Linux.Siggen.1772

Technical Information

Malicious functions:

Launches itself as a daemon

Kills system processes:

sshd

Kills the following processes:

exim4
bash
run.sh

Network activity:

Awaits incoming connections on ports:

127.0.0.1:3521

Establishes connection:

8.#.8.8:53
18#.##4.25.178:4534

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

Sends data to the following servers:

18#.##4.25.178:4534
57.##.43.7:23
20#.##2.25.38:23
14.##.249.85:23
18#.##0.95.247:23
13#.##3.232.178:23
17#.##.128.72:23
41.##.242.240:23
21#.#3.27.48:23
11#.#2.46.44:23
8.###.23.84:23
21#.##6.200.139:23
89.##.223.155:23
11#.##5.82.110:23
16#.##3.255.191:23
10#.##2.254.161:23
18#.##0.48.73:23
35.##.231.22:23
17#.##3.170.233:23
16#.##7.198.68:23
11#.##.173.222:23
4.###.145.49:23
10#.##4.108.68:23
13#.##.233.106:23
14.##.80.77:23
15#.##7.249.185:23
39.###.45.103:23
17#.##3.177.143:23
34.##.166.222:23
14#.##.174.92:23
32.##1.92.45:23
38.###.191.76:23
21#.##4.131.51:23
16#.##.123.190:23
15#.#2.129.5:23
17#.##8.79.52:23
14.##3.29.26:23
38.###.211.66:23
21#.##.87.147:23
10#.##2.107.106:23
18#.##.127.75:23
16#.##.127.246:23
10#.##4.83.32:23
10#.##.96.144:23
17#.##.59.248:23
17#.#3.81.75:23
20#.##.99.241:23
97.##4.88.65:23
13#.##8.208.7:23
40.###.14.135:23
16#.##.187.127:23
20#.##7.192.5:23
65.###.97.229:23
48.##9.8.56:23
15#.##.171.249:23
14#.##.179.202:23
22#.##.220.220:23
19#.##3.218.157:23
85.###.207.195:23
10#.##0.76.85:23
99.###.113.90:23
11#.##7.123.96:23
99.##.23.92:23
16#.##1.130.89:23
18#.##0.245.104:23
10#.##6.203.58:23
21#.##6.84.168:23
16#.##8.251.65:23
12.###.253.196:23
10#.##8.104.78:23
17#.##2.154.16:23
46.###.77.162:23
17#.##2.140.255:23
19#.##.96.116:23
22#.##.13.132:23
76.###.98.150:23
1.###.193.136:23
15#.##.47.206:23
27.###.166.221:23
32.###.45.107:23
16#.##.195.151:23
78.##.232.155:23
22#.##7.237.174:23
96.###.159.131:23
18#.##8.11.79:23
85.###.156.55:23
79.##.28.110:23
39.#.223.102:23
11#.##.39.136:23
67.###.221.120:23
66.###.50.149:23
15#.##.120.211:23
19#.#1.182.7:23
99.###.207.218:23
20#.##6.54.79:23
44.###.132.132:23
15#.##7.101.231:23
17#.##7.85.89:23
90.###.255.167:23
80.###.25.108:23
19#.##.103.40:23
47.##.43.244:23
14#.##.215.165:23
17#.##.136.83:23
96.###.128.82:23
37.###.113.255:23
19#.##4.104.63:23
21#.##8.168.138:23
38.###.203.49:23
78.###.254.44:23
15#.##1.207.241:23
45.###.119.189:23
18#.##.192.228:23
71.##.103.3:23
17#.##3.45.149:23
63.###.251.181:23
11#.##.242.11:23
21#.##.20.167:23
12#.##.154.244:23
10#.#.137.84:23
12#.#.241.173:23
14#.##.154.145:23
21#.#.224.146:23
16#.##.64.187:23
80.##.107.27:23
62.###.228.71:23
41.###.206.163:23
14#.##2.153.206:23
12#.##.139.152:23
12#.##.88.158:23
17#.##.159.245:23
14#.#4.79.10:23
19#.#.114.14:23
38.##8.5.117:23
9.##.39.96:23
13.##.109.249:23
24.##2.19.83:23
85.##.14.62:23
17#.##2.135.63:23
13#.##0.93.134:23
10#.##2.212.187:23
20#.#.39.37:23
47.###.128.240:23
47.###.240.241:23
16#.##0.229.67:23
18#.##9.26.122:23
16#.##6.80.63:23
19#.##8.202.225:23
16#.##.64.117:23
10#.##7.43.30:23
13#.##2.187.228:23
11#.##.234.143:23
14.###.129.175:23
12#.##9.90.189:23
15#.##4.43.226:23
21#.##4.51.11:23
69.#.7.49:23
14.#.53.152:23
10#.##.168.167:23
11#.##0.210.85:23
54.###.235.79:23
21#.#6.29.92:23
10#.##7.64.195:23
14#.##.133.57:23
10#.##8.156.210:23
95.###.32.186:23
15#.##7.218.44:23
12#.##1.51.251:23
22#.##.230.224:23
16#.##.161.165:23
19#.##.186.58:23
18#.##8.79.209:23
22#.#.164.120:23
20#.##8.104.149:23
10#.##.252.230:23
14#.##0.0.159:23
12#.##4.236.70:23
41.##2.181.4:23
53.##.64.23:23
21#.##.226.59:23
14#.##4.254.73:23
67.##.107.128:23
90.###.153.180:23
65.#.249.99:23
18.###.244.192:23
15#.##8.48.198:23
37.###.204.156:23
77.##.71.115:23
14#.##9.196.184:23
20#.##9.27.238:23
20#.##4.212.108:23
17#.##1.220.4:23
14.###.48.163:23
99.###.136.133:23
19#.##3.140.167:23
16#.#4.41.87:23
21#.##5.223.154:23
4.###.237.61:23
16#.##.77.104:23
77.###.222.212:23
22#.##.80.228:23
70.###.124.181:23
15#.#.240.212:23
62.###.197.248:23
21#.##4.44.170:23
80.##.146.141:23
15#.##8.86.18:23
79.###.251.150:23
10#.#.38.231:23
23.###.217.217:23
16#.##.230.198:23
79.##.33.171:23
18#.##1.46.46:23
20#.##6.218.164:23
11#.##7.87.169:23
19#.##6.21.45:23
11#.#3.3.171:23
10#.##.207.205:23
16#.##.116.42:23
31.###.161.186:23
79.###.54.195:23
16#.##3.148.116:23
81.##.242.108:23
77.##.236.109:23
15#.##1.196.15:23
15#.##.232.92:23
11#.##5.57.159:23
62.##.213.74:23
48.###.248.127:23
16#.##.247.182:23
15#.##5.169.123:23
15#.##9.176.231:23
87.###.247.199:23
18#.##8.137.88:23
82.###.207.67:23
2.##.146.218:23
8.###.111.39:23
38.##.222.230:23
14#.##8.249.214:23
10#.#13.0.9:23
11#.##7.215.116:23
19#.##7.65.179:23
19#.##4.139.18:23
9.###.1.255:23
81.###.88.249:23
16#.##0.107.73:23
15#.#2.43.22:23
64.##.64.58:23
20#.##7.82.197:23
11#.##6.252.35:23
38.###.229.145:23
12#.##4.175.8:23
48.##.72.169:23
68.###.52.210:23
18#.##.117.209:23
16#.##.143.255:23
10#.##4.66.188:23
95.##.172.78:23
35.###.221.240:23
11#.##2.224.158:23
16#.##.48.112:23
39.#.154.159:23
17#.#1.3.142:23
14#.##6.200.101:23
43.###.207.181:23
18#.##.195.95:23
15#.##.122.52:23
15#.#7.190.7:23
2.###.232.32:23
70.##5.7.117:23
21#.#2.11.84:23
21#.##3.140.15:23
18#.##4.238.17:23
40.###.19.238:23
21#.##1.217.195:23
42.##.152.239:23
10#.##9.44.26:23
70.##.39.57:23
22#.##9.8.108:23
14#.##3.19.55:23
19#.##2.255.19:23
19#.##7.50.29:23
20#.##5.25.148:23
15#.##.241.15:23
85.##3.38.96:23
31.##.127.217:23
21#.#.5.7:23
12#.#95.9.1:23
17#.##1.233.155:23
95.##.222.165:23
12#.##9.165.17:23
96.###.247.57:23
11#.##.146.231:23
17#.##0.233.153:23
21#.##5.119.136:23
10#.##.186.67:23
98.###.99.236:23
16#.##3.236.234:23
21#.#12.91.9:23
71.###.211.217:23
20#.##2.112.19:23
21#.##.245.110:23
88.##.213.237:23
12#.##0.216.83:23
17#.##.80.118:23
22#.#.13.82:23
41.##.214.214:23
10#.##7.75.29:23
10#.##.65.124:23
11#.##0.186.136:23
43.###.41.247:23
21#.##7.190.148:23
19#.##.109.235:23
17#.##1.191.245:23
90.##0.76.96:23
18#.##.75.137:23
21#.##.12.217:23
72.##.40.158:23
74.##0.27.74:23
18#.##9.4.180:23
19#.##4.246.84:23
48.###.75.230:23
72.###.124.126:23
54.###.241.121:23
21#.##.186.96:23
5.##.216.195:23
71.##.75.223:23
10#.##2.88.171:23
18#.##5.199.113:23
21#.##7.239.235:23
18#.##4.166.144:23
76.##0.74.81:23
79.###.169.182:23
20#.##9.180.22:23
15#.##.209.224:23
22#.##.152.138:23
10#.##3.34.32:23
11#.##8.239.71:23
16#.##0.100.17:23
8.###.48.175:23
4.###.134.229:23
17#.##5.32.226:23
19#.##1.106.101:23
16#.##2.198.156:23
74.###.178.188:23
74.##.72.226:23
38.###.180.185:23
1.##.244.77:23
14.##.43.88:23
14#.#39.5.98:23
10#.##1.156.250:23
18#.##7.125.3:23
78.###.52.197:23
14.###.201.27:23
38.#.181.35:23
14#.##.135.249:23
41.##.93.131:23
46.###.209.214:23
11#.##2.67.162:23
10#.##.30.241:23
11#.##4.178.64:23
17#.##9.14.140:23
20#.##.53.135:23
73.##2.86.50:23
15#.##.106.129:23
10#.##3.16.165:23
11#.#1.37.13:23
16#.##3.26.156:23
81.###.191.57:23
38.##3.49.87:23
18#.##3.218.216:23
10#.##3.156.117:23
87.###.91.140:23
12#.##5.72.45:23
18#.##8.245.63:23
88.##.197.128:23
78.##.184.81:23
45.##.25.226:23
17#.##2.18.135:23
10#.##.103.253:23
22#.#6.74.59:23
41.###.166.19:23
20#.##.199.163:23
64.##.17.227:23
21#.##.24.166:23
16#.#3.0.133:23
21#.##9.233.70:23
19#.##.74.233:23
86.###.170.60:23
15#.#7.17.28:23
16#.##0.120.151:23
17#.##.186.254:23
8.##.17.46:23
16#.##.219.230:23
10#.##.29.255:23
21#.##8.198.116:23
13#.##.121.28:23
39.##.131.41:23
11#.##7.110.116:23
1.###.109.125:23
19#.#2.163.5:23
86.###.153.33:23
10#.##1.237.216:23
21#.##.234.230:23
12#.##.174.96:23
24.###.146.104:23
61.##.232.82:23
86.###.165.166:23
15#.##8.91.181:23
11#.##.206.176:23
71.##.18.47:23
96.##3.44.22:23
20.##7.77.14:23
66.##.140.83:23
5.###.0.192:23
11#.#7.139.4:23
9.###.242.200:23
22#.##.151.104:23
57.##.73.41:23
20#.##.69.102:23
21#.#6.6.129:23
17#.##.227.245:23
99.##3.37.9:23
59.##.191.58:23
22#.##.187.90:23
14.#.53.189:23
19#.##9.128.195:23

Receives data from the following servers:

18#.##4.25.178:4534

Other:

Collects information about network activity

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations