Linux.Siggen.7207

Technical Information

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

e28081

Kills the following processes:

rpcbind
rpc.statd
rpc.idmapd
cron
dbus-daemon
rsyslogd
agetty
lockfile-touch
ntpdate
run.sh
sleep
stub.sh
tee

Network activity:

Awaits incoming connections on ports:

127.0.0.1:33337

Establishes connection:

8.#.8.8:53
45.###.232.208:33335

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

DNS ASK:

ro##me.xyz

Sends data to the following servers:

45.###.232.208:33335
10#.##9.110.3:23
11#.#0.20.55:23
10#.##.241.190:23
25#.##1.75.21:23
37.###.156.254:23
21#.##.188.98:23
22#.##5.251.249:23
14.###.109.99:23
32.###.152.29:23
75.###.194.79:23
23#.##.63.242:23
28.##.225.224:23
18#.##7.140.41:23
28.###.209.215:23
81.##.20.135:23
24.###.132.239:23
61.##9.97.74:23
70.###.209.78:23
91.##.216.172:23
25#.##.144.142:23
4.##.84.131:23
25#.##6.69.19:23
21#.##.211.72:23
22#.##6.186.31:23
11.##.142.84:23
24.##8.5.148:23
77.###.144.168:23
16#.##2.54.79:23
16#.##6.199.40:23
19#.##.245.122:23
10#.##.79.174:23
13#.##.31.169:23
87.###.121.181:23
23#.##5.35.107:23
12#.##.58.106:23
24#.##.16.108:23
24#.#7.115.5:23
11#.##.44.177:23
30.##.246.154:23
16#.##.30.175:23
50.##.144.46:23
25#.##.28.222:23
13.##1.48.28:23
32.###.195.53:23
10#.##.23.225:23
20.##.243.243:23
60.###.36.113:23
35.###.78.248:23
16#.#5.181.6:23
15#.##.156.187:23
13#.##3.75.100:23
18#.##5.154.189:23
36.##.192.52:23
35.###.233.122:23
17#.##2.151.129:23
24#.##9.42.33:23
41.##.253.62:23
34.###.99.174:23
24#.##.152.107:23
51.###.150.138:23
21#.#73.42.3:23
66.##.101.113:23
17.#.14.63:23
14#.##.251.150:23
77.###.202.81:23
91.###.59.169:23
12#.##.17.232:23
11#.##.125.236:23
19#.##6.114.141:23
19#.#0.2.246:23
14#.##.127.226:23
25#.##0.59.68:23
44.##.231.176:23
21#.#9.57.72:23
5.###.250.152:23
1.###.85.167:23
68.###.226.28:23
16#.##5.38.184:23
18#.##0.182.216:23
15.###.34.229:23
15#.##1.116.91:23
17#.##.202.83:23
36.##1.4.219:23
61.###.201.240:23
23#.##5.248.174:23
10#.##9.11.89:23
14#.##0.168.188:23
19#.##3.41.111:23
74.###.171.83:23
76.###.248.96:23
96.##.251.13:23
23.###.199.119:23
14#.#9.1.25:23
36.##1.9.40:23
65.##.158.28:23
21#.##5.159.140:23
16#.##.95.253:23
22.###.151.180:23
56.###.52.149:23
10#.##0.57.123:23
21#.#0.20.12:23
13#.##2.44.226:23
11.##.168.180:23
13#.##.126.111:23
70.#.25.63:23
20#.##.191.221:23
10#.#.181.67:23
20#.##.99.229:23
79.##.247.242:23
41.###.174.60:23
10#.##1.222.186:23
20#.##2.12.159:23
19#.##5.155.238:23
93.###.233.82:23
23#.##4.60.89:23
33.##.139.39:23
19#.##6.52.52:23
13#.##.107.249:23
80.###.246.243:23
24#.#3.87.50:23
21#.##1.149.160:23
4.##.225.53:23
12#.##2.245.144:23
23#.#2.89.24:23
85.###.200.19:23
23#.##0.228.143:23
11#.##4.19.237:23
17#.##.92.199:23
10#.##3.210.61:23
22#.##4.204.222:23
13#.##.202.181:23
20#.##8.219.236:23
31.##.152.69:23
18#.##.74.103:23
90.###.157.205:23
68.###.28.159:23
18#.##6.39.118:23
13#.##3.169.146:23
25#.##0.231.204:23
20#.##5.244.35:23
54.##.128.174:23
66.##.51.187:23
15#.##0.29.221:23
21#.##2.160.62:23
17#.##.188.177:23
30.##6.1.136:23
34.###.151.249:23
23#.##2.201.61:23
10#.##.223.165:23
51.##.220.146:23
51.##.25.82:23
14.##.3.99:23
25#.#.108.97:23
16#.##1.226.62:23
19#.##.23.247:23
32.###.29.217:23
14#.##7.141.141:23
17#.##5.221.25:23
88.##.186.178:23
20#.##.39.143:23
11#.##5.13.210:23
68.##9.85.29:23
24#.#2.95.59:23
11#.##4.46.251:23
16#.#.109.56:23
10#.##6.238.234:23
20#.##9.222.120:23
46.##7.42.97:23
37.###.109.50:23
22#.##.15.177:23
74.###.95.201:23
13.###.201.217:23
17.##.159.141:23
13#.##0.194.8:23
30.#.23.162:23
11#.##.145.109:23
14#.#.34.93:23
19#.##0.103.128:23
12#.##.103.181:23
11.###.110.122:23
5.###.93.45:23
14#.#.218.251:23
18#.##2.242.191:23
11#.##3.209.62:23
13#.##8.132.99:23
13#.##.87.224:23
84.##.190.160:23
20#.##8.180.200:23
13#.##.233.55:23
89.###.231.62:23
99.##.178.70:23
19#.##6.98.72:23
14#.##8.156.114:23
86.###.113.24:23
4.###.9.171:23
18#.##.206.50:23
19#.##.231.234:23
17#.##3.29.75:23
97.##.32.24:23
17#.##.189.31:23
41.##2.81.6:23
15#.##1.13.30:23
88.###.161.206:23
87.##.27.86:23
11#.##4.14.24:23
24#.##8.42.111:23
19#.##1.95.186:23
15#.##8.18.14:23
27.##.116.118:23
19#.#7.72.65:23
18#.##5.10.165:23
25#.##3.145.220:23
87.##.238.21:23
13#.##.55.168:23
23.##.207.245:23
51.###.161.81:23
24#.##.35.111:23
13#.##.25.171:23
81.###.139.230:23
22#.##5.246.17:23
30.###.183.178:23
60.##.0.37:23
20#.#36.20.0:23
22#.##8.17.214:23
16#.##5.67.75:23
4.###.158.79:23
92.##8.7.89:23
6.###.158.234:23
52.###.38.127:23
22#.##6.50.234:23
34.###.59.183:23
13#.##6.62.240:23
55.###.177.214:23
16#.##.198.201:23
50.###.164.21:23
25#.##4.204.216:23
10#.##9.44.220:23
21#.#3.23.35:23
19#.##2.81.181:23
15#.##.172.189:23
17.###.75.126:23
55.###.108.124:23
33.##.121.187:23
21#.##3.86.128:23
65.##.212.42:23
21#.##3.34.89:23
26.###.202.96:23
20#.##2.65.39:23
18#.#69.98.1:23
16.##1.66.70:23
10#.##.138.213:23
25#.##1.43.143:23
78.##9.41.64:23
11#.##8.24.107:23
48.##.236.222:23
33.##.31.137:23
19#.##4.17.109:23
71.###.156.111:23
18#.##4.89.198:23
16#.#2.153.7:23
22#.##4.232.93:23
13.###.108.246:23
59.###.39.218:23
32.##.171.153:23
14#.#.86.169:23
79.###.228.201:23
64.##.70.80:23
85.###.249.31:23
20#.##.109.25:23
24#.##9.206.53:23
18#.##.227.165:23
11#.##1.44.254:23
25#.##9.152.153:23
11#.##5.34.219:23
11#.##5.194.181:23
45.##.187.68:23
13#.##2.98.75:23
21#.##0.108.169:23
12#.##2.140.201:23
13#.##3.182.112:23
18#.##.66.222:23
35.###.68.145:23
33.###.155.153:23
15#.##9.84.38:23
17#.#.112.228:23
19#.##2.197.94:23
20#.##3.131.177:23
47.##.91.96:23
22#.##2.220.205:23
11.###.215.63:23
68.##.7.10:23
34.###.209.42:23
14#.#50.53.7:23
44.###.151.230:23
17#.##9.59.162:23
10#.##6.39.202:23
40.##4.31.47:23
24#.##9.215.14:23
4.##.90.37:23
99.###.111.223:23
51.##1.9.247:23
5.##.46.24:23
66.###.212.223:23
86.###.230.185:23
24#.##3.131.200:23
25#.##.115.159:23
6.###.87.208:23
94.##.93.64:23
51.##1.98.78:23
94.##.189.134:23
10#.##1.23.15:23
19#.##9.169.212:23
20.##.136.128:23
45.###.124.34:23
24#.##2.128.108:23
18#.##.150.12:23
24#.#.165.28:23
33.###.101.131:23
79.###.194.131:23
21#.##4.140.134:23
90.##.123.1:23
15#.##.55.141:23
2.##.35.218:23
31.###.208.121:23
36.###.240.52:23
12.###.230.241:23
12#.##4.174.183:23
12#.##0.83.233:23
24#.##6.51.65:23
16#.##3.216.211:23
71.##.104.231:23
61.###.52.184:23
99.##8.0.58:23
18#.##6.112.129:23
10#.#5.115.0:23
67.###.70.172:23
33.##.69.242:23
36.###.207.200:23
25.##.156.218:23
83.###.129.44:23
54.##.70.86:23
4.###.140.205:23
19#.##9.251.148:23
68.##5.81.42:23
19#.##9.88.205:23
10#.##4.22.193:23
41.##.131.242:23
14.###.254.90:23
16#.##4.7.160:23
82.###.244.137:23
23#.##3.56.246:23
23#.##.17.223:23
20#.##.197.45:23
66.###.32.210:23
62.##4.21.76:23
12#.##6.50.90:23
24#.##7.130.253:23
24#.#2.2.208:23
73.##.152.3:23
24#.#.93.45:23
23#.##2.246.110:23
13#.##2.73.146:23
10#.##0.45.83:23
61.###.141.168:23
35.##4.30.23:23
19#.##.143.73:23
22#.##5.118.127:23
14#.##3.4.104:23
24#.##.66.240:23
17#.##6.208.76:23
98.##.152.2:23
24#.##8.44.252:23
58.##.217.101:23
57.###.255.199:23
10#.##0.80.13:23
11.##.103.8:23
22.##.250.198:23
69.###.184.131:23
79.##.36.214:23
17#.##.163.13:23
13#.##7.165.51:23
13.##.45.219:23
16.###.174.62:23
16#.##.184.224:23
21#.##7.14.192:23
20#.#6.175.7:23
93.###.216.174:23
23#.##2.25.122:23
17#.##.117.119:23
20#.##8.36.63:23
22#.##0.225.4:23
16#.#3.56.73:23
14#.##6.226.160:23
14#.#.8.113:23
24#.##3.184.51:23
17#.##2.116.220:23
12.###.110.97:23
13#.##.64.255:23
24.##.16.205:23
16#.##3.156.85:23
52.##.61.123:23
12#.##1.62.205:23
16.###.123.164:23
15#.##4.30.159:23
23#.#.133.57:23
13#.##8.145.230:23
17#.#.97.205:23
14#.##9.184.189:23
78.###.173.241:23
19#.##8.255.98:23
16#.##7.45.160:23
1.##.227.203:23
11#.##.132.97:23
21#.##3.159.181:23
79.###.73.128:23
10#.##.26.156:23
12#.#.130.255:23
13#.##4.157.106:23
11#.##.124.229:23
16#.##.36.132:23
45.##.17.216:23
11#.##2.66.155:23
14#.##.65.192:23
24.###.109.91:23
12#.##8.57.95:23
72.##.95.174:23
21#.##.91.221:23
93.##.4.41:23
12#.##0.80.76:23
12#.##0.211.209:23
15#.##4.61.71:23
14#.#.239.55:23
27.###.123.46:23
19#.##1.172.157:23
22#.#9.17.59:23
28.###.146.209:23
13#.##1.102.189:23
22#.##0.175.29:23
15.###.47.206:23
23#.##8.240.74:23
67.##0.0.68:23
12#.##8.19.245:23
45.###.156.238:23
13#.##.34.107:23
47.###.73.186:23
50.##.141.7:23
60.###.140.72:23
24#.##.158.13:23
74.###.12.219:23
23#.#3.12.61:23
11#.##.25.213:23
12.##.34.192:23
15#.##.51.255:23
25#.##3.220.199:23
10#.##4.31.243:23
21#.##3.165.254:23
11#.##1.168.15:23
11#.##.125.162:23
37.##.144.187:23
17#.##5.2.181:23
75.##4.12.49:23
48.###.207.141:23
10#.##6.218.178:23
25#.##2.68.92:23
16#.##.208.66:23
19#.##1.49.193:23
17#.##3.59.93:23
86.###.69.253:23
21#.##6.208.205:23
24#.#8.168.6:23
15#.##0.15.36:23
20#.#.147.194:23
90.###.164.241:23
17#.##.242.113:23
20#.##9.151.176:23
14#.##.122.213:23
17#.##7.151.222:23
24#.##6.175.7:23
63.###.192.203:23
25#.##6.80.193:23
14#.##8.206.211:23
23#.#.85.37:23
23#.##.34.136:23
1.###.255.91:23
21.###.58.139:23
13#.##.18.255:23
95.##.171.197:23
21#.##.115.97:23
21#.##7.127.1:23
19#.##.222.35:23
24#.##.211.201:23
25#.#0.38.0:23
10#.##9.73.16:23
19#.##.206.11:23
37.###.137.234:23
20#.##.210.211:23
17.###.149.99:23
14#.##2.42.128:23
76.##.16.149:23
13#.##3.18.38:23
19.###.226.126:23
15#.##4.154.125:23
12#.##.75.145:23
16#.##8.127.248:23
48.##.250.159:23
11#.##6.242.135:23
23#.##.170.50:23
13#.##3.254.202:23
17#.##.20.246:23
13#.##9.218.206:23
25#.##.225.65:23
85.###.227.33:23

Receives data from the following servers:

45.###.232.208:33335

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations