Linux.Mirai.3714

Technical Information

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

/bin/busybox

Replaces the following system files:

/bin/wget
/sbin/wget

Launches processes:

/bin/sh -c cd /bin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
cat tftp
cat <SAMPLE_FULL_PATH>
/bin/sh -c chmod 777 tftp
chmod 777 tftp
/bin/sh -c cd /bin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
cat rm
/bin/sh -c chmod 777 rm
chmod 777 rm
/bin/sh -c cd /bin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
cat kill
/bin/sh -c chmod 777 kill
chmod 777 kill
/bin/sh -c cd /bin/; cat cd > cd-cpy; cat <SAMPLE_FULL_PATH> > cd
cat cd
/bin/sh -c chmod 777 cd
chmod 777 cd
/bin/sh -c cd /bin/; cat wget > wget-cpy; cat <SAMPLE_FULL_PATH> > wget
cat wget
/bin/sh -c chmod 777 wget
chmod 777 wget
/bin/sh -c cd /sbin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
/bin/sh -c cd /sbin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
/bin/sh -c cd /sbin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
/bin/sh -c cd /sbin/; cat cd > cd-cpy; cat <SAMPLE_FULL_PATH> > cd
/bin/sh -c cd /sbin/; cat wget > wget-cpy; cat <SAMPLE_FULL_PATH> > wget

Kills the following processes:

rsyslogd
acpid
dbus-daemon
agetty
exim4

Performs operations with the file system:

Creates or modifies files:

/bin/tftp-cpy
/bin/tftp
/bin/rm-cpy
/bin/rm
/bin/kill-cpy
/bin/kill
/bin/cd-cpy
/bin/cd
/bin/wget-cpy
/sbin/tftp-cpy
/sbin/tftp
/sbin/rm-cpy
/sbin/rm
/sbin/kill-cpy
/sbin/kill
/sbin/cd-cpy
/sbin/cd
/sbin/wget-cpy

Network activity:

Establishes connection:

8.#.8.8:53
18#.##2.250.46:9090

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

Sends data to the following servers:

18#.##2.250.46:9090
53.###.161.93:23
92.###.19.101:23
17#.##8.126.137:23
39.##.113.249:23
97.###.113.67:23
66.##.7.228:23
91.##9.181.8:23
20#.##.64.186:23
92.###.222.98:23
20.###.251.197:23
17#.##.32.245:23
17#.#08.4.16:23
15#.##7.115.77:23
10#.##1.169.192:23
81.###.35.101:23
62.##8.98.38:23
38.###.201.150:23
15#.##7.110.98:23
10#.##3.26.230:23
16#.##0.177.208:23
90.###.255.252:23
16#.##2.243.131:23
18#.#10.2.23:23
20#.#25.9.64:23
19#.##3.203.135:23
53.###.138.128:23
25.##.196.198:23
13#.##1.20.45:23
73.###.144.42:23
11#.##3.5.174:23
19#.##9.252.13:23
10#.##7.134.222:23
15#.##.236.133:23
10#.#4.59.88:23
10#.#36.8.71:23
12#.##6.236.104:23
61.###.174.78:23
15#.##.44.205:23
42.##7.219.5:23
11#.##5.92.226:23
14#.##.106.36:23
10#.##7.218.27:23
44.###.137.168:23
47.###.143.82:23
16#.##2.238.217:23
51.##4.130.9:23
15#.##1.239.20:23
14#.##2.145.223:23
96.##4.23.47:23
35.##.223.213:23
89.###.189.186:23
54.###.60.214:23
93.###.134.230:23
74.###.30.133:23
61.##.244.204:23
81.###.84.251:23
11#.##1.15.139:23
15#.##0.159.89:23
16#.##.186.46:23
49.##2.51.36:23
41.###.172.242:23
17#.#6.228.9:23
31.##7.230.6:23
19#.##0.233.117:23
63.##.202.22:23
67.###.110.224:23
21#.##8.31.92:23
39.###.53.222:23
17#.##0.26.57:23
21#.##.71.115:23
64.##.87.13:23
11#.#0.34.25:23
18.##.123.238:23
10#.##.176.55:23
13#.##3.19.197:23
18#.##.196.10:23
36.###.115.30:23
19.###.20.219:23
14#.##6.118.13:23
85.###.132.68:23
19#.##.171.227:23
14#.##.173.190:23
14.###.213.142:23
19#.##9.59.74:23
91.##.45.19:23
21#.##6.120.168:23
14.##.9.112:23
10#.##0.238.107:23
14#.##.215.241:23
21#.##5.213.145:23
21#.##0.93.107:23
99.##.64.234:23
13#.##9.129.140:23
32.##0.135.5:23
46.##.17.103:23
9.###.236.51:23
10#.##.186.187:23
25.##.32.208:23
20#.##6.199.156:23
20#.##5.254.186:23
12#.##.17.218:23
79.##.158.174:23
13#.##4.59.193:23
12#.##2.221.74:23
17#.##0.149.22:23
16#.##4.98.101:23
21#.##6.0.208:23
80.##.56.30:23
20#.##.95.253:23
21#.##2.200.42:23
31.#.31.241:23
18#.#6.53.31:23
71.#.248.54:23
17#.##9.49.89:23
13#.##.153.103:23
20#.##2.49.100:23
20#.##.46.117:23
46.###.138.98:23
12#.##.178.223:23
61.##.144.101:23
20#.##.202.43:23
94.###.37.162:23
20#.##6.217.59:23
94.###.119.234:23
10#.##0.97.175:23
1.###.207.246:23
41.###.225.212:23
63.##.2.221:23
75.##.145.239:23
1.##.123.173:23
27.###.42.154:23
81.#.35.116:23
21#.##.163.103:23
13#.#7.60.46:23
14#.##4.12.129:23
21#.##.47.239:23
15#.##8.234.84:23
85.##.223.198:23
31.###.200.23:23
84.###.148.47:23
22#.##7.105.221:23
20#.##8.21.252:23
14#.##2.2.124:23
81.###.135.167:23
22#.##1.25.21:23
21#.##2.102.69:23
57.###.197.66:23
17.###.26.116:23
15#.##.172.101:23
89.###.142.148:23
20#.##.104.51:23
11#.##6.62.124:23
31.###.138.209:23
44.##.209.219:23
21#.#.200.73:23
21#.##2.15.92:23
12.##3.3.45:23
21#.##.57.224:23
11#.##5.63.28:23
74.###.152.173:23
21#.##6.79.226:23
31.###.22.127:23
83.##.71.48:23
25.###.54.230:23
35.###.235.214:23
10#.##.201.248:23
10#.##.167.173:23
93.##.233.159:23
19#.##9.183.211:23
20#.##9.2.224:23
16#.##1.95.168:23
22#.##8.210.95:23
75.##.19.131:23
14.###.146.241:23
21#.##.251.201:23
17.##0.97.89:23
21#.##8.142.59:23
45.###.132.178:23
15#.##.51.147:23
58.###.227.33:23
37.###.64.220:23
13#.##5.148.0:23
84.##.111.170:23
59.###.84.206:23
13#.##0.231.211:23
10#.##9.64.195:23
14#.##5.92.24:23
19.###.197.237:23
16#.##6.128.102:23
22#.##.202.223:23
17#.##1.176.91:23
64.###.168.240:23
15#.##.184.16:23
57.###.38.209:23
68.##.116.9:23
48.#.30.14:23
20.###.127.59:23
36.##.221.139:23
59.###.122.19:23
31.###.225.161:23
13#.##.100.115:23
81.#.105.34:23
18#.#24.88.0:23
20#.#1.153.9:23
13#.##1.162.213:23
35.##.186.177:23
96.###.233.130:23
62.##.1.120:23
10#.##5.220.234:23
15#.##.81.210:23
11#.##1.201.38:23
11#.##.176.78:23
20#.##0.107.18:23
49.###.46.101:23
92.##.183.112:23
88.##.9.197:23
70.##.178.8:23
18#.##7.142.166:23
48.###.178.11:23
87.###.17.123:23
15#.##1.169.144:23
2.#.#54.76:23
16#.##1.191.209:23
18#.##.118.159:23
27.###.222.243:23
83.###.127.120:23
12#.##.73.172:23
59.##.6.163:23
14#.##1.119.230:23
92.##.52.197:23
18#.##0.42.34:23
17#.##0.18.234:23
19#.##6.127.144:23
18#.##3.117.102:23
53.##9.30.76:23
11#.#2.83.2:23
17#.##.243.128:23
14#.##.189.101:23
13#.##0.175.60:23
50.##.31.120:23
82.##7.95.6:23
19#.#8.8.28:23
59.##.90.32:23
62.##3.80.88:23
20#.#4.7.115:23
78.###.142.156:23
65.###.148.28:23
16#.##3.17.217:23
13#.##8.210.28:23
15#.##6.144.169:23
65.##3.34.39:23
10#.##4.73.106:23
14#.##9.216.61:23
41.##3.5.152:23
12#.##1.109.73:23
12#.##1.166.234:23
17#.##4.246.204:23
17.###.67.203:23
75.###.210.207:23
74.##7.5.130:23
77.###.205.42:23
10#.#9.105.8:23
19.##6.36.26:23
14#.##.189.160:23
12.##.83.30:23
14#.#.222.132:23
48.###.100.59:23
19#.##.182.118:23
20#.##6.64.116:23
14#.##0.215.168:23
17#.##.43.237:23
73.###.23.210:23
14#.##1.202.21:23
85.###.65.132:23
68.###.102.41:23
11#.##7.178.3:23
21#.##1.131.229:23
14#.##.30.138:23
15#.##0.8.203:23
8.##.66.235:23
14#.##5.159.82:23
19#.##.37.244:23
8.###.189.22:23
48.##.93.71:23
20#.##.184.204:23
4.###.19.28:23
12#.##.219.43:23
18#.##.165.66:23
27.###.84.210:23
19#.##.144.216:23
10#.##2.206.21:23
91.###.214.97:23
14.#.173.146:23
14#.##6.92.96:23
16#.##2.18.139:23
9.###.195.196:23
16#.##.216.92:23
10#.##3.105.179:23
99.##.251.213:23
22#.##.235.108:23
39.##2.88.59:23
46.##.128.51:23
14#.##7.11.30:23
15#.##.181.66:23
12#.##.146.185:23
12#.##0.223.124:23
98.###.115.188:23
12#.##2.118.247:23
16#.#.93.169:23
52.##.248.71:23
79.##6.68.51:23
79.##.38.63:23
24.###.199.223:23
18.###.159.70:23
16#.##3.42.245:23
13#.##.59.169:23
17.##3.21.33:23
21#.##9.25.45:23
17#.#2.68.1:23
13#.##.126.23:23
20#.##0.208.134:23
20#.##3.13.107:23
58.###.138.192:23
71.###.212.64:23
89.###.32.110:23
42.#.48.63:23
13#.#.30.209:23
18#.##2.218.211:23
12#.##9.66.159:23
21#.##0.9.235:23
19#.##.149.28:23
50.###.91.218:23
18#.##2.201.95:23
19#.##3.185.231:23
71.###.138.171:23
15#.##3.228.53:23
16#.##8.169.83:23
14#.##7.31.14:23
58.##9.92.6:23
77.##.78.53:23
68.###.237.19:23
10#.#.98.215:23
13#.##4.97.182:23
17#.##9.195.172:23
15#.##2.37.171:23
17#.##5.149.31:23
20.##.106.196:23
21#.#23.13.8:23
18#.##2.105.129:23
11#.##6.154.25:23
15#.##.80.243:23
21#.##9.22.241:23
19#.##.75.215:23
24.###.179.51:23
18#.#0.91.58:23
99.###.222.27:23
21#.##0.152.27:23
96.###.225.208:23
85.##4.66.70:23
12.##.7.162:23
22#.##4.224.233:23
24.###.136.20:23
18#.##3.184.205:23
14#.##9.245.42:23
13#.##8.16.16:23
10#.##.93.250:23
18.#.247.17:23
75.##3.66.99:23
8.###.121.254:23
14#.##0.149.157:23
81.###.250.135:23
51.##6.52.19:23
11#.#59.81.1:23
16#.##.227.60:23
65.###.149.49:23
23.##.72.15:23
15#.##4.72.191:23
96.###.111.133:23
20#.##5.126.70:23
95.###.188.44:23
13#.##.223.117:23
63.###.100.76:23
68.##.74.239:23
15#.##0.244.82:23
21#.##4.235.166:23
17#.##4.37.247:23
10#.##.162.236:23
61.###.161.228:23
19#.##.171.124:23
15#.##2.198.145:23
17#.##9.36.222:23
44.###.242.122:23
32.###.208.135:23
21#.##4.184.80:23
1.##.80.201:23
17#.##9.44.70:23
13#.##4.68.95:23
10#.##4.51.163:23
21#.##8.119.169:23
59.###.221.129:23
13#.##3.208.167:23
17#.##.238.111:23
77.##.13.213:23
16#.##8.65.142:23
12#.##8.112.221:23
12#.##7.187.108:23
52.###.123.135:23
20.###.252.143:23
31.###.211.94:23
45.##0.92.43:23
25.###.128.166:23
14#.##0.194.162:23
59.###.162.108:23
4.###.240.5:23
18#.##0.199.11:23
15#.##6.152.125:23
97.###.151.244:23
5.##.178.250:23
13#.##7.143.77:23
11#.##2.9.192:23
73.##.94.54:23
20#.##.78.162:23
13#.##.168.166:23
18#.##7.184.18:23
52.##.234.230:23
21#.##.161.81:23
16#.##2.35.241:23
10#.##8.230.218:23
11#.##.246.205:23
21#.##9.154.38:23
14#.##5.74.240:23
86.###.153.111:23
16#.##.124.146:23
11#.#2.77.76:23
85.#.138.103:23
15#.##3.91.253:23
12#.#77.53.2:23
14#.##0.210.18:23
54.##3.85.76:23
4.###.101.189:23
8.###.197.80:23
70.###.163.39:23
68.#.88.134:23
39.##.54.102:23
15#.#2.66.88:23
85.###.238.253:23
67.##.152.26:23
79.##.240.0:23
18#.##4.103.184:23
14#.##3.101.85:23
21#.##4.171.47:23
15#.#.111.113:23
96.###.157.66:23
53.##.55.52:23
21#.#.203.12:23
92.##.144.83:23
2.###.207.171:23
10#.#0.3.54:23
70.###.211.171:23
44.###.49.185:23
13#.##6.34.75:23
14#.##0.148.224:23
13#.##8.68.35:23
12#.##3.253.180:23
10#.##9.215.42:23
24.##8.28.64:23
21#.##.116.79:23
17#.#0.34.17:23
18#.##.240.114:23
86.##.11.150:23
34.##.180.47:23
4.###.109.248:23
11#.##2.255.0:23
16#.##.178.24:23
19#.##3.155.169:23
21#.##2.152.222:23
19.###.68.216:23
11#.##6.189.188:23
94.###.161.125:23
76.##.40.237:23
15#.##3.210.13:23
83.###.216.161:23
15#.##7.23.154:23
13.###.78.155:23
25.##6.13.32:23
12#.##.209.173:23
13#.##4.8.221:23
62.###.40.171:23
85.###.143.117:23
71.###.232.125:23
10#.##5.128.78:23
21#.##4.222.141:23
10#.##9.38.154:23
19#.##6.102.168:23
20.##2.99.13:23
85.##0.18.79:23
21#.##.158.160:23
12#.##3.132.170:23
19#.##6.228.151:23
50.###.210.36:23
18#.#2.15.27:23
39.###.148.164:23
27.###.217.215:23
10#.##1.16.241:23
15#.##0.248.85:23
18#.##.26.101:23
10#.##.174.138:23
10#.##4.26.126:23
57.###.97.192:23
85.###.157.101:23
71.###.210.175:23
15#.##2.139.4:23
14#.##0.144.148:23
19#.##.158.171:23
17#.##8.60.160:23
14#.##.148.238:23
98.###.45.231:23
16#.##.119.42:23
11#.##1.169.204:23
46.###.42.181:23
22#.##4.136.0:23
44.##3.80.75:23
20.###.170.75:23
10#.##.185.37:23
18#.#8.68.43:23
69.##.136.220:23
46.###.252.122:23
90.##.138.58:23
17#.##.180.246:23
11#.##.59.154:23
20#.##.197.130:23
17#.##3.124.47:23
87.##4.69.26:23
12#.##.139.226:23
15#.##3.72.67:23
11#.#3.78.93:23
34.###.50.115:23
21#.#1.35.87:23
15#.##2.104.145:23
20#.##5.99.45:23
14#.##9.142.81:23
14#.##.120.150:23
14#.##4.167.20:23
20#.##.177.90:23
15#.##.106.76:23
12#.#.172.61:23
50.###.229.245:23
37.###.175.154:23
16#.##.49.178:23
18#.##1.251.0:23
15#.##8.53.184:23
13.###.31.202:23
69.##.112.140:23
17#.##7.58.132:23
11#.##3.168.133:23
12#.##0.78.101:23
70.###.207.180:23
10#.##4.82.236:23
12#.##.21.254:23
16#.##.186.155:23
16#.##4.158.224:23
18.##2.49.72:23
13#.##.175.148:23
20#.##5.144.163:23
17#.##2.53.133:23
10#.##3.211.130:23
16#.#02.6.22:23
12#.##3.158.82:23
84.##.193.173:23
22#.##4.145.60:23
59.##.182.170:23
20#.#.214.1:23
57.##6.36.71:23
47.##9.10.67:23
15#.#.250.125:23
20#.##5.80.192:23
48.###.169.225:23
17#.#.228.176:23
15#.##2.109.123:23
84.##.92.217:23
93.##.83.132:23
34.###.225.195:23
17#.#2.33.23:23
50.##9.79.81:23
11#.##4.10.48:23
15#.##7.166.179:23
83.###.135.226:23
18#.##4.128.174:23
98.##3.62.50:23
80.##.232.5:23
13#.##.78.228:23
11#.##3.203.192:23
11#.##2.130.124:23
19#.##7.106.73:23
84.##.215.141:23
20#.##.192.224:23
21#.#1.8.133:23
11#.##.134.51:23
22#.##.27.146:23
16#.##7.187.22:23
13#.##9.135.196:23
11#.##1.155.102:23
15#.##8.137.134:23
10#.##7.179.18:23
12#.##0.52.205:23
16#.##.208.33:23
22#.##8.207.208:23
13#.##.233.96:23
21#.##7.174.227:23
13#.##7.80.244:23
19#.##.60.250:23
24.##.255.211:23
12#.##7.134.255:23
11#.##3.44.112:23
14#.##.110.225:23
11#.##.142.115:23
16#.##4.37.22:23
13#.##6.226.156:23
12#.##6.84.25:23
38.###.86.234:23
14#.##2.248.97:23
15#.#6.26.97:23
13#.##.20.103:23
8.###.231.41:23
72.###.179.67:23
12#.#.52.47:23
35.##9.16.44:23
20#.#9.42.3:23
19#.##.130.245:23
14#.##6.1.143:23
13#.##7.89.136:23
18#.##.34.112:23
69.###.168.208:23
96.###.160.22:23
12#.##7.186.148:23
42.###.241.32:23
16#.##3.163.45:23
20#.##0.16.26:23
11#.##1.198.111:23
16#.##3.124.123:23
18#.##7.144.172:23
14#.##.133.102:23
12#.##9.234.10:23
83.###.129.119:23
13#.##.48.245:23
18#.##.247.77:23
18#.##.92.240:23
18#.##5.231.93:23
10#.##.190.38:23
10#.##.153.63:23
20#.##7.180.37:23
14#.#.19.10:23
13#.##4.160.10:23
11#.##.181.95:23
14#.##.22.150:23
20#.##8.154.45:23
14#.##7.14.233:23
1.###.20.31:23
9.###.235.9:23
73.###.207.76:23
16#.##8.230.177:23
13#.##1.147.185:23
14#.##4.127.144:23
96.##0.2.20:23
16#.##8.40.80:23
15#.##1.181.1:23
40.##5.53.66:23
17#.##5.63.70:23
37.###.231.24:23
20#.##.211.91:23
10#.##5.216.114:23
10#.#5.30.79:23
45.##4.18.48:23
12#.##7.148.1:23
13#.#8.1.203:23
16#.#.173.224:23
49.##.45.244:23
20#.##.90.139:23
11#.##5.97.103:23
44.##.154.237:23
18#.##7.99.44:23
88.##3.101.1:23
8.###.115.201:23
21#.##.229.14:23
23.##.179.66:23
12#.##5.151.246:23
19#.##3.154.219:23
44.##.42.155:23
18#.##.247.104:23
12#.##.201.194:23
36.###.11.150:23
94.###.121.150:23
17#.##8.134.31:23
13#.##.213.135:23
19#.##0.89.10:23
87.###.176.133:23
32.##8.6.97:23
17.###.83.172:23
17#.##.10.179:23
83.###.197.114:23
20#.##3.128.63:23
10#.##.167.132:23
20#.##3.228.227:23
18#.##2.155.218:23
75.##.107.37:23
13#.##4.240.182:23
19#.##.142.86:23
15#.##.201.74:23
21#.#.140.95:23
16#.##2.199.27:23
17#.##1.135.163:23
21#.##.198.161:23
13#.##.235.247:23
14#.##3.146.254:23
90.###.127.243:23
11#.##2.157.239:23
21#.##8.156.79:23
17#.##.198.154:23
15#.##.26.223:23
11#.##2.188.137:23
13#.##0.208.53:23
14#.##5.237.218:23
17.##.184.214:23
44.###.11.185:23
72.###.175.188:23
14#.#17.65.9:23
10#.##4.181.255:23
10#.##1.102.250:23
22#.##0.192.63:23
14#.##5.105.245:23
32.###.176.40:23
20#.##6.249.120:23
58.###.128.74:23
13#.##1.130.181:23
39.###.209.239:23
20#.##0.35.85:23
15#.##7.151.23:23
57.###.131.126:23
14#.##.254.209:23
15#.##.112.138:23
11#.##7.237.31:23
18#.#8.4.134:23
14#.##4.43.66:23
18#.##4.195.0:23
21#.##.136.221:23
14#.##.66.215:23
20#.##3.249.144:23
11#.##6.211.210:23
38.##.156.205:23
35.###.99.185:23
10#.##5.175.148:23
11#.##.247.27:23
10#.#4.41.38:23
69.##.13.108:23
90.###.242.255:23
76.###.223.45:23
13#.##.236.164:23
15#.##2.55.193:23
20#.##7.193.178:23
25.###.90.119:23
14#.#.111.70:23
68.###.167.87:23
73.###.121.242:23
84.###.212.199:23
9.###.231.107:23
20#.#04.10.8:23
19#.##9.120.203:23
96.###.247.208:23
16#.##8.172.54:23
12#.##2.92.84:23
12#.##3.236.189:23

Receives data from the following servers:

18#.##2.250.46:9090

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations