Linux.Siggen.1560

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

/etc/init.d/netdns
/etc/init.d/.depend.boot
/etc/init.d/.depend.start
/etc/init.d/.depend.stop

Creates or modifies the following symlinks:

/etc/rc0.d/K01netdns
/etc/rc1.d/K01netdns
/etc/rc2.d/S01netdns
/etc/rc3.d/S01netdns
/etc/rc4.d/S01netdns
/etc/rc5.d/S01netdns
/etc/rc6.d/K01netdns

Malicious functions:

Launches itself as a daemon

Manages services:

systemctl enable netdns
/usr/sbin/update-rc.d netdns defaults
systemctl daemon-reload

Launches processes:

<SAMPLE_FULL_PATH> [kerberods]
/bin/bash -c chattr -i /usr/lib/systemd/system/netdns.service
chattr -i /usr/lib/systemd/system/netdns.service
/bin/bash -c chkconfig --add netdns
/bin/bash -c systemctl enable netdns
/sbin/insserv netdns

Performs operations with the file system:

Creates or modifies files:

/tmp/.X11unix
/usr/sbin/kerberods
/usr/lib/systemd/system/netdns.service

Locks files:

/tmp/.X11unix

Network activity:

Establishes connection:

<LOCAL_DNS_SERVER>
17#.#8.123.25:9
[2########::f03c:91ff:fe70:2b9d]:9
19#.##8.216.75:6379
19#.##8.216.0:6379
<LOCAL_GATE>:6379
19#.##8.216.3:6379
19#.##8.216.7:6379
19#.##8.216.8:6379
19#.##8.216.9:6379
<LOCAL_GATE>0:6379
<LOCAL_GATE>1:6379
<LOCAL_GATE>2:6379
<LOCAL_GATE>3:6379
<LOCAL_GATE>4:6379
<LOCAL_GATE>6:6379
<LOCAL_GATE>7:6379
<LOCAL_GATE>8:6379
<LOCAL_GATE>9:6379
19#.##8.216.20:6379
19#.##8.216.21:6379
19#.##8.216.22:6379
19#.##8.216.23:6379
19#.##8.216.24:6379
19#.##8.216.25:6379
19#.##8.216.26:6379
19#.##8.216.27:6379
19#.##8.216.28:6379
19#.##8.216.99:6379
19#.##8.216.30:6379
19#.##8.216.31:6379
19#.##8.216.32:6379
19#.##8.216.33:6379
19#.##8.216.34:6379
19#.##8.216.36:6379
19#.##8.216.37:6379
19#.##8.216.35:6379
19#.##8.216.38:6379
19#.##8.216.39:6379
19#.##8.216.40:6379
19#.##8.216.41:6379
19#.##8.216.43:6379
19#.##8.216.44:6379
19#.##8.216.45:6379
19#.##8.216.46:6379
19#.##8.216.47:6379
19#.##8.216.48:6379
19#.##8.216.49:6379
19#.##8.216.50:6379
19#.##8.216.51:6379
19#.##8.216.52:6379
19#.##8.216.53:6379
19#.##8.216.54:6379
19#.##8.216.55:6379
19#.##8.216.56:6379
19#.##8.216.57:6379
19#.##8.216.58:6379
19#.##8.216.59:6379
19#.##8.216.61:6379
19#.##8.216.63:6379
19#.##8.216.64:6379
19#.##8.216.65:6379
19#.##8.216.66:6379
19#.##8.216.67:6379
19#.##8.216.68:6379
19#.##8.216.69:6379
19#.##8.216.70:6379
19#.##8.216.71:6379
19#.##8.216.73:6379
19#.##8.216.74:6379
19#.##8.216.29:6379
19#.##8.216.76:6379
19#.##8.216.77:6379
19#.##8.216.78:6379
19#.##8.216.79:6379
19#.##8.216.80:6379
19#.##8.216.81:6379
19#.##8.216.82:6379
19#.##8.216.83:6379
19#.##8.216.84:6379
19#.##8.216.85:6379
19#.##8.216.86:6379
19#.##8.216.87:6379
19#.##8.216.88:6379
19#.##8.216.89:6379
19#.##8.216.90:6379
19#.##8.216.91:6379
19#.##8.216.92:6379
19#.##8.216.94:6379
19#.##8.216.95:6379
19#.##8.216.97:6379
19#.##8.216.98:6379
19#.##8.216.2:6379
19#.##8.216.4:6379
19#.##8.216.5:6379
19#.##8.216.6:6379
<LOCAL_GATE>5:6379
19#.##8.216.42:6379
19#.##8.216.60:6379
19#.##8.216.62:6379
19#.##8.216.72:6379
19#.##8.216.93:6379
19#.##8.216.96:6379
<LOCAL_GATE>00:6379
<LOCAL_GATE>01:6379
<LOCAL_GATE>02:6379
<LOCAL_GATE>03:6379
<LOCAL_GATE>04:6379
<LOCAL_GATE>05:6379
<LOCAL_GATE>06:6379
<LOCAL_GATE>07:6379
<LOCAL_GATE>08:6379
<LOCAL_GATE>09:6379
<LOCAL_GATE>10:6379
<LOCAL_GATE>11:6379
<LOCAL_GATE>12:6379
<LOCAL_GATE>13:6379
<LOCAL_GATE>14:6379
<LOCAL_GATE>15:6379
<LOCAL_GATE>16:6379
<LOCAL_GATE>17:6379
<LOCAL_GATE>18:6379
<LOCAL_GATE>19:6379
<LOCAL_GATE>20:6379
<LOCAL_GATE>21:6379
<LOCAL_GATE>22:6379
<LOCAL_GATE>23:6379
<LOCAL_GATE>24:6379
<LOCAL_GATE>25:6379
<LOCAL_GATE>26:6379
<LOCAL_GATE>27:6379
<LOCAL_GATE>28:6379
<LOCAL_GATE>29:6379
<LOCAL_GATE>30:6379
<LOCAL_GATE>31:6379
<LOCAL_GATE>32:6379
<LOCAL_GATE>33:6379
<LOCAL_GATE>34:6379
<LOCAL_GATE>35:6379
<LOCAL_GATE>36:6379
<LOCAL_GATE>37:6379
<LOCAL_GATE>38:6379
<LOCAL_GATE>39:6379
<LOCAL_GATE>40:6379
<LOCAL_GATE>41:6379
<LOCAL_GATE>42:6379
<LOCAL_GATE>43:6379
<LOCAL_GATE>44:6379
<LOCAL_GATE>45:6379
<LOCAL_GATE>46:6379
<LOCAL_GATE>47:6379
<LOCAL_GATE>48:6379
<LOCAL_GATE>49:6379
<LOCAL_GATE>50:6379
<LOCAL_GATE>51:6379
<LOCAL_GATE>52:6379
<LOCAL_GATE>53:6379
<LOCAL_GATE>54:6379
<LOCAL_GATE>55:6379
<LOCAL_GATE>56:6379
<LOCAL_GATE>57:6379
<LOCAL_GATE>58:6379
<LOCAL_GATE>59:6379
<LOCAL_GATE>60:6379
<LOCAL_GATE>61:6379
<LOCAL_GATE>63:6379
<LOCAL_GATE>62:6379
<LOCAL_GATE>64:6379
<LOCAL_GATE>65:6379
<LOCAL_GATE>66:6379
<LOCAL_GATE>67:6379
<LOCAL_GATE>68:6379
<LOCAL_GATE>69:6379
<LOCAL_GATE>70:6379
<LOCAL_GATE>71:6379
<LOCAL_GATE>72:6379
<LOCAL_GATE>73:6379
<LOCAL_GATE>74:6379
<LOCAL_GATE>75:6379
<LOCAL_GATE>76:6379
<LOCAL_GATE>77:6379
<LOCAL_GATE>78:6379
<LOCAL_GATE>79:6379
<LOCAL_GATE>98:6379
<LOCAL_GATE>80:6379
<LOCAL_GATE>81:6379
<LOCAL_GATE>82:6379
<LOCAL_GATE>84:6379
<LOCAL_GATE>85:6379
<LOCAL_GATE>86:6379
<LOCAL_GATE>87:6379
<LOCAL_GATE>88:6379
<LOCAL_GATE>89:6379
<LOCAL_GATE>90:6379
<LOCAL_GATE>91:6379
<LOCAL_GATE>92:6379
<LOCAL_GATE>93:6379
<LOCAL_GATE>94:6379
<LOCAL_GATE>95:6379
<LOCAL_GATE>97:6379
<LOCAL_GATE>83:6379
<LOCAL_GATE>96:6379
<LOCAL_GATE>99:6379
19#.###.216.200:6379
19#.###.216.201:6379
19#.###.216.202:6379
19#.###.216.203:6379
19#.###.216.204:6379
19#.###.216.205:6379
19#.###.216.206:6379
19#.###.216.207:6379
19#.###.216.208:6379
19#.###.216.209:6379
19#.###.216.210:6379
19#.###.216.211:6379
19#.###.216.212:6379
19#.###.216.213:6379
19#.###.216.214:6379
19#.###.216.215:6379
19#.###.216.216:6379
19#.###.216.217:6379
19#.###.216.218:6379
19#.###.216.219:6379
19#.###.216.220:6379
19#.###.216.221:6379
19#.###.216.222:6379
19#.###.216.223:6379
19#.###.216.224:6379
19#.###.216.225:6379
19#.###.216.226:6379
19#.###.216.227:6379
19#.###.216.233:6379
19#.###.216.234:6379
19#.###.216.235:6379
19#.###.216.236:6379
19#.###.216.237:6379
19#.###.216.238:6379
19#.###.216.229:6379
19#.###.216.230:6379
19#.###.216.231:6379
19#.###.216.232:6379
19#.###.216.228:6379
19#.###.216.239:6379
19#.###.216.240:6379
19#.###.216.241:6379
19#.###.216.242:6379
19#.###.216.243:6379
19#.###.216.244:6379
19#.###.216.245:6379
19#.###.216.246:6379
19#.###.216.247:6379
19#.###.216.249:6379
19#.###.216.250:6379
19#.###.216.251:6379
19#.###.216.252:6379
95.##1.0.0:6379
95.##1.0.1:6379
95.##1.0.2:6379
95.##1.0.3:6379
95.##1.0.4:6379

HTTP GET requests:

id##t.me/

DNS ASK:

id##t.me

Other:

Collects RAM information

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement