Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- /bin/busybox
Kills system processes:
- sshd
Kills the following processes:
- <SAMPLE>
- dhclient
- rpcbind
- rpc.statd
- rpc.idmapd
- atd
- cron
- systemd-logind
- rsyslogd
- acpid
- dbus-daemon
- agetty
- exim4
- bash
- run.sh
- systemd
Network activity:
Establishes connection:
- 19#.##.97.85:9090
- 15#.##.42.193:37215
- 19#.###.195.82:37215
- 15#.##.42.193:37215
- 15#.##.222.251:37215
- 41.###.21.55:37215
- 19#.###.220.23:37215
- 41.##.45.250:37215
- 19#.###.53.215:37215
- 19#.##8.170.4:37215
- 41.##.171.226:37215
- 15#.###.192.122:37215
- 41.###.79.173:37215
- 15#.##.67.219:37215
- 15#.###.51.101:37215
- 15#.##4.37.28:37215
- 41.##.79.40:37215
- 41.###.43.137:37215
- 15#.##.119.140:37215
- 15#.##.123.108:37215
- 41.###.53.253:37215
- 41.#.#4.184:37215
- 41.##.250.242:37215
- 41.###.188.168:37215
- 41.###.238.237:37215
- 15#.###.123.106:37215
- 19#.##9.12.45:37215
- 41.##.102.200:37215
- 19#.##.149.101:37215
- 15#.##.193.139:37215
- 41.##.53.95:37215
- 15#.##.3.168:37215
- 41.##.255.176:37215
- 41.##.27.223:37215
- 41.###.209.85:37215
- 41.##.48.153:37215
- 19#.##.44.48:37215
- 19#.##.5.80:37215
- 41.###.173.0:37215
- 15#.##8.54.57:37215
- 19#.###.100.18:37215
- 19#.##.165.27:37215
- 19#.#.184.36:37215
- 41.###.67.105:37215
- 15#.##.5.12:37215
- 41.###.45.175:37215
- 41.##.95.148:37215
- 19#.###.129.228:37215
- 19#.###.94.108:37215
- 15#.###.44.247:37215
- 19#.###.130.83:37215
- 19#.###.182.175:37215
- 41.##.218.84:37215
- 15#.###.247.105:37215
- 41.###.189.188:37215
- 41.###.152.180:37215
- 19#.###.177.246:37215
- 19#.##.6.197:37215
- 19#.##.235.130:37215
- 19#.###.50.210:37215
- 15#.###.102.85:37215
- 15#.##.82.234:37215
- 41.###.123.143:37215
- 19#.###.71.105:37215
- 15#.###.183.181:37215
- 19#.###.130.55:37215
- 41.###.55.165:37215
- 19#.###.231.212:37215
- 15#.##4.73.8:37215
- 41.##.80.202:37215
- 15#.###.80.179:37215
- 15#.##.30.28:37215
- 41.##.39.127:37215
- 15#.##.229.102:37215
- 15#.###.106.229:37215
- 15#.###.112.12:37215
- 15#.###.234.127:37215
- 41.###.240.101:37215
- 19#.##8.65.56:37215
- 15#.##.60.167:37215
- 41.###.104.149:37215
- 19#.###.46.158:37215
- 41.##.85.133:37215
- 19#.###.251.53:37215
- 15#.##.244.176:37215
- 41.#.#68.30:37215
- 19#.###.46.217:37215
- 41.##.168.49:37215
- 19#.##.127.10:37215
- 41.###.204.218:37215
- 19#.##6.7.204:37215
- 19#.###.66.146:37215
- 19#.###.171.88:37215
- 19#.##1.71.45:37215
- 15#.##.20.161:37215
- 41.###.62.62:37215
- 15#.###.236.27:37215
- 41.###.189.241:37215
- 19#.###.137.214:37215
- 19#.##.86.180:37215
- 15#.###.106.62:37215
- 41.###.239.77:37215
- 15#.##.196.27:37215
- 41.##.12.96:37215
- 41.###.124.169:37215
- 19#.##2.37.32:37215
- 41.##.153.150:37215
- 19#.##.123.202:37215
- 15#.##.80.14:37215
- 41.##.250.105:37215
- 41.##.175.150:37215
- 41.##.104.31:37215
- 15#.###.117.244:37215
- 19#.###.199.107:37215
- 41.###.98.126:37215
- 19#.##.198.167:37215
- 15#.###.26.206:37215
- 19#.##2.6.192:37215
- 15#.###.170.19:37215
- 15#.###.126.25:37215
- 15#.###.254.97:37215
- 41.###.9.119:37215
- 19#.###.36.129:37215
- 19#.###.251.68:37215
- 15#.###.72.151:37215
- 41.###.247.184:37215
- 15#.###.168.80:37215
- 15#.##.53.28:37215
- 19#.##.119.146:37215
- 19#.###.159.227:37215
- 19#.###.207.52:37215
- 15#.##.32.173:37215
- 15#.###.15.185:37215
- 41.##.254.81:37215
- 19#.###.52.139:37215
- 15#.###.76.195:37215
- 15#.###.32.182:37215
- 15#.###.149.146:37215
- 15#.##9.15.39:37215
- 15#.###.136.62:37215
- 41.###.124.242:37215
- 41.###.42.155:37215
- 19#.###.83.148:37215
- 19#.##0.43.7:37215
- 19#.##.184.160:37215
- 41.###.56.87:37215
- 41.###.143.210:37215
- 15#.##.217.87:37215
- 41.###.78.94:37215
- 19#.##.76.196:37215
- 19#.#.51.8:37215
- 41.###.59.137:37215
- 41.##.9.151:37215
- 19#.##.252.178:37215
- 41.##.150.151:37215
- 19#.##0.7.199:37215
- 15#.##4.26.10:37215
- 15#.###.35.228:37215
- 19#.###.25.196:37215
- 15#.###.106.133:37215
- 41.###.13.150:37215
- 41.##.224.80:37215
- 41.##.101.116:37215
- 15#.##9.82.75:37215
- 15#.##.178.56:37215
- 41.##.176.215:37215
- 41.###.19.74:37215
- 19#.###.158.236:37215
- 15#.##.41.157:37215
- 19#.###.115.251:37215
- 15#.##.25.244:37215
- 19#.##.4.160:37215
- 41.###.150.42:37215
- 41.###.74.178:37215
- 15#.##.138.211:37215
- 15#.##.3.174:37215
- 41.##.229.29:37215
- 19#.##.177.240:37215
- 41.###.118.183:37215
- 41.###.71.25:37215
- 41.###.14.107:37215
- 19#.##.103.214:37215
- 15#.##.249.141:37215
- 19#.###.25.218:37215
- 41.##.0.57:37215
- 41.###.31.175:37215
- 15#.###.75.165:37215
- 41.##.64.250:37215
- 19#.###.51.121:37215
- 19#.##.149.223:37215
- 15#.###.39.191:37215
- 15#.###.100.121:37215
- 19#.##.16.24:37215
- 41.##.14.170:37215
- 19#.##.119.92:37215
- 41.###.7.143:37215
- 15#.###.80.236:37215
- 41.###.61.26:37215
- 19#.###.204.125:37215
- 15#.##.15.144:37215
- 15#.#.67.163:37215
- 15#.##.43.39:37215
- 15#.##.119.50:37215
- 41.###.169.252:37215
- 41.###.98.174:37215
- 19#.##.132.214:37215
- 41.##.157.210:37215
- 41.###.61.127:37215
- 19#.###.250.227:37215
- 15#.###.252.247:37215
- 15#.###.192.197:37215
- 15#.##.6.152:37215
- 41.###.238.127:37215
- 41.###.100.152:37215
- 15#.##5.180.5:37215
- 41.##.47.245:37215
- 41.###.115.208:37215
- 15#.###.125.190:37215
- 15#.##.24.200:37215
- 19#.##.134.249:37215
- 15#.##.164.81:37215
- 19#.###.138.202:37215
- 19#.###.142.93:37215
- 15#.##5.6.25:37215
- 15#.##.52.186:37215
- 15#.##.91.152:37215
- 15#.##.134.86:37215
- 41.##.217.46:37215
- 19#.##.73.199:37215
- 19#.##.213.216:37215
- 41.##.77.48:37215
- 19#.###.235.47:37215
- 41.###.175.155:37215
- 15#.##.22.179:37215
- 15#.#.110.131:37215
- 41.###.243.135:37215
- 41.##.32.183:37215
- 15#.###.238.175:37215
- 19#.###.164.20:37215
- 41.##.81.72:37215
- 19#.###.142.112:37215
- 15#.##.134.220:37215
- 41.###.211.184:37215
- 19#.##.165.40:37215
- 19#.###.249.95:37215
- 19#.#.162.67:37215
- 41.###.202.218:37215
- 15#.###.60.184:37215
- 19#.##.175.26:37215
- 19#.###.86.103:37215
- 19#.##.128.249:37215
- 41.###.3.38:37215
- 19#.###.114.37:37215
- 15#.###.201.172:37215
- 15#.##.109.120:37215
- 19#.###.184.63:37215
- 15#.##.213.104:37215
- 15#.###.199.213:37215
- 19#.##4.98.0:37215
- 19#.##1.80.97:37215
- 15#.###.117.118:37215
- 19#.##.145.76:37215
- 15#.###.56.113:37215
- 19#.##3.42.92:37215
- 15#.##0.203.3:37215
- 19#.##.38.68:37215
- 41.##.118.189:37215
- 19#.##.2.27:37215
- 19#.###.132.92:37215
- 15#.###.184.187:37215
- 19#.###.244.107:37215
- 19#.##6.73.23:37215
- 15#.###.118.102:37215
- 41.###.26.1:37215
- 15#.##.204.70:37215
- 15#.###.165.198:37215
- 15#.###.24.158:37215
- 41.###.217.236:37215
- 15#.###.37.229:37215
- 15#.###.66.130:37215
- 15#.##.236.195:37215
- 19#.##6.37.26:37215
- 19#.##.9.220:37215
- 41.#.#73.215:37215
- 19#.##.134.171:37215
- 19#.###.58.134:37215
- 41.###.82.144:37215
- 41.#.#79.83:37215
- 19#.###.80.163:37215
- 19#.###.113.150:37215
- 41.##.62.7:37215
- 41.###.198.207:37215
- 19#.###.146.10:37215
- 19#.###.42.118:37215
- 15#.###.224.42:37215
- 41.##.84.96:37215
- 41.###.225.91:37215
- 15#.###.249.93:37215
- 19#.###.231.237:37215
- 19#.###.167.22:37215
- 15#.###.20.227:37215
- 19#.###.112.109:37215
- 15#.##.85.101:37215
- 41.##.237.36:37215
- 19#.##.134.232:37215
- 19#.###.98.163:37215
- 41.###.95.211:37215
- 15#.#.177.30:37215
- 41.###.185.48:37215
- 41.##.106.96:37215
- 41.##.91.246:37215
- 19#.##.218.10:37215
- 15#.###.103.97:37215
- 15#.##.182.222:37215
- 15#.###.199.182:37215
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
HTTP POST requests:
- http://###.##.##.84/ctrlt/DeviceUpgrade_1
Sends data to the following servers:
- 19#.##.97.85:9090
Other:
Collects information about network activity
