Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- /bin/busybox
Launches processes:
- /bin/sh -c cd /bin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
- cat tftp
- cat <SAMPLE_FULL_PATH>
- /bin/sh -c cd /bin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
- cat rm
- /bin/sh -c cd /bin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
- cat kill
- /bin/sh -c cd /sbin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
- /bin/sh -c cd /sbin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
- /bin/sh -c cd /sbin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
Kills system processes:
- sshd
Kills the following processes:
- agetty
- exim4
- bash
- run.sh
- <SAMPLE>
- systemd
Performs operations with the file system:
Creates or modifies files:
- /bin/tftp-cpy
- /bin/tftp
- /bin/rm-cpy
- /bin/rm
- /bin/kill-cpy
- /bin/kill
- /sbin/tftp-cpy
- /sbin/tftp
- /sbin/rm-cpy
- /sbin/rm
- /sbin/kill-cpy
- /sbin/kill
Network activity:
Establishes connection:
- 19#.##.97.85:9090
- 15#.###.163.207:37215
- 19#.###.163.207:37215
- 15#.##.84.214:37215
- 15#.###.115.91:37215
- 41.##.250.50:37215
- 19#.##.94.106:37215
- 41.#.#1.224:37215
- 19#.###.26.208:37215
- 19#.###.48.252:37215
- 41.##.59.249:37215
- 15#.##.53.47:37215
- 41.##.32.17:37215
- 15#.#.195.111:37215
- 15#.###.251.237:37215
- 15#.##.180.134:37215
- 41.###.123.211:37215
- 41.###.199.128:37215
- 15#.###.26.251:37215
- 15#.##6.83.78:37215
- 41.###.131.232:37215
- 41.##.150.245:37215
- 41.##.67.35:37215
- 41.##.40.26:37215
- 41.###.193.206:37215
- 15#.##.239.159:37215
- 19#.##.230.74:37215
- 41.###.185.221:37215
- 19#.##.45.109:37215
- 15#.##5.17.67:37215
- 41.###.96.180:37215
- 15#.###.125.55:37215
- 41.###.134.10:37215
- 41.###.8.31:37215
- 41.##.146.46:37215
- 41.##.39.10:37215
- 19#.##5.197.5:37215
- 19#.###.145.117:37215
- 41.##.197.140:37215
- 15#.###.89.140:37215
- 19#.##.52.30:37215
- 19#.###.126.239:37215
- 19#.##.6.21:37215
- 41.###.175.178:37215
- 15#.##.182.161:37215
- 41.###.181.197:37215
- 41.###.15.102:37215
- 19#.##.234.184:37215
- 19#.##.222.171:37215
- 15#.###.217.198:37215
- 19#.##.110.1:37215
- 19#.###.219.12:37215
- 41.##.33.244:37215
- 15#.##5.58.28:37215
- 41.###.61.102:37215
- 41.##.150.141:37215
- 19#.##6.2.193:37215
- 19#.##.197.226:37215
- 19#.###.192.196:37215
- 19#.##.223.154:37215
- 15#.###.114.88:37215
- 15#.###.195.246:37215
- 41.###.185.164:37215
- 19#.###.90.198:37215
- 15#.###.188.94:37215
- 19#.###.52.110:37215
- 41.###.44.23:37215
- 19#.###.107.62:37215
- 15#.###.147.53:37215
- 41.###.60.10:37215
- 15#.##.223.50:37215
- 15#.###.235.210:37215
- 41.###.255.93:37215
- 15#.##.98.133:37215
- 15#.###.22.191:37215
- 15#.###.199.170:37215
- 15#.###.147.152:37215
- 41.##.175.188:37215
- 19#.###.191.41:37215
- 15#.##.21.4:37215
- 41.##.35.243:37215
- 19#.##.9.1:37215
- 41.##.203.159:37215
- 19#.###.88.117:37215
- 15#.##.137.96:37215
- 41.###.152.95:37215
- 19#.###.109.232:37215
- 41.###.111.133:37215
- 19#.###.25.220:37215
- 41.###.89.11:37215
- 19#.###.118.10:37215
- 19#.###.107.24:37215
- 19#.##.11.55:37215
- 19#.##.9.26:37215
- 15#.#.91.96:37215
- 41.###.65.253:37215
- 15#.##7.69.69:37215
- 41.###.65.214:37215
- 19#.###.23.128:37215
- 19#.##.39.112:37215
- 15#.###.235.238:37215
- 41.##.42.112:37215
- 15#.###.129.229:37215
- 41.###.83.205:37215
- 41.###.250.136:37215
- 19#.##.250.5:37215
- 41.###.232.171:37215
- 19#.##.91.208:37215
- 15#.##.131.24:37215
- 41.##.195.13:37215
- 41.##.58.37:37215
- 41.###.70.98:37215
- 15#.###.55.170:37215
- 19#.###.246.68:37215
- 41.##.15.191:37215
- 19#.##.84.58:37215
- 15#.##.164.250:37215
- 19#.###.141.222:37215
- 15#.##.127.19:37215
- 15#.###.192.49:37215
- 15#.###.196.53:37215
- 41.###.187.123:37215
- 19#.###.239.143:37215
- 19#.###.109.188:37215
- 15#.###.170.160:37215
- 41.##.235.16:37215
- 15#.##7.23.52:37215
- 15#.###.141.48:37215
- 19#.###.250.35:37215
- 19#.##1.7.170:37215
- 19#.###.223.34:37215
- 15#.##9.35.76:37215
- 15#.###.118.253:37215
- 41.###.146.24:37215
- 19#.##.210.78:37215
- 15#.###.161.12:37215
- 15#.##.52.249:37215
- 15#.###.252.252:37215
- 15#.##.117.212:37215
- 15#.##0.8.19:37215
- 41.###.158.13:37215
- 41.###.45.222:37215
- 19#.##.153.150:37215
- 19#.###.146.70:37215
- 19#.##.84.62:37215
- 41.##.8.249:37215
- 41.##.231.129:37215
- 15#.##.91.46:37215
- 41.#.#0.99:37215
- 19#.##0.187.9:37215
- 19#.##.111.14:37215
- 41.###.176.155:37215
- 41.##.88.10:37215
- 41.###.95.230:37215
- 41.###.29.182:37215
- 15#.###.166.191:37215
- 15#.##.215.205:37215
- 19#.##0.40.39:37215
- 41.###.23.82:37215
- 15#.###.194.153:37215
- 15#.###.57.161:37215
- 41.##.145.172:37215
- 41.###.58.35:37215
- 19#.##9.4.198:37215
- 19#.##3.52.4:37215
- 41.##.159.49:37215
- 15#.##.129.65:37215
- 15#.###.215.102:37215
- 15#.###.65.169:37215
- 41.###.32.130:37215
- 41.###.46.228:37215
- 19#.###.54.130:37215
- 41.##.136.245:37215
- 15#.##.141.250:37215
- 19#.##.161.156:37215
- 15#.##.132.175:37215
- 19#.##.238.122:37215
- 41.##.187.99:37215
- 15#.##0.55.49:37215
- 19#.###.138.255:37215
- 41.##.129.84:37215
- 15#.##.200.251:37215
- 41.###.193.60:37215
- 41.##.210.142:37215
- 41.###.163.187:37215
- 41.##.22.87:37215
- 41.##.34.199:37215
- 41.###.87.1:37215
- 15#.###.139.44:37215
- 41.##.248.30:37215
- 19#.###.113.66:37215
- 19#.###.209.119:37215
- 41.##.211.110:37215
- 41.##.148.122:37215
- 19#.##4.185.4:37215
- 41.##.189.186:37215
- 41.##.101.209:37215
- 41.#.#0.236:37215
- 15#.###.207.82:37215
- 15#.###.139.92:37215
- 15#.###.188.31:37215
- 41.###.28.236:37215
- 41.##.213.123:37215
- 15#.###.57.106:37215
- 41.###.12.212:37215
- 41.##.226.196:37215
- 15#.###.36.139:37215
- 41.###.112.49:37215
- 41.###.56.73:37215
- 19#.##.84.168:37215
- 19#.###.123.194:37215
- 41.##.244.239:37215
- 41.###.80.215:37215
- 15#.##.159.123:37215
- 41.###.128.102:37215
- 41.###.149.164:37215
- 15#.###.221.252:37215
- 41.###.144.227:37215
- 41.##.167.216:37215
- 19#.###.211.104:37215
- 19#.###.252.53:37215
- 15#.##.139.118:37215
- 19#.##3.56.54:37215
- 41.##.122.120:37215
- 15#.###.58.137:37215
- 19#.###.140.100:37215
- 19#.###.242.29:37215
- 19#.###.195.118:37215
- 19#.##5.3.8:37215
- 15#.###.246.93:37215
- 41.###.5.254:37215
- 19#.##.180.195:37215
- 15#.###.60.186:37215
- 41.#.#8.213:37215
- 19#.##.172.12:37215
- 41.###.161.220:37215
- 19#.###.213.231:37215
- 15#.##2.63.21:37215
- 41.##.226.237:37215
- 19#.###.57.209:37215
- 41.###.17.234:37215
- 15#.###.35.218:37215
- 41.###.129.186:37215
- 19#.##.230.224:37215
- 41.###.22.156:37215
- 19#.##0.10.78:37215
- 15#.##.123.141:37215
- 19#.##3.32.89:37215
- 19#.#.218.243:37215
- 15#.###.30.181:37215
- 19#.##.157.134:37215
- 15#.###.131.154:37215
- 19#.##.216.149:37215
- 41.###.80.53:37215
- 15#.##9.10.51:37215
- 41.##.150.236:37215
- 19#.##.38.180:37215
- 41.###.27.50:37215
- 15#.###.205.41:37215
- 41.##.32.203:37215
- 15#.##4.21.38:37215
- 41.###.252.111:37215
- 19#.###.231.41:37215
- 41.###.150.168:37215
- 41.###.16.41:37215
- 15#.###.212.168:37215
- 15#.###.227.154:37215
- 41.###.180.70:37215
- 19#.###.167.240:37215
- 19#.###.117.26:37215
- 19#.##.103.171:37215
- 19#.###.20.247:37215
- 41.###.74.172:37215
- 41.###.101.59:37215
- 41.##.236.7:37215
- 15#.##.135.134:37215
- 41.##.54.214:37215
- 15#.###.182.22:37215
- 41.###.24.102:37215
- 41.###.230.190:37215
- 15#.##5.99.82:37215
- 15#.##.254.97:37215
- 19#.##.179.169:37215
- 19#.###.204.54:37215
- 41.###.153.59:37215
- 15#.##.225.227:37215
- 19#.###.90.116:37215
- 19#.##.78.200:37215
- 15#.##.33.94:37215
- 41.###.83.130:37215
- 19#.###.60.167:37215
- 19#.##.194.73:37215
- 19#.##.199.49:37215
- 19#.###.101.58:37215
- 41.###.48.16:37215
- 15#.##.57.130:37215
- 15#.##.242.114:37215
- 19#.###.102.122:37215
- 41.###.149.43:37215
- 15#.###.66.176:37215
- 41.###.163.246:37215
- 41.###.15.190:37215
- 15#.##.24.216:37215
- 41.###.249.33:37215
- 41.#.#3.59:37215
- 19#.###.90.142:37215
- 41.##.249.212:37215
- 19#.##.124.47:37215
- 19#.###.120.172:37215
- 41.##.97.9:37215
- 41.##.201.133:37215
- 15#.###.121.103:37215
- 19#.###.234.212:37215
- 41.##.80.39:37215
- 15#.##.183.156:37215
- 41.###.156.191:37215
- 19#.##2.7.53:37215
- 19#.##.158.184:37215
- 41.###.242.47:37215
- 15#.##.226.103:37215
- 41.##.240.57:37215
- 19#.##.42.30:37215
- 15#.###.227.199:37215
- 19#.###.219.141:37215
- 19#.##8.87.98:37215
- 41.###.5.142:37215
- 19#.##.106.65:37215
- 41.###.126.196:37215
- 15#.###.202.150:37215
- 41.###.141.80:37215
- 15#.###.227.40:37215
- 19#.###.241.54:37215
- 41.##.193.251:37215
- 15#.###.62.164:37215
- 41.###.123.24:37215
- 41.##.112.78:37215
- 19#.##.160.129:37215
- 15#.#.188.17:37215
- 19#.##.160.35:37215
- 19#.###.232.136:37215
- 19#.##.168.173:37215
- 15#.###.190.194:37215
- 15#.##.17.63:37215
- 15#.##8.0.172:37215
- 41.###.51.15:37215
- 41.###.63.59:37215
- 19#.##.60.233:37215
- 41.###.11.79:37215
- 19#.##.151.0:37215
- 15#.###.20.100:37215
- 19#.###.187.90:37215
- 19#.##7.99.58:37215
- 15#.##.5.220:37215
- 15#.###.52.121:37215
- 19#.##0.21.61:37215
- 41.###.52.152:37215
- 19#.###.197.183:37215
- 41.##.9.139:37215
- 41.###.56.8:37215
- 19#.##.143.91:37215
- 15#.###.211.67:37215
- 19#.###.250.49:37215
- 15#.###.232.106:37215
- 19#.###.115.171:37215
- 41.###.26.238:37215
- 19#.###.88.240:37215
- 41.###.119.194:37215
- 41.#.#31.167:37215
- 19#.##.142.136:37215
- 19#.###.114.185:37215
- 41.###.66.212:37215
- 15#.##1.84.25:37215
- 19#.###.240.17:37215
- 19#.##.115.213:37215
- 41.###.57.219:37215
- 19#.###.127.255:37215
- 19#.###.158.87:37215
- 41.###.129.243:37215
- 19#.##.21.97:37215
- 15#.##.52.208:37215
- 41.###.238.202:37215
- 41.##.140.226:37215
- 41.###.149.52:37215
- 19#.##9.17.6:37215
- 19#.##.21.110:37215
- 19#.###.52.227:37215
- 41.###.14.236:37215
- 19#.##.243.156:37215
- 41.###.47.105:37215
- 19#.##.185.30:37215
- 41.##.185.151:37215
- 19#.###.183.149:37215
- 15#.###.234.140:37215
- 41.###.43.240:37215
- 15#.##.201.1:37215
- 19#.##2.53.31:37215
- 15#.###.39.255:37215
- 15#.##.187.135:37215
- 15#.##.86.172:37215
- 15#.###.100.64:37215
- 19#.##5.49.52:37215
- 15#.###.27.243:37215
- 15#.###.105.126:37215
- 19#.###.197.23:37215
- 41.###.77.58:37215
- 15#.###.215.245:37215
- 41.##.146.210:37215
- 19#.##3.183.8:37215
- 41.###.87.97:37215
- 19#.###.223.113:37215
- 19#.##.233.137:37215
- 15#.##.115.103:37215
- 19#.##.220.37:37215
- 19#.##.212.114:37215
- 15#.###.181.188:37215
- 19#.###.24.201:37215
- 41.###.225.20:37215
- 41.###.143.142:37215
- 41.###.76.102:37215
- 41.###.101.161:37215
- 15#.###.125.100:37215
- 41.##.156.65:37215
- 41.###.145.200:37215
- 41.###.222.28:37215
- 15#.##.127.246:37215
- 41.##.94.205:37215
- 15#.##.242.166:37215
- 19#.##7.16.87:37215
- 41.##.172.245:37215
- 41.###.85.128:37215
- 19#.##.84.194:37215
- 15#.###.123.166:37215
- 41.##.26.32:37215
- 41.###.24.182:37215
- 41.###.48.80:37215
- 15#.##.45.110:37215
- 15#.##1.25.11:37215
- 41.###.187.67:37215
- 41.###.115.206:37215
- 15#.##.182.132:37215
- 19#.#.184.127:37215
- 15#.###.253.21:37215
- 41.##.221.170:37215
- 19#.###.245.214:37215
- 19#.##.21.234:37215
- 19#.###.128.16:37215
- 19#.##0.23.46:37215
- 19#.###.170.172:37215
- 41.##.89.252:37215
- 41.##.45.3:37215
- 19#.##8.7.68:37215
- 19#.###.110.254:37215
- 15#.#.147.246:37215
- 15#.###.90.150:37215
- 19#.###.215.130:37215
- 15#.##.111.98:37215
- 19#.##1.0.195:37215
- 15#.###.133.196:37215
- 41.###.124.225:37215
- 41.###.194.136:37215
- 19#.###.50.163:37215
- 41.##.216.57:37215
- 15#.##.247.15:37215
- 41.###.74.220:37215
- 19#.##.35.52:37215
- 15#.##.98.18:37215
- 19#.##3.24.62:37215
- 19#.###.41.162:37215
- 15#.###.161.38:37215
- 41.###.25.16:37215
- 19#.##.160.173:37215
- 15#.##0.68.27:37215
- 15#.##.244.151:37215
- 19#.##0.19.33:37215
- 41.###.66.118:37215
- 41.###.227.51:37215
- 15#.##.81.150:37215
- 41.###.0.63:37215
- 41.##.53.154:37215
- 15#.###.119.18:37215
- 41.##.215.95:37215
- 15#.##.21.210:37215
- 15#.##1.37.7:37215
- 19#.###.62.139:37215
- 15#.##.56.250:37215
- 15#.###.152.234:37215
- 19#.###.33.106:37215
- 15#.###.240.229:37215
- 19#.##1.59.18:37215
- 15#.##.26.92:37215
- 41.###.253.16:37215
- 15#.##.155.117:37215
- 19#.###.59.144:37215
- 41.###.17.24:37215
- 15#.##9.67.23:37215
- 15#.###.150.110:37215
- 15#.###.237.77:37215
- 41.##.70.153:37215
- 19#.##6.11.24:37215
- 15#.###.126.12:37215
- 41.##.135.101:37215
- 41.###.206.175:37215
- 41.###.3.46:37215
- 15#.###.161.187:37215
- 19#.###.100.21:37215
- 41.###.139.8:37215
- 15#.###.165.230:37215
- 41.##.15.19:37215
- 19#.###.149.178:37215
- 41.###.99.175:37215
- 41.##.3.137:37215
- 19#.##9.57.60:37215
- 15#.##.233.38:37215
- 41.###.18.249:37215
- 41.###.204.89:37215
- 19#.##.68.89:37215
- 15#.##.117.69:37215
- 15#.###.98.103:37215
- 41.###.252.121:37215
- 41.###.152.129:37215
- 15#.##5.75.87:37215
- 19#.###.221.234:37215
- 15#.###.149.13:37215
- 15#.##.39.81:37215
- 15#.###.55.131:37215
- 19#.###.103.191:37215
- 19#.##.214.52:37215
- 41.###.251.247:37215
- 15#.###.111.26:37215
- 15#.##.134.7:37215
- 19#.##2.49.96:37215
- 19#.##.224.243:37215
- 19#.###.96.146:37215
- 15#.###.207.214:37215
- 41.###.44.99:37215
- 15#.##.169.203:37215
- 15#.###.157.239:37215
- 41.###.63.133:37215
- 15#.###.112.54:37215
- 19#.###.123.44:37215
- 15#.##.202.134:37215
- 19#.###.166.208:37215
- 41.###.63.151:37215
- 41.###.103.167:37215
- 41.###.56.53:37215
- 15#.##.218.197:37215
- 15#.##3.41.33:37215
- 19#.##.30.149:37215
- 19#.#.138.155:37215
- 15#.##4.99.23:37215
- 15#.###.86.125:37215
- 41.###.105.207:37215
- 19#.###.142.84:37215
- 19#.##.195.145:37215
- 41.##.10.229:37215
- 19#.###.168.55:37215
- 41.###.98.65:37215
- 41.#.#1.131:37215
- 19#.###.253.235:37215
- 19#.###.179.63:37215
- 41.###.88.145:37215
- 15#.###.248.62:37215
- 41.###.102.96:37215
- 41.##.35.25:37215
- 41.###.171.45:37215
- 19#.##.211.83:37215
- 19#.###.161.181:37215
- 15#.###.237.127:37215
- 41.###.178.69:37215
- 19#.##2.60.79:37215
- 41.##.193.233:37215
- 19#.###.139.149:37215
- 19#.##.242.24:37215
- 41.###.223.60:37215
- 19#.##.26.181:37215
- 19#.#.231.237:37215
- 41.##.238.127:37215
- 41.###.201.71:37215
- 19#.###.43.136:37215
- 41.###.116.89:37215
- 41.##.150.238:37215
- 41.##.106.23:37215
- 41.###.115.239:37215
- 15#.##.140.170:37215
- 41.###.82.40:37215
- 15#.##.193.199:37215
- 19#.###.171.18:37215
- 41.###.138.255:37215
- 41.###.49.189:37215
- 41.###.215.251:37215
- 19#.##.234.62:37215
- 41.##.9.72:37215
- 41.##.191.52:37215
- 15#.#.176.252:37215
- 41.#.#99.104:37215
- 19#.##.165.85:37215
- 15#.##7.17.1:37215
- 41.###.76.221:37215
- 41.###.236.17:37215
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##.97.85:9090
Receives data from the following servers:
- 19#.##.97.85:9090
Other:
Collects information about network activity
