Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
- telnetd
Modifies firewall settings:
- iptables -A INPUT -p tcp --destination-port 23 -j DROP
- iptables -A INPUT -p tcp --destination-port 7547 -j DROP
- iptables -A INPUT -p tcp --destination-port 5555 -j DROP
- iptables -A INPUT -p tcp --destination-port 5358 -j DROP
- iptables -D INPUT -j CWMP_CR
- iptables -X CWMP_CR
- iptables -I INPUT -p udp --dport 25522 -j ACCEPT
Launches processes:
- sh -c iptables -A INPUT -p tcp --destination-port 23 -j DROP
- sh -c iptables -A INPUT -p tcp --destination-port 7547 -j DROP
- sh -c iptables -A INPUT -p tcp --destination-port 5555 -j DROP
- sh -c iptables -A INPUT -p tcp --destination-port 5358 -j DROP
- sh -c iptables -D INPUT -j CWMP_CR
- sh -c iptables -X CWMP_CR
- sh -c iptables -I INPUT -p udp --dport 25522 -j ACCEPT
Performs operations with the file system:
Creates folders:
- /root/.p
Deletes folders:
- <SAMPLE_FULL_PATH>
- /root/.p/.d
Deletes files:
- <SAMPLE_FULL_PATH>
- /tmp/ftpupdate.sh
- /tmp/ftpupload.sh
Network activity:
Awaits incoming connections on ports:
- 0.0.0.0:25522
Establishes connection:
- 8.#.8.8:53
- <LOCAL_DNS_SERVER>
- [:##]:25522
- 127.0.0.1:25522
DNS ASK:
- po##.ntp.org
- ro####.utorrent.com
- ro####.bittorrent.com
Sends data to the following servers:
- 95.##.6.121:123
- 82.###.103.244:6881
- 67.###.246.10:6881
- 41.##.239.157:4520
- 19#.###.29.149:50321
- 14#.##7.6.223:18359
- 12#.###.202.11:12472
- 62.#.#35.231:7325
- 18#.##1.40.65:41095
- 86.###.82.203:6883
- 18#.##.149.228:38754
- 1.###.63.100:7303
- 94.###.129.193:55581
- 94.##.217.95:18326