Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- sshd
Modifies firewall settings:
- iptables -I INPUT -p tcp --destination-port 56595 -j ACCEPT
- iptables -I OUTPUT -p tcp --source-port 56595 -j ACCEPT
- iptables -I PREROUTING -t nat -p tcp --destination-port 56595 -j ACCEPT
- iptables -I INPUT -p tcp --destination-port 22 -j DROP
Launches processes:
- sh -c killall -9 telnetd utelnetd scfgmgr
- sh -c iptables -I INPUT -p tcp --destination-port 56595 -j ACCEPT
- sh -c iptables -I OUTPUT -p tcp --source-port 56595 -j ACCEPT
- sh -c iptables -I PREROUTING -t nat -p tcp --destination-port 56595 -j ACCEPT
- sh -c iptables -I INPUT -p tcp --destination-port 22 -j DROP
- sh -c iptables -I INPUT -p tcp --destination-port 23 -j DROP
Attempts to kill the following processes:
- killall -9 telnetd utelnetd scfgmgr
Performs operations with the file system:
Creates or modifies files:
- /proc/self/oom_score_adj
- /proc/531/oom_score_adj
- /root/.ips
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:14737
- 0.0.0.0:33445
- 0.0.0.0:56595
Establishes connection:
- 8.#.8.8:53
- 85.##.77.35:5555
- 27.##.117.49:8080
- 13#.##.169.63:60001
- 85.###.192.127:8080
- 20#.###.225.203:8081
- 12.##.108.206:8081
- 15#.##3.241.81:8181
- 61.###.100.239:8081
- 17#.###.178.75:52869
- 10#.##3.92.149:8080
- 21#.##.163.65:8181
- 79.##.7.67:49152
- 16#.##8.51.212:80
- 11#.##2.254.168:80
- 31.##1.86.14:80
- 18#.##.46.124:80
- 15#.##9.1.35:37215
- 13#.##.151.117:80
- 53.###.222.123:8080
- 55.##.123.200:80
- 10#.###.202.247:8080
- 21#.##.69.161:37215
- 38.###.135.226:60001
- 11#.##.217.56:49152
- 19#.#.37.70:80
- 18#.#8.22.10:81
- 73.###.114.45:8443
- 18#.###.115.164:8080
- 19#.##3.28.116:80
- 19#.##7.169.1:80
- 18#.#5.131.8:81
- 17#.##.184.176:7574
- 22#.###.159.245:8080
- 21#.##7.240.156:80
- 44.##.216.112:8080
- 91.###.215.228:60001
- 21#.###.19.171:52869
- 70.###.173.81:8443
- 14#.##0.199.94:7574
- 99.##1.65.54:80
- 17#.##2.137.7:80
- 19#.##.145.218:5555
- 36.###.60.26:8081
- 21#.##9.213.80:8443
- 11#.###.110.167:60001
- 97.##.15.29:80
- 16#.###.203.92:37215
- 55.###.4.190:8081
- 15#.##5.92.70:81
- 10#.##9.24.129:8181
- 13#.##.91.233:8080
- 21.#.#82.72:5555
- 19#.##7.5.141:8080
- 63.###.149.71:8443
- 20#.##.65.169:8080
- 66.##.157.44:49152
- 15#.#32.32.9:80
- 14#.##.131.200:7574
- 18#.###.108.227:7574
- 15#.###.46.189:37215
- 15#.##1.1.155:80
- 16#.##9.11.91:80
- 77.###.242.109:80
- 19#.##1.104.97:8081
- 51.##.231.37:52869
- 20#.###.157.110:5555
- 12.##.78.29:80
- 49.###.40.204:60001
- 13#.###.164.236:8080
- 14#.##4.50.53:80
- 82.###.52.109:81
- 17#.##3.167.8:80
- 50.###.117.9:5555
- 62.##.125.109:80
- 14#.##7.52.141:80
- 16#.##1.27.245:8080
- 64.##.94.237:80
- 15#.##8.68.61:8080
- 17#.##9.161.186:80
- 5.###.171.203:8080
- 21#.##3.59.24:80
- 10#.###.175.106:8080
- 18#.##8.205.20:8080
- 16#.###.169.39:37215
- 19#.##6.5.146:80
- 14#.##2.152.25:8081
- 56.###.157.224:7574
- 96.###.12.252:8080
- 15#.##0.121.254:80
- 21#.###.175.238:8181
- 81.###.19.180:60001
- 10#.##5.48.202:8443
- 15#.##1.253.7:8081
- 21#.##.198.165:8443
- 16#.##9.73.94:8080
- 19#.###.180.148:8080
- 19#.##0.99.224:80
- 21#.##.179.142:8081
- 13#.##.2.53:8080
- 18#.###.141.211:8080
- 93.##.122.88:8080
- 49.##.155.111:37215
- 68.###.122.22:81
- 20#.##9.14.136:80
- 20#.#.72.168:49152
- 6.###.240.25:60001
- 20#.###.118.234:8080
- 21#.##.125.50:80
- 16#.##.159.238:5555
- 64.###.36.203:81
- 62.###.125.24:8080
- 15#.##.184.169:80
- 12#.#1.64.88:80
- 16#.##.220.79:37215
- 95.###.44.16:5555
- 20#.##0.135.141:80
- 79.##.4.155:80
- 13#.##3.91.230:80
- 72.##.174.206:60001
- 18#.##.68.177:60001
- 20#.###.154.132:8080
- 70.###.124.229:49152
- 20.##.64.212:8081
- 19#.##2.192.216:81
- 12#.##.250.148:8080
- 36.#.208.10:80
- 15#.##1.50.247:8080
- 15#.##.211.104:80
- 18#.##.91.209:80
- 49.###.121.244:8181
- 16#.##6.254.36:8080
- 21.###.235.167:8081
- 82.###.130.43:80
- 30.###.102.228:80
- 96.###.4.41:8080
- 91.###.134.193:8080
- 13#.###.172.192:8181
- 21#.###.206.244:5555
- 15#.##0.59.230:80
- 13#.##.43.113:8081
- 11#.##8.9.250:7574
- 12#.##.201.26:52869
- 62.###.51.153:8443
- 23.##.174.10:8080
- 10#.##4.167.102:80
- 18#.##7.150.10:7574
- 12#.##3.65.196:7574
- 15#.##.67.181:80
- 67.###.245.161:8080
- 76.###.189.199:37215
- 94.##.201.86:8081
- 13#.##1.44.15:80
- 93.##.249.158:80
- 56.##.21.68:7574
- 87.##.205.37:7574
- 95.###.144.56:52869
- 11#.###.101.168:8080
- 18#.##7.65.80:8080
- 19#.##.252.196:80
- 48.###.142.102:8080
- 11#.##0.146.164:80
- 9.##.82.135:80
- 35.###.89.218:81
- 10#.##5.71.252:80
- 13#.##1.115.129:80
- 15#.##5.62.4:8080
- 16#.##.229.97:37215
- 28.###.48.226:7574
- 19#.###.35.212:60001
- 11#.##8.105.113:80
- 72.###.40.144:8181
- 15#.##.103.202:8080
- 18.##.241.155:8080
- 19#.#.78.207:37215
- 20#.##2.24.178:80
- 15#.##.202.25:8080
- 10#.###.134.182:8081
- 4.###.160.72:80
- 11#.##.24.54:8080
- 70.##.194.72:8080
- 81.###.32.203:8080
- 6.###.214.178:60001
- 51.##.116.226:80
- 21.###.96.144:80
- 20#.##.99.192:80
- 58.###.134.104:80
- 19#.##2.27.8:5555
- 20#.#4.68.43:80
- 11#.##3.189.96:80
- 16#.##8.187.1:5555
- 11#.#.124.195:80
- 18#.##.129.72:80
- 74.##8.91.18:80
- 14#.##3.53.28:8080
- 74.#.#1.187:8081
- 53.##.101.20:80
- 18#.##.236.125:8081
- 12#.##.107.165:8080
- 10#.##6.119.39:80
- 95.##.95.127:8081
- 13#.###.165.199:8080
- 12#.##.95.6:5555
- 14#.#.38.2:80
- 15#.##5.59.107:80
- 17#.##.105.39:80
- 73.###.167.176:81
- 11#.##.160.188:80
- 52.###.221.62:81
- 12#.##2.35.250:8080
- 22.##4.0.118:80
- 80.##.22.27:80
- 16#.##7.56.33:60001
- 13.###.148.88:60001
- 94.##2.128.2:80
- 66.###.129.104:80
- 87.##.115.69:8080
- 12#.##5.70.224:80
- 15#.###.234.152:8081
- 12#.##.73.130:52869
- 17#.##2.23.235:7574
- 15#.###.101.119:8081
- 18#.##0.36.104:8080
- 16#.##9.236.47:8081
- 81.###.78.100:7574
- 21#.##1.153.197:80
- 12#.#.54.102:49152
- 18#.###.138.126:8080
- 21#.##6.64.120:80
- 60.###.250.75:8081
- 19#.###.190.61:52869
- 21#.##1.73.249:80
- 18#.##.107.176:8181
- 20#.##.196.58:8081
- 76.###.218.5:5555
- 15#.##1.3.107:5555
- 13#.###.230.246:49152
- 40.###.115.171:8080
- 11#.##7.98.103:8080
- 18#.##.75.5:8081
- 13#.##7.106.223:80
- 15#.##4.235.186:80
- 69.##.203.237:8080
- 15#.#.46.117:8080
- 11#.###.136.216:8081
- 10#.##1.36.139:8080
- 25.###.239.65:8080
- 21#.##.22.22:60001
- 61.##.244.4:8181
- 72.###.237.99:8443
- 19#.##.117.71:5555
- 20#.###.236.170:8080
- 2.###.168.35:7574
- 14#.##.77.13:8081
- 33.###.254.87:80
- 46.###.145.80:8081
- 2.##.178.6:80
- 74.###.117.124:8081
- 14#.##.131.187:81
- 11.###.74.217:37215
- 41.###.85.35:8443
- 38.###.205.77:8443
- 12#.##7.229.114:80
- 21#.##6.232.72:81
- 16#.###.135.204:8080
- 16#.##.153.95:8081
- 20#.##1.64.225:7574
- 23.###.220.217:60001
- 10#.###.52.158:37215
- 21#.##8.75.42:81
- 14#.##8.1.167:49152
- 11#.##6.169.8:52869
- 15#.#45.5.74:80
- 88.##.136.207:80
- 61.###.228.108:80
- 20#.##.231.138:8081
- 92.##.73.61:80
- 41.###.119.219:80
- 42.###.132.72:49152
- 18#.##.167.35:8080
- 54.##.207.171:49152
- 13#.##7.29.131:8081
- 29.###.50.224:80
- 54.###.99.200:8181
- 9.###.240.180:80
- 93.###.130.56:80
- 70.###.70.104:52869
- 20#.###.110.202:49152
- 21#.#.99.170:80
- 51.###.103.179:8080
- 14#.##6.51.234:8080
- 20#.##9.212.12:8080
- 72.###.34.233:8443
- 77.##.96.22:8081
- 18#.##8.1.195:80
- 74.###.1.33:8081
- 12#.##7.163.92:8443
- 11#.##.251.197:8080
- 45.##7.201.6:80
- 17#.##.247.176:80
- 18#.###.186.189:8080
- 29.##.128.15:5555
- 17#.##4.33.14:81
- 10#.###.68.150:49152
- 1.###.35.141:8080
- 94.##.211.237:37215
- 21#.##4.188.169:80
- 15#.##7.11.157:81
- 21#.##7.174.186:80
- 15#.#6.50.36:81
- 18#.##.133.60:80
- 14#.##2.126.125:80
- 19#.##.147.91:80
- 89.##.35.20:80
- 14#.##7.194.30:80
- 12#.##7.71.97:8080
- 27.###.132.236:8080
- 19.###.188.127:8443
- 62.#.36.216:80
- 21#.#.121.67:37215
- 15#.##1.0.245:80
- 14#.##3.167.13:8080
- 15#.##4.89.107:8080
- 70.###.247.132:80
- 12#.##.143.140:8080
- 90.##.45.149:8080
- 16#.##3.213.113:80
- 15#.##.177.226:8080
- 21#.##1.48.80:80
- 67.##.148.237:8080
- 8.###.176.202:8080
- 12#.##.239.43:80
- 81.##.0.234:49152
- 20#.###.118.113:8080
- 13#.###.106.103:8080
- 11.##.32.35:80
- 76.##.224.95:80
- 13#.##.89.0:8080
- 14#.##.232.173:8080
- 18#.##.14.136:8443
- 11#.##7.74.27:8080
- 12.##.67.123:80
- 70.#.26.70:8081
- 22.##.218.113:8081
- 88.###.216.211:80
- 19#.##.225.203:8181
- 12#.#6.33.59:80
- 23.##.4.113:81
- 20#.##.187.223:8080
- 12#.##.191.134:80
- 10#.###.133.106:8080
- 24.##.164.253:8080
- 32.###.26.116:80
- 13#.##.136.130:49152
- 10#.##3.28.172:8080
- 4.##.#4.182:49152
- 46.###.127.129:8081
- 13#.##.217.68:8081
- 20#.##1.12.162:8181
- 10#.#.25.7:8081
- 18#.###.144.218:7574
- 20#.###.119.193:8080
- 11#.##.109.253:8080
- 68.###.17.246:8080
- 17#.##4.151.143:80
- 35.###.49.251:80
- 45.###.70.163:8080
- 20#.##1.101.76:80
- 10#.##8.81.242:80
- 61.##.135.153:8080
- 16#.##4.110.149:80
- 12#.##4.133.168:80
- 20#.##7.136.78:8080
- 18#.###.150.109:49152
- 16#.###.115.235:8080
- 18#.##2.82.248:8080
- 91.###.190.151:80
- 14#.##1.254.212:80
- 45.###.152.197:8080
- 13.###.249.4:8181
- 94.###.244.131:80
- 14#.###.98.180:49152
- 88.###.108.227:8080
- 45.##.26.23:80
- 10#.##6.35.24:8081
- 27.###.243.145:80
- 18.###.210.110:81
- 20#.##.62.206:80
- 66.##.204.156:8080
- 19#.##.166.172:80
- 14#.##.200.230:8181
- 18#.###.25.211:52869
- 82.###.172.180:80
- 20#.##.234.175:5555
- 15#.##0.246.7:8080
- 58.###.238.111:81
- 60.###.181.252:80
- 15#.##.198.153:8081
- 11#.##.90.81:8081
- 49.###.179.105:8080
- 49.###.98.188:80
- 68.###.81.126:80
- 58.###.224.19:80
- 10#.##.50.124:8080
- 66.###.164.242:37215
- 17#.###.173.166:8081
- 52.###.32.82:37215
- 19#.##.222.81:37215
- 14#.##7.38.91:80
- 20#.##9.234.186:81
- 18#.##.195.127:80
- 23.###.45.211:80
- 11#.##1.42.187:8080
- 21.##.59.49:37215
- 18#.##.166.107:80
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 23#.###.255.250:1900
- 10#.##6.109.219:23
- 18#.##2.121.177:23
- 10#.##0.176.100:23
- 22#.##0.30.13:23
- 72.###.199.144:23
- 14#.##.185.68:23
- 2.###.41.41:23
- 18#.##.142.214:23
- 17#.##7.180.111:23