Linux.Packed.1005

Technical Information

Malicious functions:

Removes itself

Launches itself as a daemon

Substitutes application name for:

/lib/systemd/systemd-logind

Kills the following processes:

<SAMPLE>

Performs operations with the file system:

Creates or modifies files:

<SAMPLE_FULL_PATH>

Network activity:

Awaits incoming connections on ports:

19#.##8.213.50:3467

Establishes connection:

8.#.8.8:53
18#.###.111.199:4321
18#.###.111.199:7685

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

Sends data to the following servers:

18#.###.111.199:4321
18#.###.111.199:7685
0.0.0.0:0
14#.##3.68.35:23
70.##.100.247:23
22#.##.172.180:23
15#.##6.67.232:23
18#.##5.42.191:23
17#.##6.200.168:23
15#.##0.115.83:23
26.##.196.27:23
7.###.200.94:23
41.###.159.66:23
16#.##7.188.121:23
14#.##.63.244:23
21#.##.210.49:23
17#.##7.221.220:23
21#.##.55.237:23
18#.##3.12.13:23
85.###.37.213:23
12#.##5.188.88:23
14#.#3.41.52:23
55.##.184.44:23
18#.##0.240.114:23
64.##.113.124:23
18#.##9.174.127:23
48.##.52.55:23
22#.##.139.122:23
12#.##.39.242:23
87.##.100.186:23
58.##.27.152:23
67.###.11.127:23
11#.##3.227.29:23
15#.##0.78.88:23
22#.##3.206.146:23
21#.##0.100.155:23
46.###.38.101:23
45.###.228.189:23
71.#.121.13:23
10#.##2.99.211:23
16#.#.107.249:23
93.##5.9.13:23
10#.##6.209.56:23
13.#.241.41:23
22#.##.88.119:23
15#.##6.205.195:23
26.###.96.146:23
75.##.248.178:23
18#.#05.9.70:23
11#.#6.13.65:23
15#.##7.205.173:23
14#.##4.203.255:23
33.###.139.59:23
18#.##7.243.136:23
96.###.198.95:23
33.###.209.134:23
13#.##2.45.78:23
24#.##8.101.43:23
13.#.201.61:23
3.##.166.147:23
22.###.143.14:23
14#.##.115.96:23
14#.##.125.120:23
78.###.251.243:23
8.###.148.0:23
67.##1.252.2:23
11#.##.207.117:23
21#.##3.253.90:23
15#.##8.236.153:23
20#.##3.111.153:23
25#.#9.1.139:23
37.###.176.41:23
23#.##6.251.228:23
22#.##.224.234:23
20#.##2.115.251:23
21#.##9.80.13:23
67.###.50.246:23
76.###.222.217:23
18#.##5.196.226:23
12#.##.19.135:23
19#.##7.192.108:23
13#.##5.67.67:23
22#.##4.240.192:23
17#.#9.91.2:23
44.##.226.108:23
16#.##.169.239:23
22#.##7.148.37:23
10#.#89.61.2:23
22#.##.156.65:23
18#.##.66.178:23
15#.##.37.153:23
23#.##0.114.29:23
14#.##8.162.224:23
49.###.146.85:23
13#.##5.143.120:23
1.##.48.140:23
24#.##0.24.192:23
12#.#3.98.62:23
21#.#1.240.6:23
25#.##1.108.236:23
24#.##1.245.185:23
15#.##.101.69:23
12#.##.87.247:23
2.##.23.47:23
17#.##5.82.56:23
89.###.244.10:23
13#.##0.190.226:23
24#.##3.153.133:23
23#.##5.154.228:23
18#.##.217.57:23
20#.##.110.125:23
90.##.166.185:23
17#.##9.100.113:23
10#.##9.234.55:23
23.###.19.250:23
10#.##.134.14:23
24#.##4.87.10:23
17#.#.123.81:23
22#.##.77.205:23
19#.##7.82.121:23
16#.##7.251.26:23
16#.##.123.169:23
20.##.37.187:23
14#.##1.233.124:23
3.###.222.15:23
19#.##9.20.132:23
12#.##1.60.115:23
14#.##.130.24:23
14#.##8.138.148:23
21#.##.54.197:23
24#.#7.15.64:23
68.###.142.226:23
24#.##5.93.58:23
16#.##7.239.105:23
25#.##.17.146:23
14.###.254.134:23
13#.##.29.110:23
18#.##.252.181:23
22#.##3.48.149:23
12#.##6.72.220:23
13#.##.147.207:23
10#.##2.121.221:23
98.##9.65.42:23
11#.##0.155.150:23
25.###.137.236:23
5.###.223.96:23
50.##.176.188:23
68.##.120.29:23
50.###.109.193:23
21#.##3.59.32:23
14#.##2.231.181:23
45.#.222.226:23
13#.##9.234.35:23
14#.##7.46.88:23
16#.##.58.193:23
66.###.70.231:23
59.###.78.147:23
43.###.151.140:23
20#.##.45.193:23
24#.##.216.178:23
20#.##2.120.8:23
31.###.212.40:23
11#.##1.203.55:23
12#.##2.255.36:23
13.##.167.65:23
11#.##.196.111:23
10#.##6.102.239:23
24#.#9.80.21:23
19#.#2.224.0:23
23#.##.128.235:23
12#.##.169.35:23
23#.#5.84.16:23
83.###.178.164:23
22#.##7.203.184:23
64.##3.78.56:23
12#.##7.225.39:23
41.###.129.135:23
81.###.161.179:23
10#.##2.221.95:23
7.###.96.248:23
89.###.18.190:23
53.###.165.252:23
12#.##.76.147:23
15#.##.214.169:23
17#.##2.43.214:23
14#.##8.235.232:23
87.###.135.130:23
64.###.168.214:23
77.##.161.193:23
99.###.207.236:23
12.###.241.163:23
30.###.108.176:23
23#.##0.176.184:23
10#.##0.132.8:23
21#.##1.110.244:23
21#.##4.102.19:23
53.##.250.120:23
17#.##.67.183:23
19#.##0.164.153:23
86.###.120.159:23
30.###.198.131:23
22#.##1.18.188:23
28.##.213.222:23
87.##.18.216:23
22#.##3.54.170:23
23#.#.34.44:23
10#.##3.158.102:23
10#.##6.211.173:23
15#.##2.35.153:23
13.##.250.190:23
59.###.44.184:23
76.##7.28.73:23
84.##.52.126:23
19#.##.10.170:23
22#.##5.148.48:23
50.##6.44.72:23
16#.##.146.145:23
17#.##3.204.175:23
17#.#.83.143:23
41.###.124.125:23
13#.##7.53.94:23
17#.#2.4.232:23
14#.##.209.248:23
23#.##4.183.62:23
11#.#.65.254:23
1.##.55.224:23
37.#.221.129:23
22#.##.151.183:23
23#.##9.9.153:23
94.###.120.30:23
43.##.30.206:23
17#.##.118.183:23
19#.#25.0.48:23
86.##4.83.50:23
21#.##5.112.244:23
55.###.241.79:23
15#.##7.129.7:23
63.##.126.133:23
12#.##1.61.135:23
84.##.110.97:23
13#.##.129.71:23
12#.##0.77.39:23
16#.##3.89.49:23
19#.##2.180.159:23
20#.#8.31.84:23
24#.##1.69.235:23
16#.#.83.168:23
23.##.244.42:23
78.###.25.188:23
1.###.246.235:23
89.##.16.123:23
77.###.196.30:23
33.##.170.161:23
84.##8.17.74:23
31.##.215.57:23
11#.##1.204.3:23
14#.##0.28.169:23
8.###.185.68:23
31.##1.83.45:23
21#.##.39.247:23
22.###.250.106:23
33.###.135.215:23
63.##8.50.81:23
64.###.123.49:23
20#.#0.90.38:23
11#.##2.234.111:23
11#.##8.146.204:23
74.###.126.80:23
76.##2.72.84:23
21#.##7.254.60:23
45.###.95.116:23
10#.##.78.252:23
23#.#7.228.6:23
24#.##.154.129:23
21#.#98.92.5:23
25#.##3.47.114:23
16#.##5.158.209:23
34.##.163.66:23
4.##.181.188:23
21.###.58.189:23
18#.#09.72.1:23
71.##2.38.8:23
16.#.86.183:23
18#.##7.1.129:23
15#.##.148.215:23
15#.##4.114.98:23
22#.##6.217.50:23

Receives data from the following servers:

18#.###.111.199:7685
18#.###.111.199:4321

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению