Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- /bin/busybox
Launches processes:
- /bin/sh -c cd /bin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
- cat tftp
- cat <SAMPLE_FULL_PATH>
- /bin/sh -c cd /bin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
- cat rm
- /bin/sh -c cd /bin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
- cat kill
- /bin/sh -c cd /bin/; cat cd > cd-cpy; cat <SAMPLE_FULL_PATH> > cd
- cat cd
- /bin/sh -c cd /sbin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
- /bin/sh -c cd /sbin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
- /bin/sh -c cd /sbin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
- /bin/sh -c cd /sbin/; cat cd > cd-cpy; cat <SAMPLE_FULL_PATH> > cd
- /bin/sh -c export PATH=/root:$PATH
- /bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/.~/.bash_profile
- /bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/.~/.bashrc
- /bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/./root/.bash_profile
- /bin/sh -c echo -ne 'export PATH=/root:$PATH' >> ~/./root/.bashrc
Kills system processes:
- sshd
Kills the following processes:
- dhclient
- rpcbind
- rpc.statd
- rpc.idmapd
- atd
- cron
Performs operations with the file system:
Creates or modifies files:
- /bin/tftp-cpy
- /bin/tftp
- /bin/rm-cpy
- /bin/rm
- /bin/kill-cpy
- /bin/kill
- /bin/cd-cpy
- /bin/cd
- /sbin/tftp-cpy
- /sbin/tftp
- /sbin/rm-cpy
- /sbin/rm
- /sbin/kill-cpy
- /sbin/kill
- /sbin/cd-cpy
- /sbin/cd
- <SAMPLE_FULL_PATH>
- /root/.~/.bash_profile
- /root/.~/.bashrc
- /root/./root/.bash_profile
- /root/./root/.bashrc
Network activity:
Establishes connection:
- 19#.##.97.85:9090
- 15#.#.92.254:37215
- 19#.##.92.254:37215
- 15#.##.208.45:37215
- 15#.##.29.24:37215
- 41.###.8.199:37215
- 19#.###.199.145:37215
- 41.###.245.206:37215
- 19#.##.130.95:37215
- 19#.###.98.121:37215
- 41.###.86.213:37215
- 15#.###.61.181:37215
- 41.##.66.107:37215
- 15#.##.159.56:37215
- 15#.###.140.62:37215
- 15#.###.69.103:37215
- 41.##.92.178:37215
- 41.###.57.194:37215
- 15#.##4.66.79:37215
- 15#.###.116.117:37215
- 41.##.155.102:37215
- 41.##.19.166:37215
- 41.###.163.152:37215
- 41.##.53.229:37215
- 41.#.#89.190:37215
- 15#.###.165.90:37215
- 19#.##.104.62:37215
- 41.###.250.21:37215
- 19#.##.41.92:37215
- 15#.##.185.176:37215
- 41.###.209.217:37215
- 15#.##.183.122:37215
- 41.##.137.165:37215
- 41.##.145.68:37215
- 41.##.227.220:37215
- 41.###.21.241:37215
- 19#.##0.79.25:37215
- 19#.##.11.89:37215
- 41.###.230.56:37215
- 15#.##4.245.3:37215
- 19#.###.200.97:37215
- 19#.###.224.115:37215
- 19#.###.99.180:37215
- 41.###.40.4:37215
- 15#.##.199.177:37215
- 41.##.120.31:37215
- 41.##.113.189:37215
- 19#.###.237.129:37215
- 19#.###.112.183:37215
- 15#.##.54.42:37215
- 19#.###.114.75:37215
- 19#.###.202.68:37215
- 41.###.117.238:37215
- 15#.###.128.88:37215
- 41.##.112.199:37215
- 41.###.13.168:37215
- 19#.###.153.162:37215
- 19#.###.145.125:37215
- 19#.##9.72.32:37215
- 19#.###.145.74:37215
- 15#.###.226.227:37215
- 15#.##.35.202:37215
- 41.##.163.211:37215
- 19#.##.41.16:37215
- 15#.###.216.160:37215
- 19#.##.55.173:37215
- 41.###.152.19:37215
- 19#.###.43.193:37215
- 15#.##8.31.4:37215
- 41.###.194.249:37215
- 15#.###.166.196:37215
- 15#.###.100.113:37215
- 41.##.188.40:37215
- 15#.##.170.178:37215
- 15#.##0.41.79:37215
- 15#.###.32.100:37215
- 15#.##.129.84:37215
- 41.###.64.230:37215
- 19#.##.164.14:37215
- 15#.###.56.232:37215
- 41.###.168.149:37215
- 19#.###.229.49:37215
- 41.##.226.68:37215
- 19#.###.107.106:37215
- 15#.###.56.155:37215
- 41.###.51.56:37215
- 19#.##.40.114:37215
- 41.#.#03.252:37215
- 19#.##3.4.98:37215
- 41.###.203.236:37215
- 19#.##.51.201:37215
- 19#.###.252.84:37215
- 19#.##.154.160:37215
- 19#.###.182.248:37215
- 15#.###.144.211:37215
- 41.##.38.102:37215
- 15#.###.87.211:37215
- 41.##.33.64:37215
- 19#.##.228.96:37215
- 19#.###.98.119:37215
- 15#.#.122.152:37215
- 41.###.50.186:37215
- 15#.###.112.70:37215
- 41.###.227.220:37215
- 41.###.112.97:37215
- 19#.###.190.134:37215
- 41.##.207.245:37215
- 19#.###.251.251:37215
- 15#.###.204.211:37215
- 41.###.230.165:37215
- 41.##.113.61:37215
- 41.##.205.140:37215
- 15#.###.47.216:37215
- 19#.###.113.77:37215
- 41.##.38.58:37215
- 19#.##.229.219:37215
- 15#.##.192.51:37215
- 19#.##.8.16:37215
- 15#.##4.56.94:37215
- 15#.##.56.209:37215
- 15#.##.39.145:37215
- 41.###.57.195:37215
- 19#.##0.99.13:37215
- 19#.###.128.89:37215
- 15#.###.207.235:37215
- 41.##.68.244:37215
- 15#.#.59.213:37215
- 15#.###.210.249:37215
- 19#.###.131.97:37215
- 19#.###.26.218:37215
- 19#.##.186.231:37215
- 15#.###.142.223:37215
- 15#.###.132.181:37215
- 41.###.107.36:37215
- 19#.###.221.71:37215
- 15#.##8.237.6:37215
- 15#.###.74.130:37215
- 15#.##.65.129:37215
- 15#.##1.91.4:37215
- 15#.##.108.159:37215
- 41.###.221.109:37215
- 41.###.144.173:37215
- 19#.##.111.225:37215
- 19#.##.57.47:37215
- 19#.###.32.143:37215
- 41.###.156.147:37215
- 41.###.227.164:37215
- 15#.##.93.110:37215
- 41.###.50.180:37215
- 19#.##.126.17:37215
- 19#.##.66.79:37215
- 19#.##.82.231:37215
- 19#.###.243.31:37215
- 41.###.209.44:37215
- 41.##.105.202:37215
- 15#.###.145.218:37215
- 41.##.11.115:37215
- 41.###.231.202:37215
- 41.###.94.147:37215
- 41.###.171.31:37215
- 15#.###.211.67:37215
- 41.##.232.184:37215
- 41.###.171.217:37215
- 19#.##.95.19:37215
- 41.###.118.104:37215
- 41.###.13.132:37215
- 15#.###.120.194:37215
- 15#.###.147.146:37215
- 15#.###.32.188:37215
- 41.###.9.139:37215
- 15#.##.38.37:37215
- 15#.##9.83.31:37215
- 15#.###.138.190:37215
- 41.##.167.20:37215
- 19#.###.138.220:37215
- 15#.#.204.148:37215
- 19#.##.10.78:37215
- 41.##.150.17:37215
- 41.###.14.168:37215
- 15#.###.11.197:37215
- 15#.###.159.209:37215
- 15#.###.119.164:37215
- 15#.##7.12.83:37215
- 19#.###.213.106:37215
- 41.##.219.109:37215
- 41.###.119.82:37215
- 41.###.151.240:37215
- 41.###.165.179:37215
- 15#.###.169.183:37215
- 41.###.112.210:37215
- 19#.##.90.119:37215
- 41.###.183.197:37215
- 19#.###.17.189:37215
- 41.##.60.29:37215
- 15#.##2.15.89:37215
- 15#.##.94.15:37215
- 19#.###.217.89:37215
- 19#.###.172.125:37215
- 41.##.146.53:37215
- 19#.##.137.188:37215
- 41.###.173.6:37215
- 41.###.190.30:37215
- 15#.###.170.138:37215
- 19#.###.162.98:37215
- 19#.###.102.107:37215
- 41.###.193.30:37215
- 19#.###.161.114:37215
- 19#.###.192.235:37215
- 15#.###.82.200:37215
- 15#.##.131.97:37215
- 15#.##.133.36:37215
- 15#.##.42.144:37215
- 15#.##.218.188:37215
- 19#.#.212.56:37215
- 19#.###.239.249:37215
- 19#.##5.15.32:37215
- 15#.##1.52.31:37215
- 41.###.171.112:37215
- 15#.##.228.56:37215
- 19#.##5.31.58:37215
- 15#.#.20.216:37215
- 41.###.220.181:37215
- 19#.##0.58.39:37215
- 41.###.183.21:37215
- 41.###.168.73:37215
- 41.###.74.93:37215
- 15#.###.79.228:37215
- 19#.##.182.104:37215
- 15#.###.97.164:37215
- 41.##.88.183:37215
- 15#.###.173.223:37215
- 19#.##.142.41:37215
- 41.###.253.252:37215
- 19#.###.239.149:37215
- 19#.##.203.205:37215
- 41.##.11.155:37215
- 19#.##.219.143:37215
- 15#.##9.28.78:37215
- 19#.###.211.17:37215
- 41.#.#9.240:37215
- 15#.#.216.39:37215
- 15#.###.161.32:37215
- 41.###.253.154:37215
- 15#.###.63.109:37215
- 19#.##.4.29:37215
- 41.###.90.108:37215
- 41.###.35.49:37215
- 19#.###.115.19:37215
- 19#.###.191.204:37215
- 19#.##.126.213:37215
- 15#.##.213.154:37215
- 19#.###.171.46:37215
- 19#.##.251.168:37215
- 19#.##.133.88:37215
- 19#.#.250.231:37215
- 19#.##.54.181:37215
- 41.##.197.139:37215
- 19#.##.253.158:37215
- 15#.###.96.215:37215
- 15#.##.149.190:37215
- 15#.#.101.177:37215
- 15#.###.229.49:37215
- 15#.###.122.113:37215
- 41.###.115.87:37215
- 19#.###.175.244:37215
- 19#.###.249.46:37215
- 15#.##.142.12:37215
- 15#.###.40.177:37215
- 41.###.107.46:37215
- 19#.#.172.195:37215
- 41.###.144.11:37215
- 41.###.3.242:37215
- 19#.##.76.20:37215
- 19#.###.32.166:37215
- 19#.##3.24.64:37215
- 15#.#.15.239:37215
- 41.##.9.103:37215
- 15#.###.146.119:37215
- 15#.###.103.49:37215
- 15#.###.222.25:37215
- 41.##.60.136:37215
- 15#.##.105.206:37215
- 15#.##.169.183:37215
- 15#.##.129.79:37215
- 19#.###.70.188:37215
- 19#.##.198.171:37215
- 41.##.234.55:37215
- 19#.##9.46.97:37215
- 19#.##.106.120:37215
- 41.##.43.199:37215
- 15#.###.133.247:37215
- 19#.##.219.175:37215
- 41.###.73.206:37215
- 41.###.3.38:37215
- 41.###.3.91:37215
- 15#.##.193.158:37215
- 15#.###.218.251:37215
- 41.###.25.144:37215
- 41.###.75.1:37215
- 41.##.146.103:37215
- 41.##.172.163:37215
- 41.###.21.51:37215
- 19#.##.0.204:37215
- 41.###.138.84:37215
- 19#.###.88.119:37215
- 41.###.130.179:37215
- 41.###.109.221:37215
- 15#.###.95.123:37215
- 15#.###.147.54:37215
- 41.###.223.177:37215
- 15#.##.112.112:37215
- 15#.###.129.75:37215
- 19#.##.36.68:37215
- 41.###.86.61:37215
- 15#.##9.19.13:37215
- 19#.##.35.52:37215
- 19#.###.232.86:37215
- 19#.###.179.86:37215
- 19#.##.14.72:37215
- 41.##.7.209:37215
- 15#.###.249.90:37215
- 41.###.246.133:37215
- 41.##.58.153:37215
- 41.###.143.254:37215
- 15#.##.54.30:37215
- 19#.###.170.82:37215
- 19#.###.206.173:37215
- 15#.##.21.166:37215
- 41.##.104.121:37215
- 41.###.104.35:37215
- 15#.##.138.198:37215
- 41.##.151.15:37215
- 19#.##.94.255:37215
- 41.###.216.171:37215
- 41.###.26.90:37215
- 15#.###.118.64:37215
- 19#.###.240.102:37215
- 41.###.242.115:37215
- 15#.#.106.204:37215
- 19#.##.65.77:37215
- 15#.##2.38.58:37215
- 41.###.91.20:37215
- 19#.###.201.140:37215
- 19#.##.38.123:37215
- 15#.##.206.107:37215
- 15#.##2.38.86:37215
- 41.##.37.255:37215
- 41.###.54.54:37215
- 19#.##.101.15:37215
- 19#.##.99.68:37215
- 41.###.15.160:37215
- 41.###.28.200:37215
- 15#.###.224.67:37215
- 15#.###.244.115:37215
- 41.###.73.4:37215
- 15#.###.38.171:37215
- 15#.##.39.150:37215
- 15#.##.215.249:37215
- 41.##.215.90:37215
- 19#.##2.7.61:37215
- 15#.###.56.229:37215
- 19#.###.186.99:37215
- 19#.##.209.87:37215
- 19#.###.207.73:37215
- 15#.###.239.176:37215
- 15#.###.238.163:37215
- 41.###.130.117:37215
- 41.###.104.152:37215
- 41.###.151.45:37215
- 19#.###.169.253:37215
- 41.##.97.249:37215
- 41.###.151.11:37215
- 15#.###.223.167:37215
- 41.###.75.105:37215
- 15#.###.200.77:37215
- 15#.###.203.92:37215
- 15#.###.116.116:37215
- 41.#.#31.173:37215
- 15#.##.140.200:37215
- 15#.##.207.246:37215
- 19#.###.89.193:37215
- 41.###.51.170:37215
- 19#.##3.5.36:37215
- 19#.##.209.177:37215
- 15#.###.230.207:37215
- 15#.##.234.50:37215
- 41.##.58.242:37215
- 15#.##.102.255:37215
- 41.##.144.123:37215
- 41.##.3.151:37215
- 41.###.245.177:37215
- 19#.##.175.85:37215
- 19#.###.180.164:37215
- 19#.###.43.176:37215
- 41.###.153.136:37215
- 41.###.63.33:37215
- 15#.##.246.157:37215
- 15#.##5.164.9:37215
- 41.###.172.102:37215
- 15#.###.112.96:37215
- 41.###.134.220:37215
- 15#.##.216.41:37215
- 15#.###.165.46:37215
- 15#.###.186.223:37215
- 15#.#.123.188:37215
- 15#.###.229.180:37215
- 41.###.153.132:37215
- 15#.##7.197.0:37215
- 19#.##.15.20:37215
- 19#.###.50.102:37215
- 15#.##.161.172:37215
- 41.###.161.31:37215
- 41.###.1.153:37215
- 15#.###.172.188:37215
- 15#.###.162.42:37215
- 19#.##3.5.28:37215
- 19#.###.252.91:37215
- 15#.###.222.125:37215
- 19#.###.100.22:37215
- 41.###.45.37:37215
- 19#.###.130.183:37215
- 19#.###.131.117:37215
- 41.##.75.161:37215
- 41.###.77.27:37215
- 15#.###.196.180:37215
- 41.###.144.219:37215
- 19#.##.38.227:37215
- 41.###.124.249:37215
- 19#.###.110.167:37215
- 15#.###.220.254:37215
- 15#.##6.103.8:37215
- 15#.###.172.15:37215
- 19#.###.224.124:37215
- 41.###.69.188:37215
- 41.###.118.168:37215
- 19#.##.105.211:37215
- 19#.##.123.67:37215
- 41.###.36.232:37215
- 19#.##.210.14:37215
- 19#.##.85.94:37215
- 41.##.249.194:37215
- 41.###.129.185:37215
- 15#.##.67.231:37215
- 41.###.104.189:37215
- 41.##.135.170:37215
- 15#.###.115.159:37215
- 19#.##8.94.73:37215
- 15#.##.209.229:37215
- 41.##.230.185:37215
- 19#.##.10.128:37215
- 19#.##6.98.97:37215
- 15#.##0.4.81:37215
- 19#.###.200.130:37215
- 19#.##.198.1:37215
- 19#.##.145.222:37215
- 41.###.148.96:37215
- 15#.##.174.205:37215
- 19#.###.237.198:37215
- 15#.##6.94.19:37215
- 19#.##.185.72:37215
- 15#.###.152.106:37215
- 15#.###.188.166:37215
- 15#.##.227.187:37215
- 15#.##0.58.56:37215
- 19#.##.148.39:37215
- 15#.###.215.208:37215
- 19#.##.116.48:37215
- 19#.##5.50.18:37215
- 15#.##.187.163:37215
- 41.###.144.162:37215
- 19#.##.237.108:37215
- 19#.##.34.16:37215
- 15#.###.24.109:37215
- 19#.##.208.14:37215
- 19#.##.61.158:37215
- 41.###.36.206:37215
- 15#.###.191.185:37215
- 19#.###.253.167:37215
- 19#.##.141.28:37215
- 41.##.194.166:37215
- 19#.##.51.147:37215
- 15#.###.113.103:37215
- 41.###.255.247:37215
- 41.##.196.160:37215
- 15#.###.106.98:37215
- 41.##.177.54:37215
- 15#.##4.50.52:37215
- 19#.##.26.26:37215
- 19#.##.208.169:37215
- 19#.###.36.149:37215
- 19#.##.152.159:37215
- 15#.###.253.154:37215
- 15#.##.146.71:37215
- 41.###.32.229:37215
- 15#.###.132.147:37215
- 41.###.49.120:37215
- 41.#.#5.83:37215
- 15#.##.233.145:37215
- 15#.##4.174.0:37215
- 41.#.#5.109:37215
- 19#.##.195.209:37215
- 15#.###.244.141:37215
- 41.###.197.92:37215
- 19#.##.90.116:37215
- 19#.###.176.110:37215
- 19#.##.152.130:37215
- 19#.##.18.63:37215
- 19#.##.140.177:37215
- 41.###.137.167:37215
- 41.##.70.158:37215
- 15#.###.110.221:37215
- 15#.###.211.175:37215
- 15#.##1.20.16:37215
- 41.###.243.41:37215
- 19#.###.41.253:37215
- 15#.##.174.13:37215
- 41.##.116.0:37215
- 19#.##.48.21:37215
- 19#.##.49.105:37215
- 41.###.69.94:37215
- 15#.###.242.12:37215
- 15#.##.57.167:37215
- 15#.###.234.150:37215
- 41.##.16.20:37215
- 41.###.9.42:37215
- 19#.##.84.110:37215
- 15#.##.57.230:37215
- 19#.##.38.79:37215
- 41.###.61.208:37215
- 41.###.33.49:37215
- 19#.##4.31.29:37215
- 15#.##.137.92:37215
- 15#.##.156.107:37215
- 15#.###.184.147:37215
- 19#.###.108.135:37215
- 19#.##.77.82:37215
- 19#.###.146.134:37215
- 41.###.55.187:37215
- 15#.#.207.203:37215
- 15#.###.51.150:37215
- 15#.##.36.213:37215
- 19#.##.112.178:37215
- 15#.##2.96.41:37215
- 41.##.16.212:37215
- 15#.##.224.235:37215
- 15#.##6.32.68:37215
- 41.###.241.88:37215
- 41.##.39.23:37215
- 15#.##5.62.48:37215
- 41.###.188.28:37215
- 15#.###.234.149:37215
- 19#.###.222.153:37215
- 15#.###.217.254:37215
- 19#.##.202.176:37215
- 41.###.8.27:37215
- 19#.###.225.250:37215
- 15#.##.58.236:37215
- 15#.###.164.85:37215
- 41.###.220.29:37215
- 41.###.50.148:37215
- 19#.###.120.165:37215
- 19#.##.133.230:37215
- 15#.###.21.101:37215
- 15#.###.126.68:37215
- 41.##.133.182:37215
- 15#.###.200.53:37215
- 41.###.118.110:37215
- 15#.###.189.174:37215
- 41.###.60.15:37215
- 19#.###.203.132:37215
- 15#.###.102.133:37215
- 19#.###.98.211:37215
- 41.##.99.218:37215
- 19#.##.205.94:37215
- 41.##.162.243:37215
- 15#.##.140.185:37215
- 15#.###.161.225:37215
- 19#.##.168.251:37215
- 15#.###.135.232:37215
- 15#.##.81.1:37215
- 19#.##.17.122:37215
- 41.##.24.203:37215
- 15#.###.213.227:37215
- 19#.###.97.206:37215
- 19#.##2.66.86:37215
- 41.###.182.84:37215
- 15#.##.192.40:37215
- 41.###.94.225:37215
- 19#.##5.20.48:37215
- 15#.##.188.227:37215
- 15#.###.23.118:37215
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
- 19#.##.97.85:9090
Receives data from the following servers:
- 19#.##.97.85:9090
Other:
Collects information about network activity
