Linux.Siggen.5716

Technical Information

Malicious functions:

Gains root privileges

Launches itself as a daemon

Launches processes:

/usr/sbin/xtables-nft-multi iptables -P FORWARD ACCEPT
/usr/sbin/xtables-nft-multi iptables -X
/usr/sbin/xtables-nft-multi iptables -t nat -F
/usr/sbin/xtables-nft-multi iptables -F
/usr/sbin/xtables-nft-multi iptables -P OUTPUT ACCEPT
/usr/sbin/xtables-nft-multi iptables -t mangle -F
/usr/sbin/xtables-nft-multi iptables -P INPUT ACCEPT

Performs operations with the file system:

Modifies file access rights:

/usr/sbin/xtables-nft-multi

Creates or modifies files:

/etc/resolv.conf

Network activity:

Awaits incoming connections on ports:

0.0.0.0:5879

Establishes connection:

8.#.8.8:53
18#.##6.71.45:1620

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

Sends data to the following servers:

18#.##6.71.45:1620
37.###.185.240:23
20#.##2.41.229:23
10#.##1.64.165:23
63.###.213.117:23
16#.##1.164.249:23
60.##7.73.53:23
12#.##.154.233:23
53.###.120.109:23
34.###.144.228:23
43.###.237.178:23
16#.##6.187.213:23
18#.#6.61.12:23
20#.#.224.8:23
50.###.14.156:23
11#.##.64.169:23
46.###.175.158:23
29.##.242.139:23
21#.##.100.15:23
66.##.170.194:23
15#.##3.169.231:23
19#.#.103.209:23
22.##8.119.2:23
28.###.160.23:23
22#.##1.195.75:23
17#.##6.151.3:23
19.###.198.79:23
13#.##0.12.32:23
3.###.112.235:23
21#.##.106.75:23
79.###.226.116:23
11#.##6.57.247:23
10#.##.171.192:23
21#.##.72.164:23
75.##.205.108:23
64.###.246.189:23
88.##.192.54:23
11#.##1.170.55:23
70.###.101.234:23
30.#.177.214:23
20#.##5.239.75:23
11.###.163.65:23
12#.##5.61.203:23
19#.#93.61.5:23
10#.#.64.71:23
96.###.92.175:23
81.##.248.190:23
13#.##3.212.73:23
19#.#4.67.43:23
18#.##.35.252:23
10#.##.18.229:23
8.###.197.184:23
32.###.188.253:23
17.##.24.14:23
78.##.90.56:23
90.###.22.148:23
13#.##3.145.242:23
10#.##2.137.173:23
12#.#2.8.208:23
38.##.19.51:23
10#.#35.88.4:23
20.##5.63.42:23
18#.##3.30.31:23
17#.##.13.120:23
3.###.126.131:23
12#.##6.214.177:23
18#.##.32.102:23
95.###.141.82:23
17#.#70.63.9:23
11#.#7.36.3:23
12#.#5.90.72:23
15#.##7.82.241:23
21#.##5.220.211:23
87.###.221.138:23
68.###.122.222:23
45.###.142.162:23
98.###.103.179:23
17#.##5.32.127:23
41.###.146.168:23
17#.#.84.47:23
79.##9.21.83:23
22#.##.217.60:23
18#.##6.222.143:23
10#.##5.182.66:23
20#.##6.78.164:23
97.###.46.240:23
13#.##.27.177:23
71.##.224.192:23
11#.##1.239.95:23
15#.##6.143.181:23
18.###.124.75:23
15#.##.50.136:23
94.##.35.57:23
63.###.66.249:23
12.###.125.21:23
85.###.188.116:23
10#.##.232.195:23
91.###.118.13:23
20#.##6.115.242:23
54.###.41.200:23
55.##2.31.64:23
16#.##.241.86:23
13.###.121.77:23
19#.##4.85.56:23
21#.##2.247.192:23
16.###.253.34:23
9.###.198.120:23
14.##3.55.77:23
47.###.180.119:23
60.##.225.146:23
19#.#2.231.3:23
26.##.4.111:23
75.###.41.230:23
40.##.44.75:23
65.###.120.176:23
39.##5.27.16:23
21#.##3.146.166:23
12#.##3.98.227:23
11#.##4.190.10:23
19#.##0.228.4:23
64.###.86.213:23
12#.##2.213.237:23
19#.##.13.190:23
31.###.202.102:23
10#.##7.117.135:23
53.##7.4.234:23
20#.#5.93.16:23
59.##.29.12:23
88.###.147.13:23
17#.##.164.167:23
15#.#.227.8:23
23.###.18.150:23
4.##.167.156:23
34.###.66.156:23
17#.##2.98.153:23
11#.##0.101.32:23
11#.##.222.242:23
15.###.162.180:23
15#.##5.110.200:23
16#.##1.204.119:23
12#.##7.222.199:23
43.###.97.176:23
13#.##1.58.60:23
33.##.29.253:23
70.##1.3.173:23
7.###.3.133:23
52.###.193.33:23
93.##4.79.32:23
21#.##7.44.191:23
16#.##8.96.226:23
16#.##1.236.98:23
89.###.65.210:23
30.###.165.23:23
20#.##5.191.93:23
21.##.181.25:23
42.##9.51.6:23
27.###.196.229:23
18#.##.67.235:23
14#.##.203.237:23
10#.#.53.233:23
20#.##4.65.60:23
13#.##.135.238:23
14#.##8.141.157:23
20#.#.112.178:23
20#.##4.108.23:23
20#.##.30.205:23
13#.##4.245.199:23
21#.##6.198.60:23
11.###.214.144:23
1.#.#5.62:23
16#.##.148.62:23
14#.##.20.161:23
61.##9.14.32:23
50.##.29.254:23
13#.##2.88.210:23
57.###.174.108:23
12#.##4.195.216:23
22#.##1.48.218:23
44.###.242.194:23
13#.##0.194.141:23
24.###.199.84:23
11#.##9.33.171:23
86.##.250.98:23
21#.##3.233.3:23
19#.##2.50.34:23
17#.##1.142.103:23
11#.##6.239.193:23
48.##.53.128:23
16#.##.79.212:23
46.###.208.212:23
20#.##4.73.115:23
92.###.123.80:23
10#.##1.26.133:23
58.###.19.124:23
72.##8.72.1:23
6.##.173.147:23
19#.##8.185.119:23
29.###.87.210:23
14#.##.233.232:23
99.##.67.215:23
96.##.61.107:23
25.###.84.240:23
22#.##7.64.224:23
19#.##3.255.231:23
14#.##4.167.13:23
21#.##5.45.47:23
21#.##6.248.59:23
12#.##1.56.114:23
81.###.222.65:23
18#.#4.8.116:23
18#.##.190.49:23
36.###.55.217:23
14#.##.193.179:23
66.##.117.87:23
83.##0.1.151:23
14#.##5.204.156:23
13#.##4.134.114:23
14#.##6.205.78:23
17#.##2.242.216:23
18#.##2.42.208:23
69.###.243.251:23
15#.##9.29.64:23
20#.##.90.222:23
16#.##.121.165:23
19#.##.93.171:23
10#.##.38.180:23
16#.##8.118.103:23
84.###.132.70:23
67.###.153.143:23
19#.##8.39.140:23
62.##.243.88:23
15#.##.129.204:23
18#.##8.101.46:23
74.##.109.47:23
18#.##4.116.135:23
21#.##.174.87:23
49.###.58.144:23
22.##.226.192:23
15#.##7.34.44:23
13#.##9.220.75:23
10#.##.146.170:23
16#.##9.206.72:23
51.##6.58.73:23
10#.#7.75.95:23
14#.##.202.30:23
28.##.191.137:23
37.#.57.53:23
17#.##8.87.182:23
8.##.58.52:23
16#.##8.157.19:23
19#.##.215.115:23
13#.##4.192.96:23
18#.##3.210.103:23
22#.##.103.57:23
82.##1.114.3:23
35.###.211.53:23
32.##.8.227:23
21#.##6.43.108:23
15#.##.180.185:23
76.###.246.137:23
14#.##5.229.26:23
17#.#4.56.86:23
15#.##.210.75:23
56.##.64.5:23
17.##.109.240:23
11#.##7.96.195:23
11#.##9.15.164:23
77.###.184.17:23
2.###.223.221:23
19.##.19.161:23
80.###.212.42:23
73.##0.212.3:23
78.##5.5.41:23
11#.##.200.28:23
12#.#7.209.1:23
5.###.161.245:23
90.###.201.123:23
13#.#.115.122:23
10#.##7.163.227:23
12#.##7.80.233:23
38.###.152.114:23
10#.##.143.66:23
20.###.163.131:23
18#.##4.157.249:23
17#.##8.224.49:23
3.###.104.160:23
12#.##7.247.80:23
18#.##3.204.182:23
95.###.122.29:23
17#.##.193.68:23
11#.##6.101.87:23
12#.##.137.182:23
15#.#8.7.103:23
21#.##0.90.193:23
87.###.125.38:23
68.###.101.182:23
45.###.237.234:23
98.###.255.225:23
17#.##2.116.222:23
41.##.91.197:23
17#.##6.240.142:23
79.##0.228.6:23
22#.##.249.232:23
18#.##.27.164:23
10#.##0.35.166:23
20#.##.206.213:23
97.##.175.0:23
13#.#9.66.28:23
71.###.217.199:23
11#.##2.144.197:23
15#.##9.62.131:23
18.##.137.9:23
15#.##4.134.143:23
94.###.192.138:23
63.###.227.113:23
12.###.108.247:23
85.##.157.2:23
10#.##7.113.201:23
91.##2.17.17:23
20#.#.56.187:23
54.###.169.204:23
55.##.99.28:23
16#.##.121.133:23
13.##.232.115:23
19#.##.135.172:23
21#.##7.130.111:23
16.##.71.101:23
9.##.22.5:23
14.##.134.114:23
47.##.23.109:23
60.###.206.27:23
19#.##5.191.202:23
26.##.138.178:23
75.###.225.208:23
40.##.209.24:23
65.###.240.169:23
39.#.153.135:23
21#.#76.49.5:23
12#.#8.1.242:23
11#.##.197.103:23
19#.##1.133.40:23
64.#.99.18:23
12#.##.145.21:23
19#.##.188.100:23
31.###.222.108:23
10#.##.146.212:23
53.##.69.247:23
20#.##0.143.106:23
59.##.227.192:23
88.##.147.147:23
17#.##0.63.70:23
15#.##.36.195:23
23.###.185.202:23
4.###.140.190:23
34.###.205.32:23
17#.##9.9.131:23
11#.##7.100.238:23
11#.##7.157.148:23
15.##0.88.59:23
15#.##.234.162:23
16#.##6.228.20:23
12#.##.110.157:23
43.##.37.174:23
13#.##4.196.166:23
33.###.76.177:23
70.###.173.27:23
7.###.196.244:23
52.##.30.198:23
93.###.157.157:23
21#.##.236.181:23
16#.##1.253.254:23
16#.##4.14.68:23
89.#.37.100:23
30.###.37.250:23
20#.##6.201.58:23
21.###.20.204:23
42.###.207.71:23
27.###.118.71:23
18#.##3.136.210:23
14#.##5.254.35:23
10#.##.56.251:23
20#.##.15.184:23
13#.##4.43.174:23
14#.##.16.118:23
20#.##7.228.20:23
20#.##5.11.112:23
20#.#36.15.2:23
13#.#1.13.81:23
21#.##.31.103:23
11.##.102.13:23
1.###.251.94:23
16#.##7.31.69:23
14#.##.238.55:23
61.#.204.25:23
50.###.86.233:23
13#.##3.176.11:23
57.###.121.146:23
12#.##3.213.61:23
22#.##6.107.26:23
44.##.170.180:23
13#.##9.136.169:23
24.##.18.174:23
11#.#.172.26:23
86.###.254.228:23
21#.##6.151.176:23
19#.##.19.129:23

Receives data from the following servers:

18#.##6.71.45:1620

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations