Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Mirai.3078

Added to the Dr.Web virus database: 2019-07-20

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • /bin/busybox
Launches processes:
  • /bin/sh -c cd /bin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
  • cat tftp
  • cat <SAMPLE_FULL_PATH>
  • /bin/sh -c cd /bin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
  • cat rm
  • /bin/sh -c cd /bin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
  • cat kill
  • /bin/sh -c cd /sbin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
  • /bin/sh -c cd /sbin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
  • /bin/sh -c cd /sbin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
Kills system processes:
  • sshd
Kills the following processes:
  • agetty
  • exim4
  • bash
  • run.sh
  • <SAMPLE>
  • systemd
Performs operations with the file system:
Creates or modifies files:
  • /bin/tftp-cpy
  • /bin/tftp
  • /bin/rm-cpy
  • /bin/rm
  • /bin/kill-cpy
  • /bin/kill
  • /sbin/tftp-cpy
  • /sbin/tftp
  • /sbin/rm-cpy
  • /sbin/rm
  • /sbin/kill-cpy
  • /sbin/kill
Network activity:
Establishes connection:
  • 19#.##.97.85:9090
  • 15#.###.163.207:37215
  • 19#.###.163.207:37215
  • 15#.##.84.214:37215
  • 15#.###.115.91:37215
  • 41.##.250.50:37215
  • 19#.##.94.106:37215
  • 41.#.#1.224:37215
  • 19#.###.26.208:37215
  • 19#.###.48.252:37215
  • 41.##.59.249:37215
  • 15#.##.53.47:37215
  • 41.##.32.17:37215
  • 15#.#.195.111:37215
  • 15#.###.251.237:37215
  • 15#.##.180.134:37215
  • 41.###.123.211:37215
  • 41.###.199.128:37215
  • 15#.###.26.251:37215
  • 15#.##6.83.78:37215
  • 41.###.131.232:37215
  • 41.##.150.245:37215
  • 41.##.67.35:37215
  • 41.##.40.26:37215
  • 41.###.193.206:37215
  • 15#.##.239.159:37215
  • 19#.##.230.74:37215
  • 41.###.185.221:37215
  • 19#.##.45.109:37215
  • 15#.##5.17.67:37215
  • 41.###.96.180:37215
  • 15#.###.125.55:37215
  • 41.###.134.10:37215
  • 41.###.8.31:37215
  • 41.##.146.46:37215
  • 41.##.39.10:37215
  • 19#.##5.197.5:37215
  • 19#.###.145.117:37215
  • 41.##.197.140:37215
  • 15#.###.89.140:37215
  • 19#.##.52.30:37215
  • 19#.###.126.239:37215
  • 19#.##.6.21:37215
  • 41.###.175.178:37215
  • 15#.##.182.161:37215
  • 41.###.181.197:37215
  • 41.###.15.102:37215
  • 19#.##.234.184:37215
  • 19#.##.222.171:37215
  • 15#.###.217.198:37215
  • 19#.##.110.1:37215
  • 19#.###.219.12:37215
  • 41.##.33.244:37215
  • 15#.##5.58.28:37215
  • 41.###.61.102:37215
  • 41.##.150.141:37215
  • 19#.##6.2.193:37215
  • 19#.##.197.226:37215
  • 19#.###.192.196:37215
  • 19#.##.223.154:37215
  • 15#.###.114.88:37215
  • 15#.###.195.246:37215
  • 41.###.185.164:37215
  • 19#.###.90.198:37215
  • 15#.###.188.94:37215
  • 19#.###.52.110:37215
  • 41.###.44.23:37215
  • 19#.###.107.62:37215
  • 15#.###.147.53:37215
  • 41.###.60.10:37215
  • 15#.##.223.50:37215
  • 15#.###.235.210:37215
  • 41.###.255.93:37215
  • 15#.##.98.133:37215
  • 15#.###.22.191:37215
  • 15#.###.199.170:37215
  • 15#.###.147.152:37215
  • 41.##.175.188:37215
  • 19#.###.191.41:37215
  • 15#.##.21.4:37215
  • 41.##.35.243:37215
  • 19#.##.9.1:37215
  • 41.##.203.159:37215
  • 19#.###.88.117:37215
  • 15#.##.137.96:37215
  • 41.###.152.95:37215
  • 19#.###.109.232:37215
  • 41.###.111.133:37215
  • 19#.###.25.220:37215
  • 41.###.89.11:37215
  • 19#.###.118.10:37215
  • 19#.###.107.24:37215
  • 19#.##.11.55:37215
  • 19#.##.9.26:37215
  • 15#.#.91.96:37215
  • 41.###.65.253:37215
  • 15#.##7.69.69:37215
  • 41.###.65.214:37215
  • 19#.###.23.128:37215
  • 19#.##.39.112:37215
  • 15#.###.235.238:37215
  • 41.##.42.112:37215
  • 15#.###.129.229:37215
  • 41.###.83.205:37215
  • 41.###.250.136:37215
  • 19#.##.250.5:37215
  • 41.###.232.171:37215
  • 19#.##.91.208:37215
  • 15#.##.131.24:37215
  • 41.##.195.13:37215
  • 41.##.58.37:37215
  • 41.###.70.98:37215
  • 15#.###.55.170:37215
  • 19#.###.246.68:37215
  • 41.##.15.191:37215
  • 19#.##.84.58:37215
  • 15#.##.164.250:37215
  • 19#.###.141.222:37215
  • 15#.##.127.19:37215
  • 15#.###.192.49:37215
  • 15#.###.196.53:37215
  • 41.###.187.123:37215
  • 19#.###.239.143:37215
  • 19#.###.109.188:37215
  • 15#.###.170.160:37215
  • 41.##.235.16:37215
  • 15#.##7.23.52:37215
  • 15#.###.141.48:37215
  • 19#.###.250.35:37215
  • 19#.##1.7.170:37215
  • 19#.###.223.34:37215
  • 15#.##9.35.76:37215
  • 15#.###.118.253:37215
  • 41.###.146.24:37215
  • 19#.##.210.78:37215
  • 15#.###.161.12:37215
  • 15#.##.52.249:37215
  • 15#.###.252.252:37215
  • 15#.##.117.212:37215
  • 15#.##0.8.19:37215
  • 41.###.158.13:37215
  • 41.###.45.222:37215
  • 19#.##.153.150:37215
  • 19#.###.146.70:37215
  • 19#.##.84.62:37215
  • 41.##.8.249:37215
  • 41.##.231.129:37215
  • 15#.##.91.46:37215
  • 41.#.#0.99:37215
  • 19#.##0.187.9:37215
  • 19#.##.111.14:37215
  • 41.###.176.155:37215
  • 41.##.88.10:37215
  • 41.###.95.230:37215
  • 41.###.29.182:37215
  • 15#.###.166.191:37215
  • 15#.##.215.205:37215
  • 19#.##0.40.39:37215
  • 41.###.23.82:37215
  • 15#.###.194.153:37215
  • 15#.###.57.161:37215
  • 41.##.145.172:37215
  • 41.###.58.35:37215
  • 19#.##9.4.198:37215
  • 19#.##3.52.4:37215
  • 41.##.159.49:37215
  • 15#.##.129.65:37215
  • 15#.###.215.102:37215
  • 15#.###.65.169:37215
  • 41.###.32.130:37215
  • 41.###.46.228:37215
  • 19#.###.54.130:37215
  • 41.##.136.245:37215
  • 15#.##.141.250:37215
  • 19#.##.161.156:37215
  • 15#.##.132.175:37215
  • 19#.##.238.122:37215
  • 41.##.187.99:37215
  • 15#.##0.55.49:37215
  • 19#.###.138.255:37215
  • 41.##.129.84:37215
  • 15#.##.200.251:37215
  • 41.###.193.60:37215
  • 41.##.210.142:37215
  • 41.###.163.187:37215
  • 41.##.22.87:37215
  • 41.##.34.199:37215
  • 41.###.87.1:37215
  • 15#.###.139.44:37215
  • 41.##.248.30:37215
  • 19#.###.113.66:37215
  • 19#.###.209.119:37215
  • 41.##.211.110:37215
  • 41.##.148.122:37215
  • 19#.##4.185.4:37215
  • 41.##.189.186:37215
  • 41.##.101.209:37215
  • 41.#.#0.236:37215
  • 15#.###.207.82:37215
  • 15#.###.139.92:37215
  • 15#.###.188.31:37215
  • 41.###.28.236:37215
  • 41.##.213.123:37215
  • 15#.###.57.106:37215
  • 41.###.12.212:37215
  • 41.##.226.196:37215
  • 15#.###.36.139:37215
  • 41.###.112.49:37215
  • 41.###.56.73:37215
  • 19#.##.84.168:37215
  • 19#.###.123.194:37215
  • 41.##.244.239:37215
  • 41.###.80.215:37215
  • 15#.##.159.123:37215
  • 41.###.128.102:37215
  • 41.###.149.164:37215
  • 15#.###.221.252:37215
  • 41.###.144.227:37215
  • 41.##.167.216:37215
  • 19#.###.211.104:37215
  • 19#.###.252.53:37215
  • 15#.##.139.118:37215
  • 19#.##3.56.54:37215
  • 41.##.122.120:37215
  • 15#.###.58.137:37215
  • 19#.###.140.100:37215
  • 19#.###.242.29:37215
  • 19#.###.195.118:37215
  • 19#.##5.3.8:37215
  • 15#.###.246.93:37215
  • 41.###.5.254:37215
  • 19#.##.180.195:37215
  • 15#.###.60.186:37215
  • 41.#.#8.213:37215
  • 19#.##.172.12:37215
  • 41.###.161.220:37215
  • 19#.###.213.231:37215
  • 15#.##2.63.21:37215
  • 41.##.226.237:37215
  • 19#.###.57.209:37215
  • 41.###.17.234:37215
  • 15#.###.35.218:37215
  • 41.###.129.186:37215
  • 19#.##.230.224:37215
  • 41.###.22.156:37215
  • 19#.##0.10.78:37215
  • 15#.##.123.141:37215
  • 19#.##3.32.89:37215
  • 19#.#.218.243:37215
  • 15#.###.30.181:37215
  • 19#.##.157.134:37215
  • 15#.###.131.154:37215
  • 19#.##.216.149:37215
  • 41.###.80.53:37215
  • 15#.##9.10.51:37215
  • 41.##.150.236:37215
  • 19#.##.38.180:37215
  • 41.###.27.50:37215
  • 15#.###.205.41:37215
  • 41.##.32.203:37215
  • 15#.##4.21.38:37215
  • 41.###.252.111:37215
  • 19#.###.231.41:37215
  • 41.###.150.168:37215
  • 41.###.16.41:37215
  • 15#.###.212.168:37215
  • 15#.###.227.154:37215
  • 41.###.180.70:37215
  • 19#.###.167.240:37215
  • 19#.###.117.26:37215
  • 19#.##.103.171:37215
  • 19#.###.20.247:37215
  • 41.###.74.172:37215
  • 41.###.101.59:37215
  • 41.##.236.7:37215
  • 15#.##.135.134:37215
  • 41.##.54.214:37215
  • 15#.###.182.22:37215
  • 41.###.24.102:37215
  • 41.###.230.190:37215
  • 15#.##5.99.82:37215
  • 15#.##.254.97:37215
  • 19#.##.179.169:37215
  • 19#.###.204.54:37215
  • 41.###.153.59:37215
  • 15#.##.225.227:37215
  • 19#.###.90.116:37215
  • 19#.##.78.200:37215
  • 15#.##.33.94:37215
  • 41.###.83.130:37215
  • 19#.###.60.167:37215
  • 19#.##.194.73:37215
  • 19#.##.199.49:37215
  • 19#.###.101.58:37215
  • 41.###.48.16:37215
  • 15#.##.57.130:37215
  • 15#.##.242.114:37215
  • 19#.###.102.122:37215
  • 41.###.149.43:37215
  • 15#.###.66.176:37215
  • 41.###.163.246:37215
  • 41.###.15.190:37215
  • 15#.##.24.216:37215
  • 41.###.249.33:37215
  • 41.#.#3.59:37215
  • 19#.###.90.142:37215
  • 41.##.249.212:37215
  • 19#.##.124.47:37215
  • 19#.###.120.172:37215
  • 41.##.97.9:37215
  • 41.##.201.133:37215
  • 15#.###.121.103:37215
  • 19#.###.234.212:37215
  • 41.##.80.39:37215
  • 15#.##.183.156:37215
  • 41.###.156.191:37215
  • 19#.##2.7.53:37215
  • 19#.##.158.184:37215
  • 41.###.242.47:37215
  • 15#.##.226.103:37215
  • 41.##.240.57:37215
  • 19#.##.42.30:37215
  • 15#.###.227.199:37215
  • 19#.###.219.141:37215
  • 19#.##8.87.98:37215
  • 41.###.5.142:37215
  • 19#.##.106.65:37215
  • 41.###.126.196:37215
  • 15#.###.202.150:37215
  • 41.###.141.80:37215
  • 15#.###.227.40:37215
  • 19#.###.241.54:37215
  • 41.##.193.251:37215
  • 15#.###.62.164:37215
  • 41.###.123.24:37215
  • 41.##.112.78:37215
  • 19#.##.160.129:37215
  • 15#.#.188.17:37215
  • 19#.##.160.35:37215
  • 19#.###.232.136:37215
  • 19#.##.168.173:37215
  • 15#.###.190.194:37215
  • 15#.##.17.63:37215
  • 15#.##8.0.172:37215
  • 41.###.51.15:37215
  • 41.###.63.59:37215
  • 19#.##.60.233:37215
  • 41.###.11.79:37215
  • 19#.##.151.0:37215
  • 15#.###.20.100:37215
  • 19#.###.187.90:37215
  • 19#.##7.99.58:37215
  • 15#.##.5.220:37215
  • 15#.###.52.121:37215
  • 19#.##0.21.61:37215
  • 41.###.52.152:37215
  • 19#.###.197.183:37215
  • 41.##.9.139:37215
  • 41.###.56.8:37215
  • 19#.##.143.91:37215
  • 15#.###.211.67:37215
  • 19#.###.250.49:37215
  • 15#.###.232.106:37215
  • 19#.###.115.171:37215
  • 41.###.26.238:37215
  • 19#.###.88.240:37215
  • 41.###.119.194:37215
  • 41.#.#31.167:37215
  • 19#.##.142.136:37215
  • 19#.###.114.185:37215
  • 41.###.66.212:37215
  • 15#.##1.84.25:37215
  • 19#.###.240.17:37215
  • 19#.##.115.213:37215
  • 41.###.57.219:37215
  • 19#.###.127.255:37215
  • 19#.###.158.87:37215
  • 41.###.129.243:37215
  • 19#.##.21.97:37215
  • 15#.##.52.208:37215
  • 41.###.238.202:37215
  • 41.##.140.226:37215
  • 41.###.149.52:37215
  • 19#.##9.17.6:37215
  • 19#.##.21.110:37215
  • 19#.###.52.227:37215
  • 41.###.14.236:37215
  • 19#.##.243.156:37215
  • 41.###.47.105:37215
  • 19#.##.185.30:37215
  • 41.##.185.151:37215
  • 19#.###.183.149:37215
  • 15#.###.234.140:37215
  • 41.###.43.240:37215
  • 15#.##.201.1:37215
  • 19#.##2.53.31:37215
  • 15#.###.39.255:37215
  • 15#.##.187.135:37215
  • 15#.##.86.172:37215
  • 15#.###.100.64:37215
  • 19#.##5.49.52:37215
  • 15#.###.27.243:37215
  • 15#.###.105.126:37215
  • 19#.###.197.23:37215
  • 41.###.77.58:37215
  • 15#.###.215.245:37215
  • 41.##.146.210:37215
  • 19#.##3.183.8:37215
  • 41.###.87.97:37215
  • 19#.###.223.113:37215
  • 19#.##.233.137:37215
  • 15#.##.115.103:37215
  • 19#.##.220.37:37215
  • 19#.##.212.114:37215
  • 15#.###.181.188:37215
  • 19#.###.24.201:37215
  • 41.###.225.20:37215
  • 41.###.143.142:37215
  • 41.###.76.102:37215
  • 41.###.101.161:37215
  • 15#.###.125.100:37215
  • 41.##.156.65:37215
  • 41.###.145.200:37215
  • 41.###.222.28:37215
  • 15#.##.127.246:37215
  • 41.##.94.205:37215
  • 15#.##.242.166:37215
  • 19#.##7.16.87:37215
  • 41.##.172.245:37215
  • 41.###.85.128:37215
  • 19#.##.84.194:37215
  • 15#.###.123.166:37215
  • 41.##.26.32:37215
  • 41.###.24.182:37215
  • 41.###.48.80:37215
  • 15#.##.45.110:37215
  • 15#.##1.25.11:37215
  • 41.###.187.67:37215
  • 41.###.115.206:37215
  • 15#.##.182.132:37215
  • 19#.#.184.127:37215
  • 15#.###.253.21:37215
  • 41.##.221.170:37215
  • 19#.###.245.214:37215
  • 19#.##.21.234:37215
  • 19#.###.128.16:37215
  • 19#.##0.23.46:37215
  • 19#.###.170.172:37215
  • 41.##.89.252:37215
  • 41.##.45.3:37215
  • 19#.##8.7.68:37215
  • 19#.###.110.254:37215
  • 15#.#.147.246:37215
  • 15#.###.90.150:37215
  • 19#.###.215.130:37215
  • 15#.##.111.98:37215
  • 19#.##1.0.195:37215
  • 15#.###.133.196:37215
  • 41.###.124.225:37215
  • 41.###.194.136:37215
  • 19#.###.50.163:37215
  • 41.##.216.57:37215
  • 15#.##.247.15:37215
  • 41.###.74.220:37215
  • 19#.##.35.52:37215
  • 15#.##.98.18:37215
  • 19#.##3.24.62:37215
  • 19#.###.41.162:37215
  • 15#.###.161.38:37215
  • 41.###.25.16:37215
  • 19#.##.160.173:37215
  • 15#.##0.68.27:37215
  • 15#.##.244.151:37215
  • 19#.##0.19.33:37215
  • 41.###.66.118:37215
  • 41.###.227.51:37215
  • 15#.##.81.150:37215
  • 41.###.0.63:37215
  • 41.##.53.154:37215
  • 15#.###.119.18:37215
  • 41.##.215.95:37215
  • 15#.##.21.210:37215
  • 15#.##1.37.7:37215
  • 19#.###.62.139:37215
  • 15#.##.56.250:37215
  • 15#.###.152.234:37215
  • 19#.###.33.106:37215
  • 15#.###.240.229:37215
  • 19#.##1.59.18:37215
  • 15#.##.26.92:37215
  • 41.###.253.16:37215
  • 15#.##.155.117:37215
  • 19#.###.59.144:37215
  • 41.###.17.24:37215
  • 15#.##9.67.23:37215
  • 15#.###.150.110:37215
  • 15#.###.237.77:37215
  • 41.##.70.153:37215
  • 19#.##6.11.24:37215
  • 15#.###.126.12:37215
  • 41.##.135.101:37215
  • 41.###.206.175:37215
  • 41.###.3.46:37215
  • 15#.###.161.187:37215
  • 19#.###.100.21:37215
  • 41.###.139.8:37215
  • 15#.###.165.230:37215
  • 41.##.15.19:37215
  • 19#.###.149.178:37215
  • 41.###.99.175:37215
  • 41.##.3.137:37215
  • 19#.##9.57.60:37215
  • 15#.##.233.38:37215
  • 41.###.18.249:37215
  • 41.###.204.89:37215
  • 19#.##.68.89:37215
  • 15#.##.117.69:37215
  • 15#.###.98.103:37215
  • 41.###.252.121:37215
  • 41.###.152.129:37215
  • 15#.##5.75.87:37215
  • 19#.###.221.234:37215
  • 15#.###.149.13:37215
  • 15#.##.39.81:37215
  • 15#.###.55.131:37215
  • 19#.###.103.191:37215
  • 19#.##.214.52:37215
  • 41.###.251.247:37215
  • 15#.###.111.26:37215
  • 15#.##.134.7:37215
  • 19#.##2.49.96:37215
  • 19#.##.224.243:37215
  • 19#.###.96.146:37215
  • 15#.###.207.214:37215
  • 41.###.44.99:37215
  • 15#.##.169.203:37215
  • 15#.###.157.239:37215
  • 41.###.63.133:37215
  • 15#.###.112.54:37215
  • 19#.###.123.44:37215
  • 15#.##.202.134:37215
  • 19#.###.166.208:37215
  • 41.###.63.151:37215
  • 41.###.103.167:37215
  • 41.###.56.53:37215
  • 15#.##.218.197:37215
  • 15#.##3.41.33:37215
  • 19#.##.30.149:37215
  • 19#.#.138.155:37215
  • 15#.##4.99.23:37215
  • 15#.###.86.125:37215
  • 41.###.105.207:37215
  • 19#.###.142.84:37215
  • 19#.##.195.145:37215
  • 41.##.10.229:37215
  • 19#.###.168.55:37215
  • 41.###.98.65:37215
  • 41.#.#1.131:37215
  • 19#.###.253.235:37215
  • 19#.###.179.63:37215
  • 41.###.88.145:37215
  • 15#.###.248.62:37215
  • 41.###.102.96:37215
  • 41.##.35.25:37215
  • 41.###.171.45:37215
  • 19#.##.211.83:37215
  • 19#.###.161.181:37215
  • 15#.###.237.127:37215
  • 41.###.178.69:37215
  • 19#.##2.60.79:37215
  • 41.##.193.233:37215
  • 19#.###.139.149:37215
  • 19#.##.242.24:37215
  • 41.###.223.60:37215
  • 19#.##.26.181:37215
  • 19#.#.231.237:37215
  • 41.##.238.127:37215
  • 41.###.201.71:37215
  • 19#.###.43.136:37215
  • 41.###.116.89:37215
  • 41.##.150.238:37215
  • 41.##.106.23:37215
  • 41.###.115.239:37215
  • 15#.##.140.170:37215
  • 41.###.82.40:37215
  • 15#.##.193.199:37215
  • 19#.###.171.18:37215
  • 41.###.138.255:37215
  • 41.###.49.189:37215
  • 41.###.215.251:37215
  • 19#.##.234.62:37215
  • 41.##.9.72:37215
  • 41.##.191.52:37215
  • 15#.#.176.252:37215
  • 41.#.#99.104:37215
  • 19#.##.165.85:37215
  • 15#.##7.17.1:37215
  • 41.###.76.221:37215
  • 41.###.236.17:37215
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 19#.##.97.85:9090
Receives data from the following servers:
  • 19#.##.97.85:9090
Other:
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2019

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040