Linux.Siggen.1611

Technical Information

Malicious functions:

Removes itself

Launches itself as a daemon

Substitutes application name for:

WZDp2EmxmGVWVGneeDuBeEEMDZDiWWRuVEWzWInmBYBEx2ezBEi2

Kills system processes:

sshd

Kills the following processes:

exim4

Network activity:

Establishes connection:

8.#.8.8:53
95.###.228.205:63042
95.###.228.205:55780

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

DNS ASK:

sw##vin.xyz

Sends data to the following servers:

95.###.228.205:63042
95.###.228.205:55780
10#.##.181.238:23
20#.##7.246.205:23
52.##9.45.56:23
14#.##.109.216:23
17#.##8.216.147:23
90.###.250.223:23
17#.##6.171.18:23
20#.##6.103.225:23
18#.#.65.226:23
16#.##8.128.123:23
19#.##.207.141:23
42.###.253.175:23
90.##.73.114:23
18#.##7.213.50:23
21#.##.48.251:23
71.###.88.100:23
14#.##.137.60:23
14#.##2.104.40:23
18#.##.114.61:23
15#.##6.25.77:23
17#.##.173.162:23
2.###.141.201:23
31.###.16.130:23
50.##.121.235:23
87.##.15.141:23
13#.##7.55.165:23
18#.##.154.27:23
49.##.247.239:23
11#.##.194.246:23
59.###.222.206:23
21#.##9.47.157:23
17#.##4.182.189:23
17#.##.125.246:23
11#.#0.51.33:23
13#.#.254.248:23
66.##.116.185:23
15#.##.211.158:23
19#.##9.189.251:23
45.###.144.100:23
18#.#37.75.0:23
13#.##0.216.217:23
2.##.8.105:23
20#.#.235.141:23
49.###.239.25:23
17#.##4.194.134:23
17#.##.216.45:23
11#.##4.62.117:23
13#.##.186.240:23
20#.##.155.157:23
15#.##.171.64:23
15#.##.62.209:23
19#.##3.147.223:23
98.###.111.42:23
14#.##9.142.102:23
18#.##3.100.11:23
20#.#17.54.1:23
49.##7.5.194:23
16#.#4.76.83:23
19#.##6.162.83:23
17#.##.161.181:23
97.###.19.118:23
64.###.81.134:23
18.###.187.93:23
19#.##8.249.91:23
16#.##8.130.79:23
15#.##.244.128:23
24.##.34.36:23
50.###.244.177:23
20#.##.205.147:23
19#.##1.180.235:23
12#.#.131.185:23
22#.##7.174.226:23
18#.##9.169.9:23
93.##8.146.5:23
59.#.80.165:23
99.##.147.45:23
78.##8.85.74:23
14#.##2.125.207:23
21#.##2.56.253:23
18#.##2.52.209:23
88.###.132.53:23
76.#.204.218:23
20#.##2.207.99:23
10#.##6.175.38:23
14#.##2.235.240:23
14#.##6.109.111:23
60.###.242.193:23
12#.##6.249.172:23
21#.#.89.30:23
18#.##4.196.205:23
21#.##2.217.102:23
72.###.135.225:23
35.###.75.151:23
20#.##1.243.72:23
11#.##7.51.11:23
17#.##0.239.147:23
19.###.255.87:23
79.###.169.73:23
85.##.91.25:23
64.##.46.218:23
70.###.235.195:23
20#.##3.100.162:23
11#.##2.115.32:23
82.##4.23.42:23
39.###.84.243:23
78.#.247.126:23
77.###.192.96:23
37.###.17.195:23
85.##3.9.2:23
12#.##.77.153:23
13#.##0.40.10:23
91.##8.62.45:23
71.##0.26.89:23
12#.##5.23.195:23
20#.#8.6.211:23
16#.##.156.81:23
11#.#2.96.99:23
14#.##4.70.71:23
10#.##1.23.254:23
19#.##5.67.16:23
20#.##3.250.29:23
22#.##7.46.87:23
17#.##.58.113:23
21#.#.4.198:23
66.###.146.84:23
31.###.105.201:23
17.###.13.243:23
20#.##5.225.226:23
17.###.131.148:23
18.##.158.75:23
15#.##.125.100:23
14#.##4.132.9:23
51.###.251.139:23
15#.##1.131.17:23
32.###.15.167:23
14#.##2.211.238:23
38.###.127.152:23
11#.##.80.124:23
74.##.112.253:23
12#.#3.194.3:23
72.###.17.187:23
65.##5.73.46:23
34.##.135.251:23
38.###.243.47:23
8.###.143.164:23
12.##.211.67:23
21#.##.167.229:23
18#.##3.130.98:23
14#.##7.78.145:23
10#.##1.211.161:23
12#.#0.85.15:23
20#.##9.97.218:23
16#.#53.45.7:23
4.###.78.47:23
25.###.102.222:23
18#.##7.39.176:23
72.##7.20.88:23
2.###.172.194:23
11#.##9.83.118:23
19#.#5.83.64:23
63.###.57.188:23
31.##.206.130:23
15#.##3.79.233:23
70.###.214.10:23
58.###.14.198:23
13#.##.116.138:23
60.##.74.135:23
19#.##7.138.251:23
14#.##7.107.141:23
8.##.146.184:23
14#.#89.36.8:23
77.##.47.86:23
14.##.225.120:23
77.##6.2.166:23
19#.##8.32.135:23
95.##.118.154:23
10#.##.124.218:23
72.##.151.108:23
16#.##7.173.218:23
18#.##8.73.127:23
22#.##5.189.92:23
10#.##3.204.77:23
21#.##6.118.84:23
10#.##4.200.25:23
12#.##9.185.233:23
92.###.149.17:23
12#.##1.213.75:23
11#.#12.73.3:23
15#.##0.199.22:23
10#.#51.4.81:23
14#.##3.122.225:23
17#.##0.50.30:23
16#.##.164.12:23
43.###.142.135:23
10#.##6.55.177:23
34.###.103.236:23
19#.##6.77.98:23
11#.##6.82.98:23
15#.##.28.198:23
19#.##.161.144:23
65.###.180.30:23
18#.##6.223.67:23
18#.##.241.244:23
14#.##9.33.109:23
90.##.12.25:23
75.###.199.105:23
10#.##8.73.54:23
62.##.185.70:23
60.###.238.92:23
13#.##0.206.37:23
13#.##.37.249:23
49.###.214.147:23
67.##.143.50:23
18.###.100.227:23
12#.##.72.197:23
42.##.227.180:23
23.##.120.12:23
70.##.208.84:23
14#.##3.57.39:23
19#.##6.241.80:23
15#.##0.250.37:23
58.##.33.94:23
19#.##.91.208:23
10#.##.93.249:23
17#.##1.52.179:23
87.###.131.155:23
51.###.172.52:23
63.###.159.199:23
11#.#3.49.27:23
66.##.65.227:23
14#.##3.101.93:23
79.###.235.48:23
18#.#3.124.9:23
18#.##5.23.122:23
31.##.13.57:23
19#.##5.208.238:23
94.##.188.72:23
16#.##9.228.249:23
15#.##9.187.140:23
14#.#4.63.86:23
65.##.102.8:23
36.###.143.57:23
18#.##.245.99:23
21#.##5.197.80:23
16#.##2.135.83:23
88.##.56.71:23
11#.##6.192.157:23
20#.##5.32.96:23
42.###.59.118:23
2.##.207.142:23
10#.##8.5.116:23
13#.##5.181.231:23
14#.##3.0.232:23
38.##.114.119:23
89.###.197.104:23
21#.#5.6.38:23
17#.##6.104.198:23
10#.##.212.210:23
11#.##.199.56:23
15#.##6.151.202:23
11#.##.31.214:23
66.###.115.159:23
98.###.239.54:23
39.###.104.98:23
8.##.211.213:23
18#.##.86.204:23
45.###.40.136:23
15#.##1.230.226:23
75.###.119.106:23
12#.#4.115.7:23
19#.##.209.105:23
32.###.159.214:23
11#.##2.62.68:23
11#.#5.47.52:23
21#.##2.192.245:23
19#.##1.3.218:23
85.##2.21.92:23
69.##.86.102:23
46.##.159.143:23
14.###.211.22:23
21#.##1.101.192:23
18.##1.8.136:23
12.###.123.200:23
12.###.79.161:23
48.##.75.182:23
14#.##0.247.36:23
37.###.154.217:23
77.##.209.132:23
10#.##8.201.152:23
59.###.117.74:23
20#.##6.232.82:23
21#.##.134.244:23
94.###.123.168:23
19#.##5.16.233:23
31.###.121.80:23
12#.##2.94.108:23
17#.##.61.108:23
11#.##6.255.62:23
22#.#1.83.12:23
24.##.165.49:23
49.##.62.153:23
15#.##4.189.176:23
88.###.215.125:23
13#.#1.27.11:23
10#.##.135.224:23
10#.#7.195.6:23
5.###.164.130:23
13#.##2.79.190:23
13#.##.26.210:23
11#.##6.34.116:23
36.###.114.208:23
9.###.68.120:23
21#.##.208.19:23
18#.##8.165.50:23
39.##.172.153:23
13#.##3.51.148:23
15#.##3.37.191:23
14#.##.61.212:23
65.##5.214.4:23
13#.##.67.143:23
75.##.145.114:23
44.###.54.170:23
18#.#89.48.8:23
35.###.70.216:23
54.###.17.128:23
18#.##0.127.160:23
32.###.108.171:23
13#.##5.243.7:23
17#.#2.79.28:23
15#.#3.64.27:23
19#.##.103.125:23
57.##.43.62:23
95.#.137.191:23
46.###.189.146:23
18#.##.137.41:23
22#.##7.40.102:23
27.###.179.234:23
93.###.19.127:23
19#.##.154.33:23
20#.##4.174.90:23
63.##2.55.68:23
19#.##.107.118:23
17.###.251.35:23
16#.#3.5.62:23
15#.##8.72.52:23
10#.##.133.209:23
62.###.244.132:23
48.###.243.212:23
35.##6.19.76:23
23.##.252.246:23
14#.##6.162.71:23
49.##.47.113:23
22#.##9.94.235:23
17#.##.185.37:23
60.##.243.215:23
17#.##.141.143:23
61.###.28.197:23
34.###.245.90:23
31.###.237.51:23
16#.##3.165.104:23
15#.##.254.116:23
10#.##2.127.49:23
14#.##.13.191:23
22#.##4.152.85:23
13#.##.213.168:23
23.##1.80.96:23
20#.##2.222.6:23
21#.##4.67.215:23
94.##1.16.95:23
12.##.154.210:23
47.###.185.119:23
16#.##7.98.177:23
22#.##1.150.164:23
19.##8.32.44:23
12#.##9.122.101:23
17#.##0.228.11:23
76.##9.79.81:23
10#.##.219.44:23
70.###.193.168:23
13#.#.201.228:23
81.###.110.11:23
17#.##.74.144:23
18.##9.137.5:23
93.###.218.39:23
21#.##.97.149:23
14#.##.193.165:23
94.##.75.57:23
10#.#4.31.17:23
10#.##1.121.211:23
20#.##5.57.234:23
61.###.77.201:23
19#.##.139.153:23
21#.##.189.61:23
19#.##.20.196:23
12#.##.186.200:23
15#.##4.197.211:23
14#.##.156.163:23
19#.##.210.36:23
19.###.85.202:23
11#.##.58.206:23
38.###.191.159:23
24.###.127.227:23
48.##0.59.70:23
20#.##1.223.98:23
41.##.210.69:23
69.#.166.244:23
5.###.159.36:23
12#.#.139.35:23
23.##.232.0:23
11#.##9.228.99:23
16#.##3.10.128:23
16#.#8.52.57:23
35.##.192.35:23
20#.##1.231.160:23
17#.##.251.235:23
20#.##9.56.54:23
1.##.232.197:23
80.###.25.230:23
16#.##2.120.189:23
97.##9.8.6:23
83.###.20.226:23
52.##.208.214:23
31.##6.75.13:23
11#.##0.24.46:23
18#.##3.63.176:23
20#.##.123.13:23
14#.##7.29.254:23
15#.##5.28.35:23
84.###.194.183:23
88.###.234.237:23
18#.##.216.68:23
31.###.206.103:23
18#.##3.241.83:23
27.###.249.117:23
18#.##4.214.254:23
12#.##2.40.137:23
15#.##5.142.195:23
5.###.73.126:23
5.###.1.120:23
19#.##.186.14:23

Receives data from the following servers:

95.###.228.205:63042

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations