Техническая информация
Вредоносные функции:
Запускает себя в качестве демона
Модифицирует настройки брандмауэра:
- iptables -F
Запускает процессы:
- sh -c iptables -F
Выполняет операции с файловой системой:
Модифицирует права доступа к файлам:
- /bin/systemctl
Создает или модифицирует файлы:
- /root/hoho.arm
- /root/hoho.arm7
- /root/hoho.arm6
- /root/hoho.arm5
- /root/hoho.mips
- /root/hoho.mpsl
- /root/hoho.arc
- /root/hoho.ppc
Сетевая активность:
Ожидает входящих соединений на портах:
- 0.0.0.0:5501
Устанавливает соединение:
- 8.#.8.8:53
- 1.#.1.1:53
- 19#.##5.18.28:30047
HTTP GET-запросы:
- bo#.####ismyipaddress.com/
- 19#.###.18.28/hoho.arm
- 19#.###.18.28/hoho.arm7
- 19#.###.18.28/hoho.arm6
- 19#.###.18.28/hoho.arm5
- 19#.###.18.28/hoho.mips
- 19#.###.18.28/hoho.mpsl
- 19#.###.18.28/hoho.arc
- 19#.###.18.28/hoho.ppc
DNS ASK:
- bo#.####ismyipaddress.com
- sw###hnets.net
Посылает данные следующим серверам:
- 58.##.235.24:23
- 9.##.160.223:23
- 21#.##7.64.19:23
- 11#.##3.223.152:23
- 17#.##0.244.95:23
- 31.###.161.177:23
- 11#.##.66.253:23
- 17#.##6.21.35:23
- 16#.##.123.139:23
- 97.###.238.19:23
- 12#.#.17.234:23
- 46.###.234.234:23
- 87.##.40.11:23
- 18#.##8.240.101:23
- 8.###.24.1:23
- 47.###.83.155:23
- 12#.##.155.28:23
- 9.###.81.33:23
- 10#.##.115.56:23
- 14#.##8.150.24:23
- 19#.##4.111.4:23
- 54.###.178.152:23
- 82.###.171.253:23
- 60.##.39.51:23
- 27.##.142.244:23
- 9.###.218.255:23
- 16#.##.182.135:23
- 22#.#2.42.54:23
- 15#.##2.68.39:23
- 15#.##3.162.2:23
- 57.###.90.106:23
- 21#.##1.10.35:23
- 16#.##.129.41:23
- 19#.##.200.213:23
- 74.##1.16.72:23
- 88.###.231.12:23
- 17#.##0.16.112:23
- 62.###.192.236:23
- 20#.##5.104.109:23
- 69.##.49.106:23
- 12#.##2.69.80:23
- 25.###.185.203:23
- 44.##.42.72:23
- 11#.##9.131.166:23
- 93.##.220.234:23
- 18#.#2.189.0:23
- 20#.#.120.249:23
- 88.###.244.246:23
- 15#.##9.6.123:23
- 17#.##5.19.232:23
- 76.##.6.82:23
- 93.###.118.244:23
- 54.##.224.145:23
- 22#.##8.192.224:23
- 22#.##3.195.45:23
- 19.##.15.141:23
- 91.##2.88.69:23
- 88.###.102.47:23
- 46.##.40.215:23
- 17#.##8.206.228:23
- 80.#.6.48:23
- 67.##0.66.20:23
- 10#.##2.255.251:23
- 13#.##1.201.15:23
- 21#.##1.167.178:23
- 16#.##7.42.24:23
- 82.##.5.105:23
- 16#.##4.65.83:23
- 13#.##1.104.38:23
- 17.##.172.221:23
- 15#.#8.109.7:23
- 14#.##9.44.185:23
- 19#.#.124.98:23
- 4.###.114.92:23
- 11#.##.189.19:23
- 16#.##8.1.161:23
- 14#.#.93.250:23
- 17#.##7.180.62:23
- 88.###.249.58:23
- 11#.##2.223.102:23
- 20#.##4.88.233:23
- 14#.##7.122.180:23
- 84.###.220.35:23
- 27.###.98.146:23
- 58.###.209.45:23
- 14#.##.231.67:23
- 20#.##8.213.118:23
- 66.##6.3.37:23
- 16#.##4.2.213:23
- 12.##.36.70:23
- 16#.##4.99.116:23
- 19#.##9.68.59:23
- 11#.##6.155.249:23
- 15#.#8.84.34:23
- 17#.##4.255.93:23
- 18.##.167.33:23
- 97.###.65.153:23
- 74.##0.8.248:23
- 15#.##2.23.27:23
- 21#.##0.167.208:23
- 91.#.130.59:23
- 15#.##.131.180:23
- 92.##.169.168:23
- 20#.##.200.204:23
- 20#.##1.208.220:23
- 57.##1.15.42:23
- 67.###.252.216:23
- 77.##8.126.9:23
- 80.##.102.238:23
- 10#.##.205.176:23
- 13#.##5.196.95:23
- 37.###.74.186:23
- 12#.##2.77.226:23
- 12#.#.169.1:23
- 19#.##4.123.242:23
- 57.##.239.48:23
- 20.###.224.13:23
- 19#.##2.127.99:23
- 22#.##0.15.202:23
- 16#.##.162.246:23
- 22#.##.15.205:23
- 10#.##8.140.59:23
- 18#.##0.206.232:23
- 20.###.156.173:23
- 17#.##8.103.75:23
- 12#.#0.62.61:23
- 16#.##3.205.17:23
- 12#.##5.82.137:23
- 64.##.48.206:23
- 11#.##7.119.18:23
- 2.###.222.58:23
- 4.##.55.26:23
- 93.##.12.122:23
- 13#.##.39.216:23
- 18#.##.191.80:23
- 99.###.237.213:23
- 19.##2.90.55:23
- 16#.##1.199.52:23
- 46.##.23.243:23
- 11#.##9.11.213:23
- 15#.##2.77.186:23
- 14#.##7.11.142:23
- 16#.##9.250.9:23
- 20#.##0.159.72:23
- 18.###.95.116:23
- 16#.#4.92.13:23
- 50.#.237.13:23
- 99.###.112.206:23
- 75.##.15.180:23
- 20#.##7.46.244:23
- 22#.##7.187.29:23
- 75.###.123.198:23
- 74.##.21.82:23
- 10#.##3.109.255:23
- 22#.##3.183.158:23
- 50.##.255.105:23
- 24.##.123.144:23
- 16#.##5.23.213:23
- 14.###.208.12:23
- 20#.##7.199.72:23
- 13#.#.59.223:23
- 23.###.96.193:23
- 44.##.175.59:23
- 53.###.178.114:23
- 17#.##9.76.182:23
- 11#.##2.119.30:23
- 12#.#5.38.39:23
- 37.##.29.169:23
- 70.###.160.242:23
- 16#.##.73.226:23
- 11#.##.185.40:23
- 71.##.91.22:23
- 16#.##3.16.128:23
- 44.##.166.126:23
- 1.#.#72.211:23
- 19#.##.143.195:23
- 27.###.107.230:23
- 16#.##2.97.152:23
- 19#.##.177.214:23
- 11#.##.209.139:23
- 17#.##1.67.239:23
- 12#.##4.159.79:23
- 41.###.255.62:23
- 17#.##8.99.218:23
- 36.###.14.114:23
- 62.###.54.194:23
- 19#.##7.41.186:23
- 19#.##4.198.151:23
- 43.##9.34.84:23
- 54.###.212.186:23
- 74.##.111.232:23
- 64.###.202.63:23
- 16#.##8.207.233:23
- 18.#.213.173:23
- 2.###.204.89:23
- 13#.##.147.36:23
- 82.###.168.95:23
- 15#.##4.243.89:23
- 47.##.62.34:23
- 19#.##6.208.83:23
- 13#.##.178.227:23
- 14#.##3.81.10:23
- 17#.##8.214.90:23
- 10#.##.244.11:23
