Linux.Siggen.2176

Technical Information

Malicious functions:

Removes itself

Launches itself as a daemon

Substitutes application name for:

p4x0pIV4nVuEMBYx0BRV2MimeEDYDezBZzGuMBVeZRzZpDBDpIBWRGi0MRp4m40pIp2Ezm

Kills system processes:

sshd

Kills the following processes:

exim4
<SAMPLE>

Network activity:

Establishes connection:

8.#.8.8:53
15#.##.181.108:63042

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

DNS ASK:

lo###ngxd.xyz

Sends data to the following servers:

15#.##.181.108:63042
13#.##.185.144:23
46.##.154.16:23
18#.##7.185.207:23
16#.##8.85.231:23
74.##0.17.55:23
53.##.228.198:23
27.##6.21.83:23
69.###.62.178:23
16#.#2.13.24:23
5.###.192.239:23
21#.#.5.204:23
10#.#1.151.9:23
15#.##.236.122:23
10#.##.233.39:23
23.##.184.134:23
13#.#43.1.0:23
11#.##1.172.210:23
11#.##.143.209:23
10#.##9.93.109:23
12#.##6.238.92:23
15#.##8.139.205:23
20#.##4.109.238:23
16#.##.142.13:23
13#.##0.250.198:23
25.##7.44.12:23
14#.##0.161.182:23
18#.##0.104.120:23
71.###.123.74:23
20#.##3.134.74:23
11#.##.123.176:23
17.###.184.60:23
89.##.236.14:23
19#.##.82.145:23
8.###.96.109:23
11#.##8.241.170:23
11#.##.66.120:23
44.##8.63.28:23
90.##6.56.66:23
60.##7.70.64:23
98.#.184.48:23
18#.##.62.189:23
20#.#6.14.86:23
84.###.36.252:23
19#.#7.61.83:23
14#.##0.95.199:23
22#.##1.174.3:23
86.###.250.42:23
17.###.218.152:23
13#.##6.197.44:23
58.##.117.232:23
16#.##2.182.83:23
49.###.150.159:23
10#.##4.18.30:23
94.###.255.225:23
15#.##2.60.112:23
58.##.224.83:23
50.##7.4.153:23
17#.#.226.127:23
19#.#.137.183:23
31.##.81.127:23
11#.#6.47.89:23
14#.##3.14.42:23
13#.##.108.168:23
18#.##9.246.128:23
15#.##.205.214:23
13#.##3.167.98:23
21#.##.28.160:23
10#.##.79.124:23
13.###.174.190:23
21#.##6.199.81:23
14#.##7.113.189:23
13#.##1.71.166:23
21#.##.198.222:23
20#.##6.23.224:23
11#.##.231.254:23
25.##.102.225:23
54.###.54.213:23
12#.##9.215.250:23
13#.##7.56.248:23
68.##.151.246:23
18#.##6.14.238:23
11#.##.208.44:23
61.##.32.150:23
62.###.182.144:23
14#.##2.108.8:23
13#.##0.72.94:23
19#.##9.93.137:23
13#.#5.66.50:23
12#.##1.33.19:23
19#.##4.147.1:23
88.##1.96.3:23
14#.##.173.35:23
95.##.81.27:23
75.###.129.152:23
18#.##.214.228:23
13#.##7.162.44:23
12#.##5.207.233:23
10#.##3.130.149:23
20#.##.197.50:23
21#.##4.215.160:23
20#.##3.13.39:23
11#.##4.107.108:23
58.##.55.199:23
18.##.92.105:23
38.##0.11.60:23
19#.##6.111.129:23
73.###.241.49:23
12#.##8.198.15:23
8.##.134.89:23
14#.##8.31.136:23
20#.##6.70.121:23
10#.##0.230.16:23
19#.#41.57.5:23
19#.##4.6.135:23
12#.##5.92.203:23
19#.##4.92.90:23
32.###.76.234:23
14#.##.59.107:23
15#.#6.4.33:23
98.###.115.185:23
17#.##7.97.110:23
16#.##.12.122:23
13#.##8.113.241:23
12#.##4.6.199:23
10#.##6.35.82:23
74.###.41.152:23
34.###.25.167:23
69.##.12.197:23
41.##.1.209:23
32.##.106.98:23
20#.##7.71.165:23
85.###.246.73:23
13#.##.95.208:23
22#.##7.84.208:23
12#.##8.62.167:23
19#.##4.111.149:23
11#.##4.58.225:23
19.##.181.255:23
11#.##6.135.56:23
99.###.104.237:23
18#.##2.205.41:23
13#.##.204.107:23
20#.##8.184.87:23
13.##.9.157:23
13.##.139.3:23
95.##.28.84:23
18#.##5.33.59:23
19#.##0.246.198:23
67.##.236.196:23
76.###.194.144:23
19#.##.30.201:23
83.##.28.176:23
15#.##.71.179:23
79.###.137.11:23
18#.##5.93.64:23
13#.##.231.88:23
17#.##.241.51:23
20#.##8.23.254:23
88.##.47.163:23
41.###.52.171:23
12.###.193.47:23
20#.#.40.116:23
52.##.32.19:23
17#.#7.75.85:23
18#.#.195.14:23
18#.##4.19.84:23
52.###.175.154:23
17#.##4.222.142:23
52.###.39.243:23
95.###.10.247:23
82.###.132.20:23
12.###.11.138:23
10#.#6.99.29:23
20#.##7.9.237:23
93.##.127.134:23
17#.##0.227.224:23
22#.##7.54.161:23
10#.##.132.98:23
14#.##5.75.255:23
85.###.227.215:23
19#.##.190.233:23
44.##.229.116:23
46.###.193.34:23
96.##.248.135:23
16#.#3.50.16:23
15#.##5.251.90:23
84.###.239.91:23
1.##.49.127:23
15#.##9.100.82:23
16#.##.176.177:23
23.###.237.183:23
62.###.111.52:23
21#.##8.164.174:23
97.###.204.170:23
74.##.70.11:23
65.###.23.239:23
17.###.135.169:23
18#.##4.198.19:23
16#.##.134.78:23
10#.##.94.252:23
10#.##8.164.90:23
11#.#6.4.58:23
17#.##8.190.125:23
43.###.171.53:23
20#.#15.4.64:23
10#.##.232.218:23
42.###.46.251:23
69.###.191.77:23
96.###.127.229:23
13#.##5.24.127:23
73.##.184.192:23
13#.##4.166.124:23
14#.##4.112.35:23
94.##.206.176:23
88.##.136.47:23
10#.##2.198.233:23
20#.##2.201.232:23
25.###.175.142:23
13#.##.198.49:23
62.###.166.168:23
63.###.164.60:23
59.###.179.224:23
93.###.15.118:23
11#.##.181.113:23
19#.##5.101.155:23
82.##.241.47:23
14#.##.208.140:23
44.###.77.182:23
19#.##9.11.43:23
17.##.15.124:23
18#.##.214.90:23
21#.##9.238.244:23
51.###.123.29:23
31.##.247.148:23
47.##.136.124:23
21#.##3.33.108:23
20#.##7.54.239:23
11#.#2.44.16:23
71.###.89.136:23
21#.##.128.25:23
40.###.129.230:23
1.#.#28.239:23
11#.##.66.240:23
44.###.161.65:23
16#.##2.28.195:23
25.###.175.254:23
89.###.249.32:23
22#.##.164.183:23
78.##.89.19:23
42.##.166.54:23
71.###.46.111:23
10#.##.135.91:23
21#.#1.76.51:23
67.###.166.237:23
19#.##2.125.252:23
49.###.167.122:23
15#.##5.246.140:23
12#.##7.242.48:23
93.###.106.31:23
2.##.193.210:23
18#.##9.22.125:23
27.#.183.8:23
15#.##.228.13:23
13#.##3.168.1:23
75.##.140.168:23
11#.#.155.189:23
21#.##.33.225:23
2.###.153.224:23
14#.##2.171.143:23
17#.#42.25.5:23
13#.##8.29.144:23
10#.##.250.93:23
20#.##5.201.73:23
18#.#37.7.80:23
21#.##1.220.180:23
25.###.159.23:23
20.###.241.59:23
19#.##4.53.125:23
16#.##1.202.182:23
14#.##.213.112:23
57.##.148.62:23
20.###.205.255:23
87.##.126.114:23
17#.##2.79.50:23
18#.##5.135.85:23
69.##.1.37:23
50.###.53.221:23
12#.##9.219.154:23
13#.#36.8.80:23
12#.#0.5.23:23
97.###.233.117:23
76.###.109.129:23
20#.##2.156.184:23
17#.##.238.149:23
78.###.198.221:23
18#.##.163.60:23
17#.##8.5.207:23
12#.##0.16.18:23
22#.##2.98.10:23
14#.##3.135.113:23
54.###.192.97:23
11#.#1.34.36:23
16#.##9.148.167:23
57.##.243.144:23
27.##.67.93:23
59.###.137.83:23
43.###.187.203:23
16#.##1.52.152:23
61.##.77.232:23
37.###.110.26:23
20#.##6.67.176:23
10#.##1.245.38:23
21#.##3.15.109:23
10#.##1.194.30:23
14#.##.180.93:23
17#.##8.205.228:23
87.###.67.232:23
53.##3.0.144:23
96.##.78.199:23
13#.##4.128.87:23
12#.##.133.157:23
67.##.175.104:23
47.##.98.220:23
17#.##.220.175:23
80.##1.81.76:23
13#.#37.6.51:23
64.###.73.136:23
13#.##.217.122:23
8.###.216.249:23
66.###.89.144:23
10#.##2.238.160:23
61.###.40.238:23
93.##4.251.5:23
63.###.43.105:23
16#.##5.69.96:23
10#.##6.210.106:23
15#.##.11.217:23
72.###.113.206:23
19#.##5.71.71:23
25.##.92.165:23
90.###.129.60:23
21#.##.192.162:23
14#.##3.120.179:23
15#.##8.108.214:23
11#.##.166.27:23
73.###.86.103:23
21#.##.190.120:23
15#.##6.105.4:23
9.###.202.44:23
45.##.232.245:23
42.###.198.130:23
80.###.104.68:23
18#.#1.39.26:23
94.##3.39.38:23
76.##7.15.0:23
35.###.13.175:23
10#.##.166.140:23
71.##.132.162:23
10#.##9.92.157:23
87.###.247.62:23
18.##.195.217:23
12#.##9.52.166:23
13#.##1.254.144:23
18#.##2.252.234:23
24.###.239.183:23
13#.#.24.221:23
16#.##8.143.148:23
65.###.221.47:23
16#.#1.60.78:23
89.##9.82.81:23
10#.#23.6.76:23
13#.##1.142.14:23
67.##6.8.185:23
89.###.242.149:23
20#.##3.32.215:23
21#.##2.172.114:23
79.###.130.42:23
16#.#.243.38:23
18#.##5.87.212:23
12#.##7.28.85:23
16#.##.114.15:23
15#.#5.40.4:23
11#.##6.13.66:23
14.##.65.27:23
14#.##3.170.133:23
16#.##3.114.198:23
43.###.19.242:23
14#.#.73.193:23
14#.##7.208.168:23
16#.##9.98.227:23
12#.##3.24.183:23
4.###.205.64:23
76.###.116.146:23
47.###.224.71:23
16#.#1.97.61:23
15#.##2.155.108:23
16#.##1.206.138:23
10#.##8.229.201:23
14#.##.198.34:23
44.###.119.249:23
16#.##.198.251:23
92.###.205.26:23
18#.##.102.155:23
8.###.119.18:23
11#.##7.55.215:23
14#.##.36.225:23
18#.##.99.138:23
19#.##1.62.189:23
20#.##.139.83:23
91.###.203.13:23
96.#.52.54:23
21#.##2.130.54:23
17#.##3.107.137:23
96.##.157.202:23
85.##.7.149:23
12#.##4.140.224:23
95.###.175.250:23
14#.#14.80.5:23
20#.##.224.40:23
4.##.205.246:23
20#.##.54.224:23
39.##.32.112:23
92.##6.6.228:23
97.#.41.43:23
83.##.13.229:23
17.##.77.230:23
79.###.131.107:23
61.##.144.101:23
20#.##0.93.250:23
22#.##4.196.138:23
17#.##6.50.27:23
18#.##5.120.10:23
14#.##7.230.203:23
19#.##2.118.134:23
17#.##4.244.194:23
48.##.104.109:23
13.##.36.150:23
21#.##6.53.118:23
97.###.109.107:23
13#.##.108.130:23
14#.##3.119.183:23
78.##.223.48:23
18#.##.159.204:23
57.##.154.161:23
38.###.134.190:23
41.##8.20.85:23
16#.##.142.236:23
19#.##.104.199:23
79.###.250.215:23
22#.##2.42.189:23
21#.#8.4.211:23
94.##.43.217:23
71.##.229.62:23
46.##.38.111:23
11#.##8.240.23:23
11#.##4.31.155:23
10#.##.114.237:23
11#.##.81.102:23
36.##.240.37:23
60.#.97.71:23
16#.##.226.202:23
94.##.71.231:23
14#.##.143.35:23
21#.##8.147.245:23
12#.##2.39.193:23
64.###.108.71:23
16#.#.96.192:23
9.###.5.217:23
70.###.166.125:23
52.##.141.31:23
12.###.144.12:23
12#.##2.36.84:23
14#.##.102.179:23
15#.##1.10.130:23
71.#.227.15:23
10#.##6.70.237:23
15#.##7.42.100:23

Receives data from the following servers:

15#.##.181.108:63042

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations