Linux.Siggen.2370

Technical Information

Malicious functions:

Launches itself as a daemon

Modifies firewall settings:

iptables -F

Launches processes:

sh -c iptables -F

Performs operations with the file system:

Modifies file access rights:

/bin/systemctl

Creates or modifies files:

/root/hoho.arm
/root/hoho.arm7
/root/hoho.arm6
/root/hoho.arm5
/root/hoho.mips
/root/hoho.mpsl
/root/hoho.arc
/root/hoho.ppc
/root/hoho.i586
/root/hoho.i686
/root/hoho.m68k
/root/hoho.sh4
/root/hoho.spc

Network activity:

Awaits incoming connections on ports:

0.0.0.0:5501
0.0.0.0:35934

Establishes connection:

8.#.8.8:53
1.#.1.1:53
19#.##5.18.28:30047

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

HTTP GET requests:

ic###azip.com/
19#.###.18.28/hoho.arm
19#.###.18.28/hoho.arm7
19#.###.18.28/hoho.arm6
19#.###.18.28/hoho.arm5
19#.###.18.28/hoho.mips
19#.###.18.28/hoho.mpsl
19#.###.18.28/hoho.arc
19#.###.18.28/hoho.ppc
19#.###.18.28/hoho.i586
19#.###.18.28/hoho.i686
19#.###.18.28/hoho.m68k
19#.###.18.28/hoho.sh4
19#.###.18.28/hoho.spc

DNS ASK:

ic###azip.com
sw###hnets.net

Sends data to the following servers:

19#.##5.18.28:30047
84.###.117.131:23
15#.##.98.231:23
18#.##1.65.19:23
20#.##9.206.70:23
14#.##.247.160:23
19#.##6.85.196:23
13#.##.96.101:23
35.###.183.236:23
86.##.96.97:23
11#.##0.170.140:23
16#.##.84.109:23
15#.##.65.217:23
15#.##0.99.207:23
89.###.160.96:23
69.###.18.111:23
39.##.195.103:23
17#.##.201.216:23
72.##.9.195:23
90.###.51.113:23
21#.##2.212.152:23
18#.##.214.112:23
17#.##.150.24:23
13#.##.214.91:23
22#.##1.227.153:23
47.###.72.118:23
62.##8.7.189:23
11#.##9.19.21:23
11#.##.75.245:23
15#.##.244.15:23
25.##9.10.73:23
21#.##.101.249:23
20#.##.195.79:23
94.##1.75.85:23
12#.##3.53.158:23
17#.##3.108.101:23
14#.##7.203.37:23
21#.##1.12.77:23
19#.##7.215.114:23
78.###.81.172:23
10#.#04.0.26:23
18.##.29.0:23
16#.##0.26.49:23
14#.##2.36.188:23
20#.##3.198.184:23
18#.##8.146.16:23
20#.##6.35.226:23
11#.##1.138.48:23
13.###.209.97:23
20#.##3.130.149:23
15#.##5.199.115:23
21#.#9.51.76:23
13#.##7.17.28:23
15#.##0.157.48:23
91.###.65.140:23
69.##.56.187:23
77.###.130.121:23
11#.##.149.38:23
21#.##8.202.103:23
13#.##3.132.243:23
15#.##.233.241:23
16#.##0.103.202:23
11#.##1.110.175:23
17#.##0.187.9:23
21#.##.91.117:23
22#.##.175.45:23
21#.##5.127.109:23
19#.#.27.94:23
19#.#7.23.76:23
22#.##5.15.94:23
92.##.63.148:23
19#.##.211.14:23
11#.##7.224.230:23
21#.##9.194.204:23
13#.##0.13.246:23
14#.##7.167.40:23
10#.##8.151.149:23
14.###.97.104:23
14#.##3.243.239:23
11#.#5.202.0:23
12#.##7.129.215:23
11#.##0.29.98:23
50.##.223.122:23
21#.#4.40.40:23
14#.##8.108.194:23
96.###.155.19:23
64.###.92.222:23
35.###.60.167:23
38.##.196.137:23
19.##7.75.62:23
76.##.114.166:23
79.###.227.24:23
13.##.81.205:23
11#.##0.208.65:23
11#.##9.37.81:23
13#.#0.204.0:23
12#.##9.70.201:23
21#.##6.12.154:23
69.##.130.51:23
14#.##8.177.137:23
12#.##0.219.78:23
22#.##4.219.166:23
16#.##.156.30:23
11#.##.156.65:23
18#.##.251.169:23
12#.##.69.231:23
41.###.114.237:23
75.###.212.28:23
85.##.7.90:23
21#.##2.28.202:23
10#.#60.34.6:23
19#.##4.131.79:23
65.###.182.214:23
86.###.242.209:23
17#.##.204.85:23
21#.##.215.47:23
53.##.27.167:23
10#.##1.51.80:23
13#.#5.64.66:23
49.###.129.251:23
74.###.225.233:23
47.##.125.106:23
47.#.221.195:23
93.##.231.64:23
19#.#.137.210:23
11#.#6.15.32:23
5.###.7.11:23
64.##.91.92:23
19#.##3.169.101:23
59.##.106.30:23
89.##.131.23:23
18#.##0.130.210:23
1.###.197.46:23
97.##3.27.54:23
20#.#4.254.1:23
17#.#4.15.57:23
14#.##.39.190:23
57.###.132.62:23
14#.##4.218.205:23
84.###.228.214:23
21#.##.60.255:23
16#.##9.251.3:23
12#.##0.82.61:23
40.###.212.109:23
11#.##0.183.155:23
10#.##.189.52:23
68.##.169.100:23
36.#.199.133:23
21#.#8.183.0:23
21#.##6.39.219:23
18#.##.210.156:23
12#.##1.156.255:23
15#.##8.94.26:23
80.##.236.117:23
57.###.118.123:23
61.##.184.150:23
17#.##.204.12:23
15#.##.25.140:23
93.###.23.149:23
49.###.253.22:23
14#.##4.72.83:23
78.###.103.151:23
16#.##.107.145:23
84.###.193.110:23
21#.##.247.170:23
15#.##.171.251:23
13#.##4.194.104:23
10#.#.142.119:23
20#.##.80.240:23
16#.##7.120.59:23
13#.##3.72.193:23
69.###.187.41:23
40.###.186.110:23
20#.##2.1.179:23
15#.##2.254.142:23
20#.##3.189.54:23
12#.##.246.57:23
21#.##6.29.88:23
71.###.208.206:23
19.##.213.179:23
18#.##8.109.99:23
11#.##.227.180:23
62.###.63.107:23
20#.##3.180.178:23
22#.##3.36.185:23
14#.##.242.123:23
15#.##0.192.63:23
14#.##.26.118:23
15#.##1.29.246:23
17#.##2.203.180:23
41.##9.16.5:23
16#.##5.189.176:23
22#.##.163.252:23
14#.##9.122.175:23
4.###.90.237:23
51.###.160.193:23
20#.##5.249.123:23
13#.##3.162.108:23
90.##.120.67:23
99.###.149.107:23
57.##.121.198:23
14#.#7.4.134:23
14#.##.160.10:23
13#.##.152.151:23
79.###.196.252:23
14#.##2.142.39:23
8.#.#8.83:23
74.##0.36.2:23
21#.##5.38.207:23
18#.##.166.206:23
11#.##8.45.156:23
53.###.110.132:23
10#.##8.232.250:23
12#.##.150.122:23
22#.##.81.119:23
21#.##1.212.251:23
20#.#.163.195:23
18#.##1.73.54:23
49.###.168.120:23
15#.##1.125.166:23
15#.##2.0.179:23
12#.##5.239.103:23
81.###.141.138:23
92.##2.81.4:23
12#.#3.82.46:23
95.###.113.166:23
22#.##7.51.96:23
13#.##.136.225:23
84.##.128.27:23
15#.##9.99.107:23
20#.##8.101.193:23
32.###.207.182:23
15#.##1.108.197:23
18#.#5.52.87:23
8.##.148.137:23
11#.##.171.109:23
86.###.100.254:23
31.###.50.235:23
8.###.41.186:23
42.###.244.34:23
13#.##1.160.25:23
15#.##2.232.209:23
16#.##0.179.56:23
34.###.123.21:23
18#.##5.72.86:23
20#.##0.83.160:23
80.##9.106.9:23
90.###.173.194:23
99.###.190.248:23
74.##0.82.53:23
20#.##7.138.66:23
42.###.79.160:23
51.##4.7.210:23
65.###.144.198:23
15#.##4.116.102:23
10#.##.153.120:23
8.###.184.203:23
12#.##3.88.148:23
91.#.42.88:23
12#.##9.216.119:23
83.##.64.200:23
18#.##2.128.165:23
16#.#.156.145:23
15#.#.38.24:23
18#.##.246.227:23
18#.##2.156.249:23
19#.##0.171.242:23
53.##.18.45:23
15#.#6.209.9:23
22#.#.79.15:23
21#.##.179.61:23
77.###.188.242:23
57.###.36.175:23
17#.##.105.179:23
17#.##2.217.248:23
18#.##.85.212:23
9.##.238.91:23
17#.#8.4.224:23
84.###.47.174:23
22#.##7.95.46:23
63.###.38.164:23
10#.##4.65.98:23
87.###.176.118:23
14#.##.25.171:23
19#.##.143.212:23
13#.##8.235.77:23
14#.##6.18.134:23
12#.##5.111.6:23
13#.#02.32.9:23
20#.##8.131.196:23
18#.##1.48.106:23
19#.##6.192.9:23
13#.##.11.198:23
24.###.147.250:23
49.##.122.12:23
15#.##.153.121:23
11#.##8.98.63:23
16#.##7.213.249:23
19.##.154.75:23
15#.##9.139.225:23
14#.##6.179.224:23
20#.##2.110.222:23
4.###.115.100:23
46.##.204.216:23
57.###.154.229:23
80.##.108.228:23
46.###.214.151:23
20#.##2.19.19:23
16#.##3.239.57:23
16#.##8.51.174:23
9.###.116.251:23
15#.##3.242.46:23
15#.##6.220.195:23
20#.##5.37.81:23
10#.##6.108.10:23
16#.##9.53.128:23
73.##5.8.159:23
11#.##.220.11:23
11#.##5.172.50:23
77.##.57.229:23
21#.#.9.132:23
59.##.116.19:23
25.###.181.190:23
84.###.174.97:23
40.##5.10.85:23
22#.##1.218.163:23
20#.##3.25.124:23
20#.##4.164.193:23
12#.##8.205.70:23
21#.##2.197.85:23
15#.##0.61.157:23
1.###.72.169:23
12#.##9.159.223:23
50.###.23.237:23
11#.##.67.180:23
40.###.218.122:23
19#.##3.1.135:23
14#.##0.200.217:23
20#.##.251.180:23
73.##.55.103:23
17#.##6.205.200:23
75.##.129.206:23
16#.##.105.124:23
13#.##4.227.167:23
38.##.14.254:23
20#.##9.209.100:23
12#.##.154.95:23
17#.#.186.160:23
34.###.138.113:23
96.##.185.71:23
15#.#.252.225:23
31.##6.73.97:23
10#.##1.55.225:23
16#.##3.25.199:23
21#.##.136.77:23
64.##.146.80:23
17#.##.144.15:23
31.##5.28.58:23
88.###.218.188:23
72.##.110.174:23
16#.##2.17.210:23
19#.##8.246.234:23
14#.##.147.167:23
11#.##9.165.51:23
12#.##5.68.230:23
21#.##.170.73:23
12#.#3.72.32:23
19#.##.252.14:23
16#.#.95.49:23
45.###.101.72:23
18#.##0.253.55:23
90.###.75.230:23
20#.##.98.247:23
19#.##.237.221:23
94.##.53.201:23
17#.##7.193.155:23
15#.##.30.228:23
16#.##8.23.223:23
19.##.45.139:23
10#.##6.139.81:23
83.##.35.186:23
11#.#3.72.65:23
94.###.237.30:23
8.###.136.163:23
16#.##.167.177:23
21#.#0.40.54:23
18#.##3.140.143:23
92.##.227.89:23
10#.##.155.91:23
13#.##.232.237:23
74.##.215.204:23
19.###.135.223:23
18#.##2.49.205:23
17#.##3.92.100:23
19#.##2.106.67:23
21#.##2.150.75:23
12#.##1.111.34:23
10#.##5.182.165:23
13#.##8.140.111:23
76.###.39.229:23
13#.#.170.249:23
74.###.119.231:23
20#.##.136.234:23
20.###.81.157:23
19#.##.201.123:23
93.##7.43.32:23
10#.##8.135.254:23
20#.##.229.230:23
86.##.176.202:23
15#.##.225.11:23
61.###.199.23:23
94.##.211.242:23
12#.##8.14.187:23
69.##.48.193:23
18#.##2.127.1:23
14#.##6.216.122:23
19#.##.253.185:23
48.##.162.168:23
89.##.176.224:23
13.###.143.159:23
13#.##4.25.47:23
12#.##7.65.209:23
18#.##1.29.168:23
16#.##7.124.15:23
84.###.187.89:23
18#.##.57.178:23
17#.##0.118.15:23
24.###.122.124:23
16#.##5.80.34:23
11#.#00.9.33:23
17#.#2.62.88:23
98.##.176.88:23
22#.##1.36.170:23
18#.##.96.213:23
63.##.54.217:23
74.###.133.195:23
45.###.169.73:23
81.##.34.204:23
21#.##.240.43:23
14#.#2.104.0:23
12#.##5.13.170:23
15#.##.115.10:23
27.##.9.156:23
16#.##.109.57:23
8.###.78.199:23
19.##3.10.54:23
16#.##0.54.144:23
63.##5.0.96:23
12.##.50.38:23
94.###.81.158:23
87.###.171.232:23
19#.##9.160.244:23
42.###.122.167:23
5.##.219.248:23
20#.##.22.178:23
12#.##.126.183:23
5.###.192.28:23
11#.##5.187.170:23
49.##.173.194:23
16#.##4.8.145:23
70.##.22.28:23
16#.##4.35.199:23
16#.##0.57.10:23
58.###.112.167:23
13#.##3.45.198:23
11#.##5.211.206:23
21#.##6.147.160:23
27.##.182.232:23
13#.#.223.241:23
19#.##5.69.113:23
15#.##.200.159:23
16#.##2.233.0:23
13#.##.223.175:23
11#.##5.157.65:23
22#.#62.1.13:23
65.##4.158.5:23
20#.##.245.245:23
59.##.166.14:23
60.#.146.180:23
12#.##.62.172:23
12.##6.26.16:23
94.##3.25.39:23
16#.##.155.56:23
10#.##2.60.169:23
47.##.192.167:23
13#.##1.83.29:23
42.###.80.144:23
70.###.162.112:23
11#.##7.173.39:23
14#.##7.114.236:23
62.###.33.197:23
83.##.182.75:23
18#.#9.6.220:23
12#.##.57.152:23
71.###.202.212:23
14#.#7.14.27:23
21#.##5.31.70:23
73.###.175.252:23
20#.##.110.53:23
54.#.167.28:23
16#.##.185.225:23
16#.##3.204.201:23
18#.##8.100.172:23
16#.##.137.218:23
11#.##5.241.87:23
95.###.184.135:23
9.###.142.74:23
57.#.5.174:23
86.##.59.252:23
15#.##.185.122:23
67.##.134.44:23
9.###.60.140:23
11#.##.204.205:23
16#.##.176.33:23
63.###.208.232:23
51.###.162.33:23
20#.##5.134.218:23
38.#.246.208:23
14#.##5.42.142:23
15#.#62.1.15:23
51.###.149.84:23
16#.#.139.74:23
19#.##.52.250:23
16#.##1.173.67:23
18#.##0.33.67:23
12#.##4.175.180:23
19#.#2.66.60:23
16#.##.10.104:23
31.##.31.69:23
10#.##8.111.213:23
12#.##.68.194:23
17#.##6.111.223:23
15#.##5.132.189:23
98.###.193.63:23
11#.#2.188.4:23
19#.##.190.143:23
1.##.206.88:23
12#.##5.25.34:23
11#.#1.63.28:23
91.##6.52.9:23
86.###.242.48:23
78.###.35.157:23
11#.##2.171.30:23
66.###.147.155:23
11#.##8.166.213:23
18#.##4.87.198:23
18#.##.192.111:23
72.##1.46.24:23
15#.##.152.77:23
17#.##5.4.200:23
20#.##4.3.175:23
14#.##.227.14:23
78.##.133.129:23
15#.##.77.105:23
18#.##5.189.56:23
16#.##1.15.14:23
17#.##.127.75:23
1.###.15.37:23
11#.##2.249.2:23
12.###.77.167:23
20#.##0.68.237:23
78.###.153.155:23
14#.##2.178.124:23
68.##.44.93:23
18#.##8.8.213:23
38.###.187.126:23
53.###.136.221:23
25.###.24.108:23
68.##.232.39:23
13#.##.12.193:23
21#.##3.181.30:23
16#.##8.219.168:23
94.##.101.115:23
13#.##9.179.192:23
15#.#50.0.46:23
97.###.140.12:23
32.###.202.63:23
20#.##8.203.255:23
19#.##9.139.34:23
21#.##6.144.182:23
67.###.83.161:23
18#.##.159.153:23
10#.##4.91.37:23
18#.##8.131.251:23
13#.##8.162.30:23
18#.##3.184.195:23
57.##.30.130:23
77.###.143.183:23
5.##.244.187:23
18#.##5.238.244:23
15#.##.230.167:23
16#.##9.112.34:23
36.###.255.72:23
8.##.18.242:23
19#.##4.18.12:23
18#.#.246.192:23
42.###.250.205:23
18#.##1.95.232:23
11#.##.68.148:23
15#.##1.237.124:23
17#.##4.238.72:23
94.###.45.249:23
70.##3.99.5:23

Receives data from the following servers:

19#.##5.18.28:30047

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations