227:37215
15#.##.35.202:37215
41.##.163.211:37215
19#.##.41.16:37215
15#.###.216.160:37215
19#.##.55.173:37215
41.###.152.19:37215
19#.###.43.193:37215
15#.##8.31.4:37215
41.###.194.249:37215
15#.###.166.196:37215
15#.###.100.113:37215
41.##.188.40:37215
15#.##.170.178:37215
15#.##0.41.79:37215
15#.###.32.100:37215
15#.##.129.84:37215
41.###.64.230:37215
19#.##.164.14:37215
15#.###.56.232:37215
41.###.168.149:37215
19#.###.229.49:37215
41.##.226.68:37215
19#.###.107.106:37215
15#.###.56.155:37215
41.###.51.56:37215
19#.##.40.114:37215
41.#.#03.252:37215
19#.##3.4.98:37215
41.###.203.236:37215
19#.##.51.201:37215
19#.###.252.84:37215
19#.##.154.160:37215
19#.###.182.248:37215
15#.###.144.211:37215
41.##.38.102:37215
15#.###.87.211:37215
41.##.33.64:37215
19#.##.228.96:37215
19#.###.98.119:37215
15#.#.122.152:37215
41.###.50.186:37215
15#.###.112.70:37215
41.###.227.220:37215
41.###.112.97:37215
19#.###.190.134:37215
41.##.207.245:37215
19#.###.251.251:37215
15#.###.204.211:37215
41.###.230.165:37215
41.##.113.61:37215
41.##.205.140:37215
15#.###.47.216:37215
19#.###.113.77:37215
41.##.38.58:37215
19#.##.229.219:37215
15#.##.192.51:37215
19#.##.8.16:37215
15#.##4.56.94:37215
15#.##.56.209:37215
15#.##.39.145:37215
41.###.57.195:37215
19#.##0.99.13:37215
19#.###.128.89:37215
15#.###.207.235:37215
41.##.68.244:37215
15#.#.59.213:37215
15#.###.210.249:37215
19#.###.131.97:37215
19#.###.26.218:37215
19#.##.186.231:37215
15#.###.142.223:37215
15#.###.132.181:37215
41.###.107.36:37215
19#.###.221.71:37215
15#.##8.237.6:37215
15#.###.74.130:37215
15#.##.65.129:37215
15#.##1.91.4:37215
15#.##.108.159:37215
41.###.221.109:37215
41.###.144.173:37215
19#.##.111.225:37215
19#.##.57.47:37215
19#.###.32.143:37215
41.###.156.147:37215
41.###.227.164:37215
15#.##.93.110:37215
41.###.50.180:37215
19#.##.126.17:37215
19#.##.66.79:37215
19#.##.82.231:37215
19#.###.243.31:37215
41.###.209.44:37215
41.##.105.202:37215
15#.###.145.218:37215
41.##.11.115:37215
41.###.231.202:37215
41.###.94.147:37215
41.###.171.31:37215
15#.###.211.67:37215
41.##.232.184:37215
41.###.171.217:37215
19#.##.95.19:37215
41.###.118.104:37215
41.###.13.132:37215
15#.###.120.194:37215
15#.###.147.146:37215
15#.###.32.188:37215
41.###.9.139:37215
15#.##.38.37:37215
15#.##9.83.31:37215
15#.###.138.190:37215
41.##.167.20:37215
19#.###.138.220:37215
15#.#.204.148:37215
19#.##.10.78:37215
41.##.150.17:37215
41.###.14.168:37215
15#.###.11.197:37215
15#.###.159.209:37215
15#.###.119.164:37215
15#.##7.12.83:37215
19#.###.213.106:37215
41.##.219.109:37215
41.###.119.82:37215
41.###.151.240:37215
41.###.165.179:37215
15#.###.169.183:37215
41.###.112.210:37215
19#.##.90.119:37215
41.###.183.197:37215
19#.###.17.189:37215
41.##.60.29:37215
15#.##2.15.89:37215
15#.##.94.15:37215
19#.###.217.89:37215
19#.###.172.125:37215
41.##.146.53:37215
19#.##.137.188:37215
41.###.173.6:37215
41.###.190.30:37215
15#.###.170.138:37215
19#.###.162.98:37215
19#.###.102.107:37215
41.###.193.30:37215
19#.###.161.114:37215
19#.###.192.235:37215
15#.###.82.200:37215
15#.##.131.97:37215
15#.##.133.36:37215
15#.##.42.144:37215
15#.##.218.188:37215
19#.#.212.56:37215
19#.###.239.249:37215
19#.##5.15.32:37215
15#.##1.52.31:37215
41.###.171.112:37215
15#.##.228.56:37215
19#.##5.31.58:37215
15#.#.20.216:37215
41.###.220.181:37215
19#.##0.58.39:37215
41.###.183.21:37215
41.###.168.73:37215
41.###.74.93:37215
15#.###.79.228:37215
19#.##.182.104:37215
15#.###.97.164:37215
41.##.88.183:37215
15#.###.173.223:37215
19#.##.142.41:37215
41.###.253.252:37215
19#.###.239.149:37215
19#.##.203.205:37215
41.##.11.155:37215
19#.##.219.143:37215
15#.##9.28.78:37215
19#.###.211.17:37215
41.#.#9.240:37215
15#.#.216.39:37215
15#.###.161.32:37215
41.###.253.154:37215
15#.###.63.109:37215
19#.##.4.29:37215
41.###.90.108:37215
41.###.35.49:37215
19#.###.115.19:37215
19#.###.191.204:37215
19#.##.126.213:37215
15#.##.213.154:37215
19#.###.171.46:37215
19#.##.251.168:37215
19#.##.133.88:37215
19#.#.250.231:37215
19#.##.54.181:37215
41.##.197.139:37215
19#.##.253.158:37215
15#.###.96.215:37215
15#.##.149.190:37215
15#.#.101.177:37215
15#.###.229.49:37215
15#.###.122.113:37215
41.###.115.87:37215
19#.###.175.244:37215
19#.###.249.46:37215
15#.##.142.12:37215
15#.###.40.177:37215
41.###.107.46:37215
19#.#.172.195:37215
41.###.144.11:37215
41.###.3.242:37215
19#.##.76.20:37215
19#.###.32.166:37215
19#.##3.24.64:37215
15#.#.15.239:37215
41.##.9.103:37215
15#.###.146.119:37215
15#.###.103.49:37215
15#.###.222.25:37215
41.##.60.136:37215
15#.##.105.206:37215
15#.##.169.183:37215
15#.##.129.79:37215
19#.###.70.188:37215
19#.##.198.171:37215
41.##.234.55:37215
19#.##9.46.97:37215
19#.##.106.120:37215
41.##.43.199:37215
15#.###.133.247:37215
19#.##.219.175:37215
41.###.73.206:37215
41.###.3.38:37215
41.###.3.91:37215
15#.##.193.158:37215
15#.###.218.251:37215
41.###.25.144:37215
41.###.75.1:37215
41.##.146.103:37215
41.##.172.163:37215
41.###.21.51:37215
19#.##.0.204:37215
41.###.138.84:37215
19#.###.88.119:37215
41.###.130.179:37215
41.###.109.221:37215
15#.###.95.123:37215
15#.###.147.54:37215
41.###.223.177:37215
15#.##.112.112:37215
15#.###.129.75:37215
19#.##.36.68:37215
41.###.86.61:37215
15#.##9.19.13:37215
19#.##.35.52:37215
19#.###.232.86:37215
19#.###.179.86:37215
19#.##.14.72:37215
41.##.7.209:37215
15#.###.249.90:37215
41.###.246.133:37215
41.##.58.153:37215
41.###.143.254:37215
15#.##.54.30:37215
19#.###.170.82:37215
19#.###.206.173:37215
15#.##.21.166:37215
41.##.104.121:37215
41.###.104.35:37215
15#.##.138.198:37215
41.##.151.15:37215
19#.##.94.255:37215
41.###.216.171:37215
41.###.26.90:37215
15#.###.118.64:37215
19#.###.240.102:37215
41.###.242.115:37215
15#.#.106.204:37215
19#.##.65.77:37215
15#.##2.38.58:37215
41.###.91.20:37215
19#.###.201.140:37215
19#.##.38.123:37215
15#.##.206.107:37215
15#.##2.38.86:37215
41.##.37.255:37215
41.###.54.54:37215
19#.##.101.15:37215
19#.##.99.68:37215
41.###.15.160:37215
41.###.28.200:37215
15#.###.224.67:37215
15#.###.244.115:37215
41.###.73.4:37215
15#.###.38.171:37215
15#.##.39.150:37215
15#.##.215.249:37215
41.##.215.90:37215
19#.##2.7.61:37215
15#.###.56.229:37215
19#.###.186.99:37215
19#.##.209.87:37215
19#.###.207.73:37215
15#.###.239.176:37215
15#.###.238.163:37215
41.###.130.117:37215
41.###.104.152:37215
41.###.151.45:37215
19#.###.169.253:37215
41.##.97.249:37215
41.###.151.11:37215
15#.###.223.167:37215
41.###.75.105:37215
15#.###.200.77:37215
15#.###.203.92:37215
15#.###.116.116:37215
41.#.#31.173:37215
15#.##.140.200:37215
15#.##.207.246:37215
19#.###.89.193:37215
41.###.51.170:37215
19#.##3.5.36:37215
19#.##.209.177:37215
15#.###.230.207:37215
15#.##.234.50:37215
41.##.58.242:37215
15#.##.102.255:37215
41.##.144.123:37215
41.##.3.151:37215
41.###.245.177:37215
19#.##.175.85:37215
19#.###.180.164:37215
19#.###.43.176:37215
41.###.153.136:37215
41.###.63.33:37215
15#.##.246.157:37215
15#.##5.164.9:37215
41.###.172.102:37215
15#.###.112.96:37215
41.###.134.220:37215
15#.##.216.41:37215
15#.###.165.46:37215
15#.###.186.223:37215
15#.#.123.188:37215
15#.###.229.180:37215
41.###.153.132:37215
15#.##7.197.0:37215
19#.##.15.20:37215
19#.###.50.102:37215
15#.##.161.172:37215
41.###.161.31:37215
41.###.1.153:37215
15#.###.172.188:37215
15#.###.162.42:37215
19#.##3.5.28:37215
19#.###.252.91:37215
15#.###.222.125:37215
19#.###.100.22:37215
41.###.45.37:37215
19#.###.130.183:37215
19#.###.131.117:37215
41.##.75.161:37215
41.###.77.27:37215
15#.###.196.180:37215
41.###.144.219:37215
19#.##.38.227:37215
41.###.124.249:37215
19#.###.110.167:37215
15#.###.220.254:37215
15#.##6.103.8:37215
15#.###.172.15:37215
19#.###.224.124:37215
41.###.69.188:37215
41.###.118.168:37215
19#.##.105.211:37215
19#.##.123.67:37215
41.###.36.232:37215
19#.##.210.14:37215
19#.##.85.94:37215
41.##.249.194:37215
41.###.129.185:37215
15#.##.67.231:37215
41.###.104.189:37215
41.##.135.170:37215
15#.###.115.159:37215
19#.##8.94.73:37215
15#.##.209.229:37215
41.##.230.185:37215
19#.##.10.128:37215
19#.##6.98.97:37215
15#.##0.4.81:37215
19#.###.200.130:37215
19#.##.198.1:37215
19#.##.145.222:37215
41.###.148.96:37215
15#.##.174.205:37215
19#.###.237.198:37215
15#.##6.94.19:37215
19#.##.185.72:37215
15#.###.152.106:37215
15#.###.188.166:37215
15#.##.227.187:37215
15#.##0.58.56:37215
19#.##.148.39:37215
15#.###.215.208:37215
19#.##.116.48:37215
19#.##5.50.18:37215
15#.##.187.163:37215
41.###.144.162:37215
19#.##.237.108:37215
19#.##.34.16:37215
15#.###.24.109:37215
19#.##.208.14:37215
19#.##.61.158:37215
41.###.36.206:37215
15#.###.191.185:37215
19#.###.253.167:37215
19#.##.141.28:37215
41.##.194.166:37215
19#.##.51.147:37215
15#.###.113.103:37215
41.###.255.247:37215
41.##.196.160:37215
15#.###.106.98:37215
41.##.177.54:37215
15#.##4.50.52:37215
19#.##.26.26:37215
19#.##.208.169:37215
19#.###.36.149:37215
19#.##.152.159:37215
15#.###.253.154:37215
15#.##.146.71:37215
41.###.32.229:37215
15#.###.132.147:37215
41.###.49.120:37215
41.#.#5.83:37215
15#.##.233.145:37215
15#.##4.174.0:37215
41.#.#5.109:37215
19#.##.195.209:37215
15#.###.244.141:37215
41.###.197.92:37215
19#.##.90.116:37215
19#.###.176.110:37215
19#.##.152.130:37215
19#.##.18.63:37215
19#.##.140.177:37215
41.###.137.167:37215
41.##.70.158:37215
15#.###.110.221:37215
15#.###.211.175:37215
15#.##1.20.16:37215
41.###.243.41:37215
19#.###.41.253:37215
15#.##.174.13:37215
41.##.116.0:37215
19#.##.48.21:37215
19#.##.49.105:37215
41.###.69.94:37215
15#.###.242.12:37215
15#.##.57.167:37215
15#.###.234.150:37215
41.##.16.20:37215
41.###.9.42:37215
19#.##.84.110:37215
15#.##.57.230:37215
19#.##.38.79:37215
41.###.61.208:37215
41.###.33.49:37215
19#.##4.31.29:37215
15#.##.137.92:37215
15#.##.156.107:37215
15#.###.184.147:37215
19#.###.108.135:37215
19#.##.77.82:37215
19#.###.146.134:37215
41.###.55.187:37215
15#.#.207.203:37215
15#.###.51.150:37215
15#.##.36.213:37215
19#.##.112.178:37215
15#.##2.96.41:37215
41.##.16.212:37215
15#.##.224.235:37215
15#.##6.32.68:37215
41.###.241.88:37215
41.##.39.23:37215
15#.##5.62.48:37215
41.###.188.28:37215
15#.###.234.149:37215
19#.###.222.153:37215
15#.###.217.254:37215
19#.##.202.176:37215
41.###.8.27:37215
19#.###.225.250:37215
15#.##.58.236:37215
15#.###.164.85:37215
41.###.220.29:37215
41.###.50.148:37215
19#.###.120.165:37215
19#.##.133.230:37215
15#.###.21.101:37215
15#.###.126.68:37215
41.##.133.182:37215
15#.###.200.53:37215
41.###.118.110:37215
15#.###.189.174:37215
41.###.60.15:37215
19#.###.203.132:37215
15#.###.102.133:37215
19#.###.98.211:37215
41.##.99.218:37215
19#.##.205.94:37215
41.##.162.243:37215
15#.##.140.185:37215
15#.###.161.225:37215
19#.##.168.251:37215
15#.###.135.232:37215
15#.##.81.1:37215
19#.##.17.122:37215
41.##.24.203:37215
15#.###.213.227:37215
19#.###.97.206:37215
19#.##2.66.86:37215
41.###.182.84:37215
15#.##.192.40:37215
41.###.94.225:37215
19#.##5.20.48:37215
15#.##.188.227:37215
15#.###.23.118:37215

Проводит атаку перебором по словарю (брутфорс) по протоколу Telnet.

Посылает данные следующим серверам:

19#.##.97.85:9090

Получает данные от следующих серверов:

19#.##.97.85:9090

Прочее:

Собирает информацию о сетевой активности

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению