Linux.Mirai.3078

Technical Information

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

/bin/busybox

Launches processes:

/bin/sh -c cd /bin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
cat tftp
cat <SAMPLE_FULL_PATH>
/bin/sh -c cd /bin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
cat rm
/bin/sh -c cd /bin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
cat kill
/bin/sh -c cd /sbin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
/bin/sh -c cd /sbin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
/bin/sh -c cd /sbin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill

Kills system processes:

sshd

Kills the following processes:

agetty
exim4
bash
run.sh
<SAMPLE>
systemd

Performs operations with the file system:

Creates or modifies files:

/bin/tftp-cpy
/bin/tftp
/bin/rm-cpy
/bin/rm
/bin/kill-cpy
/bin/kill
/sbin/tftp-cpy
/sbin/tftp
/sbin/rm-cpy
/sbin/rm
/sbin/kill-cpy
/sbin/kill

Network activity:

Establishes connection:

19#.##.97.85:9090
15#.###.163.207:37215
19#.###.163.207:37215
15#.##.84.214:37215
15#.###.115.91:37215
41.##.250.50:37215
19#.##.94.106:37215
41.#.#1.224:37215
19#.###.26.208:37215
19#.###.48.252:37215
41.##.59.249:37215
15#.##.53.47:37215
41.##.32.17:37215
15#.#.195.111:37215
15#.###.251.237:37215
15#.##.180.134:37215
41.###.123.211:37215
41.###.199.128:37215
15#.###.26.251:37215
15#.##6.83.78:37215
41.###.131.232:37215
41.##.150.245:37215
41.##.67.35:37215
41.##.40.26:37215
41.###.193.206:37215
15#.##.239.159:37215
19#.##.230.74:37215
41.###.185.221:37215
19#.##.45.109:37215
15#.##5.17.67:37215
41.###.96.180:37215
15#.###.125.55:37215
41.###.134.10:37215
41.###.8.31:37215
41.##.146.46:37215
41.##.39.10:37215
19#.##5.197.5:37215
19#.###.145.117:37215
41.##.197.140:37215
15#.###.89.140:37215
19#.##.52.30:37215
19#.###.126.239:37215
19#.##.6.21:37215
41.###.175.178:37215
15#.##.182.161:37215
41.###.181.197:37215
41.###.15.102:37215
19#.##.234.184:37215
19#.##.222.171:37215
15#.###.217.198:37215
19#.##.110.1:37215
19#.###.219.12:37215
41.##.33.244:37215
15#.##5.58.28:37215
41.###.61.102:37215
41.##.150.141:37215
19#.##6.2.193:37215
19#.##.197.226:37215
19#.###.192.196:37215
19#.##.223.154:37215
15#.###.114.88:37215
15#.###.195.246:37215
41.###.185.164:37215
19#.###.90.198:37215
15#.###.188.94:37215
19#.###.52.110:37215
41.###.44.23:37215
19#.###.107.62:37215
15#.###.147.53:37215
41.###.60.10:37215
15#.##.223.50:37215
15#.###.235.210:37215
41.###.255.93:37215
15#.##.98.133:37215
15#.###.22.191:37215
15#.###.199.170:37215
15#.###.147.152:37215
41.##.175.188:37215
19#.###.191.41:37215
15#.##.21.4:37215
41.##.35.243:37215
19#.##.9.1:37215
41.##.203.159:37215
19#.###.88.117:37215
15#.##.137.96:37215
41.###.152.95:37215
19#.###.109.232:37215
41.###.111.133:37215
19#.###.25.220:37215
41.###.89.11:37215
19#.###.118.10:37215
19#.###.107.24:37215
19#.##.11.55:37215
19#.##.9.26:37215
15#.#.91.96:37215
41.###.65.253:37215
15#.##7.69.69:37215
41.###.65.214:37215
19#.###.23.128:37215
19#.##.39.112:37215
15#.###.235.238:37215
41.##.42.112:37215
15#.###.129.229:37215
41.###.83.205:37215
41.###.250.136:37215
19#.##.250.5:37215
41.###.232.171:37215
19#.##.91.208:37215
15#.##.131.24:37215
41.##.195.13:37215
41.##.58.37:37215
41.###.70.98:37215
15#.###.55.170:37215
19#.###.246.68:37215
41.##.15.191:37215
19#.##.84.58:37215
15#.##.164.250:37215
19#.###.141.222:37215
15#.##.127.19:37215
15#.###.192.49:37215
15#.###.196.53:37215
41.###.187.123:37215
19#.###.239.143:37215
19#.###.109.188:37215
15#.###.170.160:37215
41.##.235.16:37215
15#.##7.23.52:37215
15#.###.141.48:37215
19#.###.250.35:37215
19#.##1.7.170:37215
19#.###.223.34:37215
15#.##9.35.76:37215
15#.###.118.253:37215
41.###.146.24:37215
19#.##.210.78:37215
15#.###.161.12:37215
15#.##.52.249:37215
15#.###.252.252:37215
15#.##.117.212:37215
15#.##0.8.19:37215
41.###.158.13:37215
41.###.45.222:37215
19#.##.153.150:37215
19#.###.146.70:37215
19#.##.84.62:37215
41.##.8.249:37215
41.##.231.129:37215
15#.##.91.46:37215
41.#.#0.99:37215
19#.##0.187.9:37215
19#.##.111.14:37215
41.###.176.155:37215
41.##.88.10:37215
41.###.95.230:37215
41.###.29.182:37215
15#.###.166.191:37215
15#.##.215.205:37215
19#.##0.40.39:37215
41.###.23.82:37215
15#.###.194.153:37215
15#.###.57.161:37215
41.##.145.172:37215
41.###.58.35:37215
19#.##9.4.198:37215
19#.##3.52.4:37215
41.##.159.49:37215
15#.##.129.65:37215
15#.###.215.102:37215
15#.###.65.169:37215
41.###.32.130:37215
41.###.46.228:37215
19#.###.54.130:37215
41.##.136.245:37215
15#.##.141.250:37215
19#.##.161.156:37215
15#.##.132.175:37215
19#.##.238.122:37215
41.##.187.99:37215
15#.##0.55.49:37215
19#.###.138.255:37215
41.##.129.84:37215
15#.##.200.251:37215
41.###.193.60:37215
41.##.210.142:37215
41.###.163.187:37215
41.##.22.87:37215
41.##.34.199:37215
41.###.87.1:37215
15#.###.139.44:37215
41.##.248.30:37215
19#.###.113.66:37215
19#.###.209.119:37215
41.##.211.110:37215
41.##.148.122:37215
19#.##4.185.4:37215
41.##.189.186:37215
41.##.101.209:37215
41.#.#0.236:37215
15#.###.207.82:37215
15#.###.139.92:37215
15#.###.188.31:37215
41.###.28.236:37215
41.##.213.123:37215
15#.###.57.106:37215
41.###.12.212:37215
41.##.226.196:37215
15#.###.36.139:37215
41.###.112.49:37215
41.###.56.73:37215
19#.##.84.168:37215
19#.###.123.194:37215
41.##.244.239:37215
41.###.80.215:37215
15#.##.159.123:37215
41.###.128.102:37215
41.###.149.164:37215
15#.###.221.252:37215
41.###.144.227:37215
41.##.167.216:37215
19#.###.211.104:37215
19#.###.252.53:37215
15#.##.139.118:37215
19#.##3.56.54:37215
41.##.122.120:37215
15#.###.58.137:37215
19#.###.140.100:37215
19#.###.242.29:37215
19#.###.195.118:37215
19#.##5.3.8:37215
15#.###.246.93:37215
41.###.5.254:37215
19#.##.180.195:37215
15#.###.60.186:37215
41.#.#8.213:37215
19#.##.172.12:37215
41.###.161.220:37215
19#.###.213.231:37215
15#.##2.63.21:37215
41.##.226.237:37215
19#.###.57.209:37215
41.###.17.234:37215
15#.###.35.218:37215
41.###.129.186:37215
19#.##.230.224:37215
41.###.22.156:37215
19#.##0.10.78:37215
15#.##.123.141:37215
19#.##3.32.89:37215
19#.#.218.243:37215
15#.###.30.181:37215
19#.##.157.134:37215
15#.###.131.154:37215
19#.##.216.149:37215
41.###.80.53:37215
15#.##9.10.51:37215
41.##.150.236:37215
19#.##.38.180:37215
41.###.27.50:37215
15#.###.205.41:37215
41.##.32.203:37215
15#.##4.21.38:37215
41.###.252.111:37215
19#.###.231.41:37215
41.###.150.168:37215
41.###.16.41:37215
15#.###.212.168:37215
15#.###.227.154:37215
41.###.180.70:37215
19#.###.167.240:37215
19#.###.117.26:37215
19#.##.103.171:37215
19#.###.20.247:37215
41.###.74.172:37215
41.###.101.59:37215
41.##.236.7:37215
15#.##.135.134:37215
41.##.54.214:37215
15#.###.182.22:37215
41.###.24.102:37215
41.###.230.190:37215
15#.##5.99.82:37215
15#.##.254.97:37215
19#.##.179.169:37215
19#.###.204.54:37215
41.###.153.59:37215
15#.##.225.227:37215
19#.###.90.116:37215
19#.##.78.200:37215
15#.##.33.94:37215
41.###.83.130:37215
19#.###.60.167:37215
19#.##.194.73:37215
19#.##.199.49:37215
19#.###.101.58:37215
41.###.48.16:37215
15#.##.57.130:37215
15#.##.242.114:37215
19#.###.102.122:37215
41.###.149.43:37215
15#.###.66.176:37215
41.###.163.246:37215
41.###.15.190:37215
15#.##.24.216:37215
41.###.249.33:37215
41.#.#3.59:37215
19#.###.90.142:37215
41.##.249.212:37215
19#.##.124.47:37215
19#.###.120.172:37215
41.##.97.9:37215
41.##.201.133:37215
15#.###.121.103:37215
19#.###.234.212:37215
41.##.80.39:37215
15#.##.183.156:37215
41.###.156.191:37215
19#.##2.7.53:37215
19#.##.158.184:37215
41.###.242.47:37215
15#.##.226.103:37215
41.##.240.57:37215
19#.##.42.30:37215
15#.###.227.199:37215
19#.###.219.141:37215
19#.##8.87.98:37215
41.###.5.142:37215
19#.##.106.65:37215
41.###.126.196:37215
15#.###.202.150:37215
41.###.141.80:37215
15#.###.227.40:37215
19#.###.241.54:37215
41.##.193.251:37215
15#.###.62.164:37215
41.###.123.24:37215
41.##.112.78:37215
19#.##.160.129:37215
15#.#.188.17:37215
19#.##.160.35:37215
19#.###.232.136:37215
19#.##.168.173:37215
15#.###.190.194:37215
15#.##.17.63:37215
15#.##8.0.172:37215
41.###.51.15:37215
41.###.63.59:37215
19#.##.60.233:37215
41.###.11.79:37215
19#.##.151.0:37215
15#.###.20.100:37215
19#.###.187.90:37215
19#.##7.99.58:37215
15#.##.5.220:37215
15#.###.52.121:37215
19#.##0.21.61:37215
41.###.52.152:37215
19#.###.197.183:37215
41.##.9.139:37215
41.###.56.8:37215
19#.##.143.91:37215
15#.###.211.67:37215
19#.###.250.49:37215
15#.###.232.106:37215
19#.###.115.171:37215
41.###.26.238:37215
19#.###.88.240:37215
41.###.119.194:37215
41.#.#31.167:37215
19#.##.142.136:37215
19#.###.114.185:37215
41.###.66.212:37215
15#.##1.84.25:37215
19#.###.240.17:37215
19#.##.115.213:37215
41.###.57.219:37215
19#.###.127.255:37215
19#.###.158.87:37215
41.###.129.243:37215
19#.##.21.97:37215
15#.##.52.208:37215
41.###.238.202:37215
41.##.140.226:37215
41.###.149.52:37215
19#.##9.17.6:37215
19#.##.21.110:37215
19#.###.52.227:37215
41.###.14.236:37215
19#.##.243.156:37215
41.###.47.105:37215
19#.##.185.30:37215
41.##.185.151:37215
19#.###.183.149:37215
15#.###.234.140:37215
41.###.43.240:37215
15#.##.201.1:37215
19#.##2.53.31:37215
15#.###.39.255:37215
15#.##.187.135:37215
15#.##.86.172:37215
15#.###.100.64:37215
19#.##5.49.52:37215
15#.###.27.243:37215
15#.###.105.126:37215
19#.###.197.23:37215
41.###.77.58:37215
15#.###.215.245:37215
41.##.146.210:37215
19#.##3.183.8:37215
41.###.87.97:37215
19#.###.223.113:37215
19#.##.233.137:37215
15#.##.115.103:37215
19#.##.220.37:37215
19#.##.212.114:37215
15#.###.181.188:37215
19#.###.24.201:37215
41.###.225.20:37215
41.###.143.142:37215
41.###.76.102:37215
41.###.101.161:37215
15#.###.125.100:37215
41.##.156.65:37215
41.###.145.200:37215
41.###.222.28:37215
15#.##.127.246:37215
41.##.94.205:37215
15#.##.242.166:37215
19#.##7.16.87:37215
41.##.172.245:37215
41.###.85.128:37215
19#.##.84.194:37215
15#.###.123.166:37215
41.##.26.32:37215
41.###.24.182:37215
41.###.48.80:37215
15#.##.45.110:37215
15#.##1.25.11:37215
41.###.187.67:37215
41.###.115.206:37215
15#.##.182.132:37215
19#.#.184.127:37215
15#.###.253.21:37215
41.##.221.170:37215
19#.###.245.214:37215
19#.##.21.234:37215
19#.###.128.16:37215
19#.##0.23.46:37215
19#.###.170.172:37215
41.##.89.252:37215
41.##.45.3:37215
19#.##8.7.68:37215
19#.###.110.254:37215
15#.#.147.246:37215
15#.###.90.150:37215
19#.###.215.130:37215
15#.##.111.98:37215
19#.##1.0.195:37215
15#.###.133.196:37215
41.###.124.225:37215
41.###.194.136:37215
19#.###.50.163:37215
41.##.216.57:37215
15#.##.247.15:37215
41.###.74.220:37215
19#.##.35.52:37215
15#.##.98.18:37215
19#.##3.24.62:37215
19#.###.41.162:37215
15#.###.161.38:37215
41.###.25.16:37215
19#.##.160.173:37215
15#.##0.68.27:37215
15#.##.244.151:37215
19#.##0.19.33:37215
41.###.66.118:37215
41.###.227.51:37215
15#.##.81.150:37215
41.###.0.63:37215
41.##.53.154:37215
15#.###.119.18:37215
41.##.215.95:37215
15#.##.21.210:37215
15#.##1.37.7:37215
19#.###.62.139:37215
15#.##.56.250:37215
15#.###.152.234:37215
19#.###.33.106:37215
15#.###.240.229:37215
19#.##1.59.18:37215
15#.##.26.92:37215
41.###.253.16:37215
15#.##.155.117:37215
19#.###.59.144:37215
41.###.17.24:37215
15#.##9.67.23:37215
15#.###.150.110:37215
15#.###.237.77:37215
41.##.70.153:37215
19#.##6.11.24:37215
15#.###.126.12:37215
41.##.135.101:37215
41.###.206.175:37215
41.###.3.46:37215
15#.###.161.187:37215
19#.###.100.21:37215
41.###.139.8:37215
15#.###.165.230:37215
41.##.15.19:37215
19#.###.149.178:37215
41.###.99.175:37215
41.##.3.137:37215
19#.##9.57.60:37215
15#.##.233.38:37215
41.###.18.249:37215
41.###.204.89:37215
19#.##.68.89:37215
15#.##.117.69:37215
15#.###.98.103:37215
41.###.252.121:37215
41.###.152.129:37215
15#.##5.75.87:37215
19#.###.221.234:37215
15#.###.149.13:37215
15#.##.39.81:37215
15#.###.55.131:37215
19#.###.103.191:37215
19#.##.214.52:37215
41.###.251.247:37215
15#.###.111.26:37215
15#.##.134.7:37215
19#.##2.49.96:37215
19#.##.224.243:37215
19#.###.96.146:37215
15#.###.207.214:37215
41.###.44.99:37215
15#.##.169.203:37215
15#.###.157.239:37215
41.###.63.133:37215
15#.###.112.54:37215
19#.###.123.44:37215
15#.##.202.134:37215
19#.###.166.208:37215
41.###.63.151:37215
41.###.103.167:37215
41.###.56.53:37215
15#.##.218.197:37215
15#.##3.41.33:37215
19#.##.30.149:37215
19#.#.138.155:37215
15#.##4.99.23:37215
15#.###.86.125:37215
41.###.105.207:37215
19#.###.142.84:37215
19#.##.195.145:37215
41.##.10.229:37215
19#.###.168.55:37215
41.###.98.65:37215
41.#.#1.131:37215
19#.###.253.235:37215
19#.###.179.63:37215
41.###.88.145:37215
15#.###.248.62:37215
41.###.102.96:37215
41.##.35.25:37215
41.###.171.45:37215
19#.##.211.83:37215
19#.###.161.181:37215
15#.###.237.127:37215
41.###.178.69:37215
19#.##2.60.79:37215
41.##.193.233:37215
19#.###.139.149:37215
19#.##.242.24:37215
41.###.223.60:37215
19#.##.26.181:37215
19#.#.231.237:37215
41.##.238.127:37215
41.###.201.71:37215
19#.###.43.136:37215
41.###.116.89:37215
41.##.150.238:37215
41.##.106.23:37215
41.###.115.239:37215
15#.##.140.170:37215
41.###.82.40:37215
15#.##.193.199:37215
19#.###.171.18:37215
41.###.138.255:37215
41.###.49.189:37215
41.###.215.251:37215
19#.##.234.62:37215
41.##.9.72:37215
41.##.191.52:37215
15#.#.176.252:37215
41.#.#99.104:37215
19#.##.165.85:37215
15#.##7.17.1:37215
41.###.76.221:37215
41.###.236.17:37215

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

Sends data to the following servers:

19#.##.97.85:9090

Receives data from the following servers:

19#.##.97.85:9090

Other:

Collects information about network activity

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению