Linux.Siggen.6746

Technical Information

Malicious functions:

Launches itself as a daemon

Launches processes:

iptables -A INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
/var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
/usr/sbin/xtables-nft-multi iptables -L OUTPUT -t raw --line-numbers
/usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
iptables -D INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -I INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -C INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
iptables -D INPUT -p tcp --syn -j DROP
iptables -D INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
iptables -L OUTPUT -t raw --line-numbers
/usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
iptables -t raw -I OUTPUT -p tcp --sport 46759 -j NOTRACK
/usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -j DROP
iptables -A INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
iptables -D INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
iptables -D INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -D OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -D OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -t raw -I OUTPUT -p tcp --sport 46759 -j NOTRACK
iptables -D INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
iptables -A INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -j DROP
iptables -A INPUT -p tcp --syn -j DROP
iptables -L INPUT --line-numbers
iptables -D INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
iptables -C INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
/usr/sbin/xtables-nft-multi iptables -L INPUT --line-numbers

Performs operations with the file system:

Modifies file access rights:

/var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k

Creates or modifies files:

/var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
/dev/watchdog
/proc/sys/net/netfilter/nf_conntrack_max
/proc/sys/net/ipv4/ip_forward

Deletes files:

/var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k

Mounts file systems:

/boot/none

Network activity:

Awaits incoming connections on ports:

127.0.0.1:65528
127.0.0.1:65531

Establishes connection:

45.##.146.93:82
8.#.8.8:53
45.##.146.93:81

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

DNS ASK:

0.#.#.#0.in-addr.arpa
0.#.##.100.in-addr.arpa
0.#.#.#27.in-addr.arpa
0.#.##.172.in-addr.arpa
0.#.#.#92.in-addr.arpa

Sends data to the following servers:

45.##.146.93:82
45.##.146.93:81
45.##.146.93:8083
10.#.193.37:23
10.#.0.222:23
10.###.113.173:23
10.##8.66.67:23
10.##4.1.158:23
10.###.81.213:23
10.##3.99.16:23
10.###.226.128:23
10.#.112.125:23
10.###.17.198:23
10.###.178.53:23
10.###.231.217:23
10.###.70.104:23
10.###.76.187:23
10.###.231.59:23
10.###.246.109:23
10.###.247.220:23
10.###.54.126:23
10.###.113.240:23
10.###.199.254:23
10.###.157.25:23
10.###.53.115:23
10.##9.62.61:23
10.##3.49.51:23
10.##9.1.188:23
10.###.182.12:23
10.###.64.150:23
10.###.102.24:23
10.###.71.147:23
10.##0.51.48:23
10.###.210.182:23
10.###.177.100:23
10.###.49.240:23
10.###.161.251:23
10.###.151.49:23
10.##7.7.149:23
10.###.17.119:23
10.###.232.16:23
10.###.49.142:23
10.##3.80.87:23
10.###.80.106:23
10.###.236.186:23
10.###.54.231:23
10.###.112.242:23
10.##5.61.63:23
10.##1.55.62:23
10.###.66.119:23
10.###.144.51:23
10.###.184.121:23
10.###.119.15:23
10.###.247.90:23
10.##0.6.34:23
10.###.237.113:23
10.###.130.64:23
10.###.224.116:23
10.###.192.245:23
10.##1.7.92:23
10.###.114.126:23
10.###.126.208:23
10.###.120.83:23
10.###.13.201:23
10.###.162.162:23
10.###.253.205:23
10.###.231.245:23
10.###.166.56:23
10.###.193.225:23
10.###.241.96:23
10.##7.25.12:23
10.##3.23.21:23
10.###.39.162:23
10.##4.72.25:23
10.###.145.176:23
10.###.215.176:23
10.###.118.36:23
10.###.247.233:23
10.###.152.83:23
10.###.231.110:23
10.###.38.247:23
10.###.240.68:23
10.###.161.244:23
10.##0.2.14:23
10.###.161.132:23
10.###.119.69:23
10.##8.146.6:23
10.###.194.90:23
10.###.178.188:23
10.###.205.245:23
10.###.215.202:23
10.###.45.156:23
10.###.65.155:23
10.###.209.116:23
10.###.93.175:23
10.###.152.173:23
10.###.225.122:23
10.###.129.170:23
10.###.161.101:23
10.###.210.91:23
10.###.151.241:23
10.##6.34.35:23
10.##2.97.61:23
10.###.97.253:23
10.###.114.48:23
10.###.130.85:23
10.###.225.222:23
10.###.48.188:23
10.##2.1.163:23
10.###.174.111:23
10.##0.98.48:23
10.###.77.216:23
10.###.49.168:23
10.###.62.254:23
10.###.215.32:23
10.###.97.102:23
10.###.161.163:23
10.##8.34.75:23
10.###.97.172:23
10.###.114.96:23
10.###.96.228:23
10.###.183.121:23
10.###.248.131:23
10.##5.104.6:23
10.##8.50.51:23
10.##7.67.78:23
10.###.67.117:23
10.##9.45.64:23
10.###.224.70:23
10.##7.97.75:23
10.###.225.27:23
10.###.114.18:23
10.###.227.56:23
10.##4.1.99:23
10.###.80.114:23
10.###.193.16:23
10.###.166.87:23
10.###.241.132:23
10.###.177.82:23
10.###.130.98:23
10.##5.1.75:23
10.###.80.240:23
10.###.209.39:23
10.###.93.173:23
10.###.161.91:23
10.##5.2.144:23
10.###.237.134:23
10.###.61.231:23
10.###.246.149:23

Receives data from the following servers:

45.##.146.93:82
45.##.146.93:81

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations