Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- /etc/shadow
Manages services:
- ['/bin/systemctl', 'enable', 'bot']
Launches processes:
- (crontab -l 2>/dev/null; echo \x22@reboot /bin/bash -c \x27<SAMPLE_FULL_PATH>\x27\x22) | crontab -
- /bin/systemctl enable bot
- crontab -
- crontab -l
Kills the following processes:
- <SAMPLE>
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.aqq18L
Creates or modifies files:
- /dev/full
- /var/spool/cron/crontabs/tmp.aqq18L
- /usr/lib/systemd/system/bot.service
Changes time of creation/access/modification of files:
- /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
- 1.#.#.127:4161
- 0.0.0.0:4161
Establishes connection:
- 8.#.8.8:53
- 0.0.0.0:4161
- 1.#.1.1:53
- 127.0.0.1:1290
DNS ASK:
- ex###cam.pro
Sends data to the following servers:
- 18#.###.157.201:37215
- 18#.###.219.224:37215
- 37.###.38.222:37215
- 10#.###.124.193:37215
- 12#.###.233.219:37215
- 13#.###.146.125:37215
- 37.###.209.240:37215
- 45.###.135.78:37215
- 18#.###.112.250:37215
- 12#.###.139.68:37215
- 20#.##.123.13:37215
- 12#.##4.231.7:37215
- 37.###.72.205:37215
- 19#.##.247.66:37215
- 18#.##9.56.44:37215
- 18#.##.98.155:37215
- 37.###.225.89:37215
- 41.###.61.204:37215
- 94.##.23.150:37215
- 31.###.72.76:37215
- 17#.##.254.107:37215
- 94.###.97.99:37215
- 37.##.154.232:37215
- 18#.###.136.97:37215
- 22#.##.191.146:37215
- 81.#.#3.140:37215
- 45.###.99.38:37215
- 51.###.109.224:37215
- 31.##.0.85:37215
- 18#.##0.52.43:37215
- 41.###.148.53:37215
- 13#.###.158.202:37215
- 15#.#.194.178:37215
- 19#.##.8.188:37215
- 12#.###.76.248:37215
- 41.###.157.243:37215
- 19#.###.40.204:37215
- 15#.###.165.237:37215
- 94.###.2.109:37215
- 41.###.182.211:37215
- 45.###.236.233:37215
- 19#.###.198.240:37215
- 31.###.231.102:37215
- 94.###.209.67:37215
- 22#.###.130.195:37215
- 18#.##3.96.59:37215
- 13#.##.62.184:37215
- 19#.##.184.107:37215
- 12#.##.120.138:37215
- 18#.##.58.59:37215
- 31.##.244.10:37215
- 31.##.42.216:37215
- 12#.###.135.107:37215
- 19#.##2.63.44:37215
- 22#.###.22.118:37215
- 31.###.53.136:37215
- 62.##.211.186:37215
- 31.##.197.30:37215
- 41.##.64.181:37215
- 31.###.236.162:37215
- 15#.##.65.157:37215
- 12#.##.128.41:37215
- 12#.##.118.5:37215
- 19#.##.83.169:37215
- 45.###.110.18:37215
- 37.###.16.219:37215
- 37.###.180.78:37215
- 12#.##.162.82:37215
- 18#.###.102.155:37215
- 41.###.241.221:37215
- 12#.###.51.183:37215
- 15#.##.229.144:37215
- 37.###.154.183:37215
- 31.###.96.174:37215
- 41.###.63.236:37215
- 41.###.121.77:37215
- 13#.###.121.239:37215
- 12#.###.109.77:37215
- 10#.###.214.232:37215
- 12#.##2.213.6:37215
- 12#.##.198.182:37215
- 18#.###.196.147:37215
- 22#.###.206.43:37215
- 31.###.45.39:37215
- 18#.##.233.77:37215
- 15#.###.106.221:37215
- 10#.##.5.93:37215
- 41.###.72.153:37215
- 15#.##.162.145:37215
- 15#.###.204.150:37215
- 10#.###.184.168:37215
- 94.##.80.238:37215
- 18#.###.189.40:37215
- 37.###.81.115:37215
- 31.###.110.219:37215
- 13#.##.100.169:37215
- 12#.###.37.127:37215
- 31.##.240.10:37215
- 15#.###.127.157:37215
- 13#.##.197.73:37215
- 45.###.234.77:37215
- 22#.###.137.239:37215
- 19#.###.208.79:37215
- 81.###.98.48:37215
- 37.##.94.179:37215
- 37.##.48.191:37215
- 45.###.152.254:37215
- 15#.###.169.105:37215
- 94.##.157.163:37215
- 41.###.33.248:37215
- 18#.##8.1.193:37215
- 45.###.30.38:37215
- 15#.###.12.159:37215
- 31.##.24.31:37215
- 10#.###.184.54:37215
- 18#.##.92.21:37215
- 94.###.250.193:37215
- 37.##.39.82:37215
- 22#.##4.7.218:37215
- 12#.##.39.21:37215
- 13#.##4.60.63:37215
- 12#.###.152.85:37215
- 17#.###.42.118:37215
- 22#.##.49.19:37215
- 18#.###.101.248:37215
- 15#.#.19.61:37215
- 22#.###.229.132:37215
- 41.###.172.220:37215
- 18#.##9.57.12:37215
- 22#.###.221.200:37215
- 37.###.191.194:37215
- 15#.##.118.55:37215
- 10#.#.75.166:37215
- 18#.###.92.193:37215
- 19#.###.63.200:37215
- 31.###.181.208:37215
- 19#.###.161.102:37215
- 37.###.60.114:37215
- 12#.##.145.153:37215
- 18#.##.218.98:37215
- 19#.##.204.85:37215
- 31.###.2.98:37215
- 12#.###.237.117:37215
- 15#.###.236.219:37215
- 19#.##.19.16:37215
- 22#.###.26.180:37215
- 31.##.12.23:37215
- 15#.###.103.91:37215
- 18#.###.124.97:37215
- 12#.###.237.175:37215
- 18#.###.59.123:37215
- 15#.###.142.212:37215
- 41.##.44.38:37215
- 37.###.135.47:37215
- 19#.#.229.25:37215
- 22#.##.227.94:37215
- 15#.##.15.154:37215
- 13#.###.136.190:37215
- 22#.##.8.232:37215
- 13#.##.208.205:37215
- 13.##.166.220:37215
- 37.##.11.38:37215
- 18#.###.111.89:37215
- 37.##.100.188:37215
- 31.###.240.228:37215
- 13#.##.3.183:37215
- 12#.###.237.229:37215
- 37.###.195.16:37215
- 45.###.233.1:37215
- 13#.###.160.80:37215
- 41.###.39.181:37215
- 15#.###.203.152:37215
- 12#.###.152.245:37215
- 31.###.218.85:37215
- 19#.###.138.223:37215
- 45.##.1.51:37215
- 13#.###.110.74:37215
- 41.#.#57.67:37215
- 12#.###.73.233:37215
- 37.###.244.126:37215
- 19#.##.192.166:37215
- 37.###.28.37:37215
- 18#.###.232.105:37215
- 15#.###.120.205:37215
- 10#.##.79.169:37215
- 10#.##.118.70:37215
- 18#.###.191.233:37215
- 12#.###.164.67:37215
- 10#.##.102.189:37215
- 21#.#.126.207:37215
- 22#.##.51.255:37215
- 45.###.76.247:37215
- 19#.###.243.33:37215
- 21#.###.124.60:37215
- 31.###.33.159:37215
- 19#.##2.0.255:37215
- 19#.##.20.56:37215
- 12#.##.113.222:37215
- 31.##.236.210:37215
- 94.#.#49.26:37215
- 18#.###.125.252:37215
- 45.##.4.154:37215
- 12#.##2.89.79:37215
- 31.###.44.165:37215
- 18#.###.99.244:37215
- 22#.##.237.190:37215
- 12#.##.241.116:37215
- 19#.###.103.111:37215
- 18#.##.87.44:37215
- 37.##.227.1:37215
- 15#.##.197.31:37215
- 37.###.71.159:37215
- 41.###.121.174:37215
- 41.##.249.33:37215
- 15#.##.153.216:37215
- 18#.###.48.135:37215
- 12#.###.250.181:37215
- 18#.###.82.211:37215
- 10#.###.81.238:37215
- 19#.#.171.252:37215
- 18#.##.57.56:37215
- 19#.###.27.250:37215
- 12#.###.121.251:37215
- 12#.#.164.175:37215
- 41.###.200.2:37215
- 18#.###.148.54:37215
- 94.##.69.136:37215
- 12#.##3.72.59:37215
- 12#.###.44.147:37215
- 18#.###.153.92:37215
- 22#.##.9.8:37215
- 45.###.130.106:37215
- 19#.###.98.120:37215
- 12#.###.235.91:37215
- 37.##.100.116:37215
- 12#.###.51.167:37215
- 15#.###.159.162:37215
- 15#.###.244.21:37215
- 42.###.161.212:37215
- 94.###.135.12:37215
- 12#.###.64.161:37215
- 22#.###.231.225:37215
- 22#.##2.74.92:37215
- 41.#.#12.175:37215
- 18#.##.119.155:37215
- 37.###.176.128:37215
- 12#.#.147.116:37215
- 10#.###.160.102:37215
- 37.###.151.186:37215
- 12#.##.0.165:37215
- 18#.###.58.226:37215
- 12#.###.175.143:37215
- 31.##.249.93:37215
- 94.###.239.128:37215
- 41.###.131.0:37215
- 10#.###.211.48:37215
- 19#.##.69.19:37215
- 12#.###.73.172:37215
- 13#.#.249.245:37215
- 94.###.130.98:37215
- 45.###.105.127:37215
- 15#.##8.75.65:37215
- 18#.##.149.1:37215
- 15#.###.211.44:37215
- 17#.##.253.134:37215
- 18#.###.249.53:37215
- 19#.##.17.105:37215
- 31.##.163.203:37215
- 18#.###.97.232:37215
- 31.##.9.44:37215
- 15#.##.46.225:37215
- 12#.##.195.172:37215
- 10#.##.74.255:37215
- 18#.#.198.235:37215
- 94.###.48.36:37215
- 88.###.9.39:37215
- 19#.##3.71.71:37215
- 31.###.144.52:37215
- 22#.###.44.233:37215
- 31.###.173.129:37215
- 19#.###.82.248:37215
- 15#.###.145.40:37215
- 10#.###.116.37:37215
- 94.###.147.74:37215
- 18#.##.4.110:37215
- 19#.##.69.222:37215
- 18#.##5.94.36:37215
- 12#.###.58.171:37215
- 45.##.49.8:37215
- 18#.##.17.121:37215
- 94.##.39.150:37215
- 15#.###.239.133:37215
- 22#.##6.85.62:37215
- 37.###.240.2:37215
- 94.##.142.29:37215
- 18#.##.131.106:37215
- 18#.##.42.183:37215
- 15#.##.229.63:37215
- 13#.##.111.98:37215
- 37.##.87.113:37215
- 13#.###.176.206:37215
- 18#.###.63.194:37215
- 45.###.123.9:37215
- 12#.###.60.212:37215
- 22#.##.78.26:37215
- 10#.##5.70.90:37215
- 15#.#.204.36:37215
- 13#.###.229.145:37215
- 18#.##.213.127:37215
- 15#.##.220.15:37215
- 12#.###.223.33:37215
- 13#.##.222.15:37215
- 94.###.104.26:37215
- 31.###.70.174:37215
- 15#.###.155.102:37215
- 94.###.163.108:37215
- 31.###.45.178:37215
- 94.###.5.244:37215
- 15#.##.61.152:37215
- 15#.##.150.38:37215
- 12#.##.23.198:37215
- 41.##.119.111:37215
- 16#.##.182.202:37215
- 12#.##0.40.45:37215
- 12#.###.40.102:37215
- 15#.###.239.163:37215
- 15#.##.28.184:37215
- 37.#.#47.94:37215
- 22#.###.251.68:37215
- 45.###.99.95:37215
- 31.##.81.222:37215
- 18#.###.133.156:37215
- 18#.###.210.209:37215
- 15#.#.11.69:37215
- 19#.#.133.57:37215
- 18#.##3.66.88:37215
- 12#.##.120.155:37215
- 19#.###.35.231:37215
- 22#.###.189.178:37215
- 19#.##.77.26:37215
- 13#.###.56.107:37215
- 18#.##.197.160:37215
- 31.##.79.188:37215
- 10#.###.172.62:37215
- 15#.###.197.236:37215
- 15#.##8.9.43:37215
- 37.###.243.186:37215
- 15#.###.13.234:37215
- 19#.###.196.25:37215
- 18#.##.222.54:37215
- 19#.#.168.239:37215
- 15#.###.118.141:37215
- 22#.###.85.199:37215
- 22#.##.7.134:37215
- 18#.##2.194.4:37215
- 22#.###.109.112:37215
- 12#.##1.1.195:37215
- 41.###.182.243:37215
- 19#.###.234.192:37215
- 45.###.58.112:37215
- 45.###.88.99:37215
- 45.###.116.219:37215
- 13#.##3.70.53:37215
- 45.##.135.48:37215
- 22#.##7.13.71:37215
- 22#.###.51.187:37215
- 22#.##3.73.73:37215
- 94.##.5.202:37215
- 10#.##.231.152:37215
- 19#.###.79.225:37215
- 94.###.168.69:37215
- 41.###.145.244:37215
- 12#.###.33.123:37215
- 19#.##.21.239:37215
- 19#.###.122.27:37215
- 18#.###.128.227:37215
- 19#.###.62.133:37215
- 15#.##.64.189:37215
- 19#.###.224.78:37215
- 13#.##.22.177:37215
- 15#.###.144.168:37215
- 12#.###.232.83:37215
- 18#.##.76.166:37215
- 45.###.213.109:37215
- 13#.##.150.50:37215
- 31.###.0.228:37215
- 15#.###.188.93:37215
- 41.###.92.1:37215
- 18#.###.161.125:37215
- 15#.##.230.245:37215
- 18#.###.181.215:37215
- 19#.###.188.245:37215
- 18#.##.45.238:37215
- 19#.##3.81.1:37215
- 18#.###.149.37:37215
- 18#.###.137.174:37215
- 18#.##.111.206:37215
- 12#.###.63.235:37215
- 18#.##.106.132:37215
- 12#.###.163.98:37215
- 15#.###.205.156:37215
- 19#.##.128.165:37215
- 12#.##1.1.131:37215
- 19#.###.147.72:37215
- 12#.##2.52.33:37215
- 19#.###.212.166:37215
- 15#.###.228.48:37215
- 37.###.206.49:37215
- 19#.##5.5.255:37215
- 18#.##.189.135:37215
- 31.##.6.76:37215
- 15#.###.132.186:37215
- 94.###.228.33:37215
- 10#.##.44.107:37215
- 41.##.115.29:37215
- 18#.###.138.120:37215
- 27.###.116.28:37215
- 15#.##.105.185:37215
- 16#.###.175.150:37215
- 18#.##.83.144:37215
- 94.##.36.184:37215
- 19#.###.20.252:37215
- 15#.##.253.243:37215
- 15#.###.98.226:37215
- 18#.###.162.19:37215
- 22#.###.31.157:37215
- 10#.##.154.95:37215
- 22#.###.136.171:37215
- 41.###.226.105:37215
- 13#.###.24.252:37215
- 12#.##.55.52:37215
- 22#.##.69.224:37215
- 41.###.63.137:37215
- 12#.##.101.130:37215
- 22#.#.192.79:37215
- 19#.###.184.137:37215
- 12#.##.73.211:37215
- 19#.###.134.131:37215
- 94.###.121.132:37215
- 94.###.60.147:37215
- 31.##.72.110:37215
- 31.###.141.96:37215
- 10#.##.114.235:37215
- 18#.###.229.57:37215
- 37.##.161.138:37215
- 15#.###.177.82:37215
- 41.###.92.118:37215
- 12#.###.195.95:37215
- 15#.###.108.28:37215
- 45.###.20.49:37215
- 31.##.63.255:37215
- 18#.###.74.190:37215
- 37.###.5.101:37215
- 94.###.76.60:37215
- 12#.##.145.190:37215
- 12#.###.78.150:37215
- 18#.##.246.251:37215
- 18#.##.46.197:37215
- 19#.###.180.188:37215
- 13#.##.42.183:37215
- 12#.###.223.191:37215
- 94.###.142.17:37215
- 15#.##4.56.41:37215
- 13#.##4.48.87:37215
- 41.##.77.236:37215
- 41.##.212.36:37215
- 41.##.229.124:37215
- 13#.###.204.80:37215
- 19#.###.149.239:37215
- 15#.###.172.32:37215
- 15#.###.254.211:37215
- 13#.##.184.18:37215
- 12#.##.244.165:37215
- 97.##.211.173:37215
- 19#.##.191.128:37215
- 37.##.48.223:37215
- 46.###.253.41:37215
- 18#.##.47.53:37215
- 94.##.206.102:37215
- 19#.##.154.52:37215
- 12#.##.202.208:37215
- 37.###.155.253:37215
- 19#.##.24.64:37215
- 15#.###.242.196:37215
- 45.##.171.8:37215
- 22#.##7.55.50:37215
- 12#.##1.79.1:37215
- 19#.##.62.59:37215
- 18#.##5.70.95:37215
- 19#.##.37.54:37215
- 18#.##.52.83:37215
- 12#.###.208.148:37215
- 94.###.245.238:37215
- 12#.##.171.176:37215
- 41.##.131.202:37215
- 19#.###.124.134:37215
- 94.##.45.228:37215
- 22#.##.68.71:37215
- 18#.##.236.22:37215
- 18#.###.180.90:37215
- 94.##.197.198:37215
- 18#.###.202.231:37215
- 12#.##1.66.74:37215
- 12#.##.238.146:37215
- 94.###.167.172:37215
- 41.##.125.96:37215
- 15#.###.61.118:37215
- 18#.##9.144.2:37215
- 31.##.84.152:37215
- 94.###.15.65:37215
- 18#.##.179.226:37215
- 18#.###.110.154:37215
