Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- sshd
Modifies firewall settings:
- iptables -I INPUT -p tcp --destination-port 38123 -j ACCEPT
- iptables -I OUTPUT -p tcp --source-port 38123 -j ACCEPT
- iptables -I PREROUTING -t nat -p tcp --destination-port 38123 -j ACCEPT
Launches processes:
- sh -c killall -9 telnetd utelnetd scfgmgr
- sh -c iptables -I INPUT -p tcp --destination-port 38123 -j ACCEPT
- sh -c iptables -I OUTPUT -p tcp --source-port 38123 -j ACCEPT
- sh -c iptables -I PREROUTING -t nat -p tcp --destination-port 38123 -j ACCEPT
Attempts to kill the following processes:
- killall -9 telnetd utelnetd scfgmgr
Performs operations with the file system:
Creates or modifies files:
- /root/.ips
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:14737
- 0.0.0.0:33445
- 0.0.0.0:38123
Establishes connection:
- 8.#.8.8:53
- 21#.##.12.76:8080
- 19#.##8.218.34:8443
- 61.##.195.43:80
- 13#.##.142.4:8080
- 19#.##.173.142:80
- 87.###.189.15:52869
- 14#.###.62.135:52869
- 14#.##5.190.68:8080
- 37.###.172.73:52869
- 20#.##4.212.30:7574
- 23.##.227.13:8443
- 21.##.231.188:8443
- 14#.##2.15.217:80
- 97.###.46.208:80
- 11#.##6.17.63:80
- 54.##.108.75:80
- 18#.##4.237.34:80
- 19#.##4.172.84:5555
- 37.###.60.7:8080
- 25.###.35.27:8080
- 16#.###.237.123:52869
- 19#.##6.72.62:49152
- 74.###.200.230:80
- 17#.##.179.100:5555
- 12#.##0.143.53:8080
- 21#.##3.166.2:5555
- 56.##.40.89:37215
- 48.##.112.187:37215
- 20#.##.55.252:8080
- 13#.##.238.182:8443
- 63.###.118.17:52869
- 50.###.86.28:8080
- 22#.#3.61.27:80
- 95.##.211.249:81
- 26.###.237.182:7574
- 59.##.151.88:8080
- 87.###.105.237:8080
- 44.###.243.214:7574
- 11#.#0.51.96:80
- 57.###.222.37:8080
- 17.###.8.245:52869
- 87.###.50.215:37215
- 53.#.50.0:49152
- 16#.###.211.34:52869
- 41.###.116.245:8080
- 13#.#.171.125:5555
- 12#.###.140.210:8080
- 14#.###.248.225:8080
- 15#.##2.187.215:81
- 76.###.128.76:7574
- 15#.###.164.151:8080
- 15#.##9.129.52:8443
- 13#.###.134.35:49152
- 35.##.6.178:81
- 13.##.79.181:80
- 19#.##.19.254:52869
- 20#.##.229.28:80
- 19#.##2.176.223:80
- 48.###.244.52:8080
- 11#.##6.68.99:8443
- 19#.##1.110.44:80
- 11#.##9.92.126:8080
- 54.##8.4.98:80
- 7.###.147.232:80
- 53.###.56.92:5555
- 72.##.213.238:49152
- 16#.##.229.156:80
- 19#.##0.33.59:8080
- 4.###.163.222:80
- 83.###.209.225:37215
- 16#.#.242.146:80
- 21#.##2.32.73:80
- 18#.##8.20.2:8080
- 69.###.114.49:8080
- 12#.##1.47.243:8080
- 14#.##.61.123:5555
- 54.##.233.153:80
- 17#.###.71.239:49152
- 19#.###.155.45:49152
- 86.##.34.96:80
- 3.###.82.82:80
- 66.###.69.238:81
- 75.###.142.115:80
- 68.###.199.28:49152
- 37.##.146.72:8080
- 34.###.111.54:8080
- 19#.###.198.22:37215
- 16#.##4.166.94:8080
- 14#.#.125.10:5555
- 16#.##7.25.121:5555
- 19#.##4.187.38:80
- 83.###.32.139:8080
- 19#.##2.20.188:8080
- 35.###.156.110:52869
- 2.###.129.122:81
- 47.###.129.86:37215
- 19#.##8.163.161:80
- 92.###.145.185:7574
- 16#.##7.77.110:80
- 18#.###.197.171:37215
- 23.##.78.188:52869
- 13#.###.158.138:5555
- 39.##.225.206:80
- 86.###.35.233:8080
- 19#.##4.149.6:81
- 50.###.120.131:80
- 34.#.#61.54:49152
- 17#.##.51.205:81
- 19#.##7.175.59:7574
- 85.###.132.61:5555
- 11#.##.148.111:8080
- 12#.##6.63.29:80
- 80.###.162.41:37215
- 73.##.252.161:80
- 20#.#64.7.44:81
- 14#.##7.146.239:80
- 83.##.112.228:5555
- 76.##.62.89:49152
- 1.###.170.23:52869
- 13#.##8.76.63:49152
- 60.###.8.195:7574
- 70.##.149.105:49152
- 10#.##4.208.136:81
- 18.##.67.55:80
- 20.###.190.168:49152
- 45.###.150.229:80
- 18#.#2.37.25:80
- 18#.###.198.146:37215
- 15#.##1.228.113:80
- 11#.##.121.63:80
- 16#.##9.176.156:81
- 14.##.12.237:7574
- 53.##3.92.42:80
- 79.###.73.26:52869
- 12#.###.153.143:5555
- 10#.###.28.124:52869
- 20#.##.165.136:52869
- 41.###.209.241:80
- 4.###.242.207:5555
- 12#.##5.39.159:80
- 11#.##8.224.96:8443
- 79.##.107.60:8080
- 11#.##3.33.250:81
- 12#.##1.86.46:81
- 21#.##.139.144:52869
- 39.###.128.16:49152
- 23.###.152.81:8080
- 89.##.177.158:81
- 18#.##.117.165:37215
- 16#.##.194.60:37215
- 17#.##.238.196:52869
- 11#.#.95.223:49152
- 38.###.186.51:80
- 39.##.29.56:8443
- 10#.###.147.116:49152
- 20#.##7.73.79:37215
- 71.###.243.161:80
- 18#.##.165.229:8080
- 16#.###.97.234:37215
- 18#.##0.234.126:80
- 45.##.98.254:80
- 19#.###.239.222:8080
- 20#.##0.134.81:7574
- 15#.##.74.206:49152
- 10#.##9.115.7:8080
- 61.##.152.172:37215
- 22.##.127.97:8443
- 15#.##1.21.98:8080
- 21.###.238.242:52869
- 26.###.215.108:8080
- 74.##.94.219:80
- 70.###.5.133:49152
- 12#.##9.0.143:8443
- 13#.##1.55.26:5555
- 3.###.146.31:8080
- 47.###.225.252:49152
- 16#.##.72.190:81
- 59.##.64.235:80
- 50.###.130.72:80
- 19#.##.78.240:8080
- 17#.##.174.103:8443
- 18#.##7.142.139:80
- 21#.##.47.109:80
- 22#.##.94.20:8080
- 17#.###.137.138:37215
- 20#.###.147.54:37215
- 3.###.106.228:5555
- 10#.##2.39.117:80
- 66.##7.142.5:80
- 16#.##1.145.59:5555
- 2.###.46.135:37215
- 11#.###.231.149:7574
- 21#.##7.100.35:80
- 13#.##6.205.7:80
- 56.###.153.176:52869
- 20.##.242.248:7574
- 20#.##1.110.105:80
- 13#.###.187.133:52869
- 50.###.96.209:5555
- 21#.##6.104.29:8443
- 18#.##0.141.156:80
- 31.#.98.25:8080
- 29.##.135.6:52869
- 21#.##6.229.33:7574
- 80.###.107.21:49152
- 10#.##.59.164:7574
- 16#.#.72.41:81
- 11#.##7.75.102:8443
- 16#.##.128.199:8443
- 15#.###.224.140:5555
- 19#.##3.40.244:7574
- 19#.###.125.254:5555
- 11#.##2.122.3:52869
- 64.###.14.231:81
- 52.##.208.184:8080
- 75.##.129.208:8080
- 59.##.90.75:8080
- 20#.##3.44.92:7574
- 65.###.13.206:80
- 12#.##.253.121:8443
- 10#.##4.99.216:7574
- 11#.###.35.253:52869
- 20#.##.78.188:49152
- 50.###.31.118:37215
- 81.###.253.169:80
- 48.##.206.223:80
- 97.##.184.234:80
- 66.###.105.149:37215
- 14#.##.243.247:8080
- 19#.###.133.89:52869
- 10#.##.8.250:5555
- 43.###.55.207:80
- 21#.##9.149.88:80
- 96.###.232.219:81
- 13#.###.187.137:8080
- 55.##.139.236:80
- 17#.##8.95.49:80
- 74.###.154.37:8080
- 18#.##8.162.24:8080
- 14#.##.205.16:7574
- 10#.##8.178.0:49152
- 14#.##3.81.240:80
- 11#.##8.150.37:8080
- 30.###.228.121:81
- 20.###.85.81:7574
- 11#.##9.65.238:81
- 17#.##.101.182:80
- 15#.##.246.73:5555
- 41.##.144.56:8080
- 12#.##6.92.40:80
- 89.##9.146.2:80
- 72.###.207.61:8080
- 18#.##2.139.219:81
- 79.###.115.89:7574
- 17#.##1.169.3:8080
- 8.###.65.146:8080
- 21#.##6.214.138:80
- 84.###.241.125:5555
- 18#.##.163.197:37215
- 17#.###.107.124:37215
- 56.###.149.84:37215
- 13#.##2.218.6:7574
- 16#.##6.216.3:8080
- 13#.#0.60.71:80
- 14#.##.65.16:8443
- 12#.##8.241.69:7574
- 14#.###.131.171:8080
- 66.###.86.234:52869
- 21#.##.105.204:7574
- 16#.#.44.57:37215
- 36.###.205.5:7574
- 83.##.218.166:8080
- 20#.##.179.113:8080
- 21#.##0.174.160:80
- 30.###.12.225:8080
- 26.##.115.58:80
- 44.###.149.171:5555
- 13.###.51.155:8080
- 22#.##8.243.241:80
- 20.###.50.195:8080
- 86.##.48.78:80
- 81.##.185.222:8080
- 21#.###.105.173:8080
- 49.###.91.184:7574
- 49.###.21.116:7574
- 18#.###.134.131:8080
- 12#.##2.66.227:81
- 19#.###.35.138:49152
- 18#.##7.84.14:8080
- 44.##.227.209:49152
- 21#.##6.12.55:5555
- 11#.##.243.98:8080
- 1.##.#3.205:7574
- 14#.##.97.188:52869
- 45.##.220.161:8080
- 29.##.214.56:8080
- 12#.#7.85.8:81
- 14#.##.232.208:80
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
HTTP POST requests:
- 127.0.0.1:80/GponForm/diag_Form?images/
Sends data to the following servers:
- 23#.###.255.250:1900
- 38.##.208.110:1023
- 18#.##.207.98:2323
- 62.###.44.170:2323
- 17#.##6.35.109:2323
- 18#.##.206.23:2323
- 79.#.#7.213:2323
- 67.###.196.215:2323
- 46.###.231.204:2323
- <LOCAL_GATE>73:2323
- 12#.##.141.142:2323
- 14#.##.158.31:2323
- 11#.##.173.163:2323
- 17#.##.232.200:2323
- 8.###.175.178:1023
- 89.###.162.37:2323
- 16#.#.27.248:2323
- 53.###.167.61:2323
- 54.##.110.110:1023
- 14.###.146.211:2323
- 10#.##.61.211:2323
- 10#.##3.40.124:2323
- 23.###.76.83:2323
- 21#.###.100.170:2323
- 16#.##.105.190:2323
- 17#.##.89.125:2323
- 15#.###.186.188:2323
- 10#.##6.6.122:2323
- 91.###.215.80:2323
- 22#.##5.134.39:2323
- 17#.##0.14.203:2323
- 8.###.50.102:1023
- 81.###.127.183:2323
- 16#.##6.105.5:2323
- 18#.##.158.25:2323
- 18#.##.78.153:1023
- 16#.##.9.142:2323
- 17#.###.182.240:2323
- 21#.##.216.3:2323
- <LOCAL_GATE>95:2323
- 63.##.109.207:2323
- 21#.##.83.192:2323
- 20#.###.139.173:2323
- 32.##.50.129:2323
- 12#.##3.33.183:2323
- 21#.##0.39.50:2323
- 95.##.103.227:2323
- 99.###.219.239:2323
- 82.#.#67.156:1023
- 78.###.99.17:2323
- 17#.##1.101.79:2323
- 38.#.#30.122:2323
- 12#.###.195.250:1023
- 18#.##7.89.91:2323
- 76.##.100.71:2323
- 5.##.#12.191:2323
- 90.###.79.239:2323
- 74.###.98.211:2323
- 91.##.65.162:2323
- 12.##.198.113:2323
- 78.###.173.76:2323
- 19#.###.148.180:2323
- 15#.##7.18.78:2323
- 10#.##9.184.84:2323
- 89.##.208.137:2323
- 20#.#.21.195:1023
- 84.###.6.68:2323
- 19.##.251.247:2323
- 10#.##.11.235:2323
- 39.##.162.151:1023
- 17#.##1.173.234:23
- 13#.##7.177.59:23
- 15#.##2.96.101:2323
- 16#.##4.210.164:23
- 11#.##7.17.144:23
- 18#.##.201.183:2323
- 10#.##.161.16:23
- 17#.##.204.52:23
- 15#.##7.30.131:2323
- 21#.##9.122.155:23
- 20#.##7.239.194:23
- 19#.##.245.170:2323
- 19#.##.90.179:23
- 15#.##7.35.26:23
- 14#.##6.15.97:2323
- 16#.##8.178.91:23
- 21#.##0.105.138:23
- 12#.##.150.115:2323
- 13.###.140.202:23
- 20#.##0.27.102:23
- 48.###.118.253:2323
- 10#.##.58.176:23
- 98.##1.6.34:23
- 18#.###.200.143:2323
- 71.##.160.197:23
- 10#.##.253.180:23
- 94.###.36.243:2323
- 15#.##6.230.86:23
- 18#.##1.154.154:23
- 57.###.231.94:2323
- 12#.##.72.248:23
- 19#.##9.23.148:23
- 11#.##.168.214:2323
- 81.##.113.163:23
- 17#.##1.91.111:23
- 5.##.#05.152:2323
- 20#.##.213.54:1023
- 12#.##1.251.3:23
- 20#.##0.108.27:2323
- 44.##6.31.23:23
- 68.##.220.155:23
- 68.#.#3.194:2323
- 14#.##3.160.215:23
- 16#.##0.207.158:23
- 17#.##1.98.135:2323
- 15#.##2.45.147:23
- 99.##.184.70:23
