Linux.Mirai.4973

Technical Information

Malicious functions:

Removes itself

Launches itself as a daemon

Substitutes application name for:

-bash

Kills the following processes:

<SAMPLE>

Performs operations with the file system:

Creates or modifies files:

<SAMPLE_FULL_PATH>

Network activity:

Awaits incoming connections on ports:

19#.##8.211.50:3467

Establishes connection:

8.#.8.8:53
18#.###.110.240:4321
18#.###.110.240:7685

Attacks using a special dictionary (brute-force technique) via the Telnet protocol.

Sends data to the following servers:

18#.###.110.240:7685
18#.###.110.240:4321
0.0.0.0:0
21.##5.98.66:23
10#.##6.103.157:23
24#.##1.155.56:23
55.###.211.134:23
23#.#51.3.71:23
17.###.177.253:23
12.##.133.4:23
17#.##8.108.237:23
90.###.226.196:23
23#.#.211.225:23
10#.##.36.166:23
20#.##5.215.35:23
17#.##.103.128:23
86.###.178.146:23
63.##.128.170:23
20#.#.32.127:23
7.##.176.117:23
20#.##.98.136:23
11#.##9.192.232:23
43.##5.157.0:23
93.##.45.84:23
17#.#.70.139:23
10#.##3.182.181:23
9.##.27.105:23
16#.#3.63.92:23
18#.##0.97.218:23
12#.#.177.145:23
23.##2.84.45:23
21#.##0.235.200:23
19#.##.218.146:23
9.###.231.136:23
57.##.120.55:23
21#.##.214.137:23
18#.##0.81.172:23
82.###.238.230:23
19#.##3.166.131:23
17#.##7.43.140:23
25#.##2.58.218:23
18#.##6.169.83:23
11.##4.0.125:23
14#.##.210.51:23
50.##.158.54:23
19#.##.196.102:23
19#.##7.58.114:23
24#.##3.54.137:23
63.##.56.35:23
71.###.214.38:23
12#.##0.131.215:23
24#.##.216.161:23
51.###.38.218:23
85.##.208.163:23
12#.##8.215.5:23
10#.##7.111.74:23
22.###.166.54:23
19#.##.182.48:23
18#.##2.227.1:23
34.###.77.210:23
10#.##5.60.234:23
12#.##4.104.160:23
23#.##5.161.192:23
11#.##7.168.40:23
15#.##0.255.251:23
19#.##0.165.136:23
22.###.161.23:23
23#.##8.247.157:23
17#.#62.46.0:23
63.###.155.27:23
42.##.130.77:23
73.##.54.1:23
29.##8.21.57:23
24#.##2.212.42:23
21#.#.205.31:23
23#.#.43.230:23
16#.#0.198.0:23
20.###.175.146:23
10#.##7.93.123:23
14#.##2.53.178:23
36.##.213.201:23
83.##.41.185:23
12#.##6.118.191:23
46.###.204.255:23
12#.##.212.83:23
13#.##0.165.64:23
24#.##9.56.140:23
50.#.116.47:23
15#.##1.172.212:23
98.##.15.169:23
24#.##8.33.83:23
15#.##2.246.211:23
89.##.80.228:23
24#.##7.116.195:23
24#.#4.74.59:23
76.##7.5.107:23
11#.##.133.182:23
21#.##4.50.138:23
11#.#5.96.40:23
19#.##.220.140:23
4.###.89.101:23
23#.##3.83.71:23
14#.##5.168.150:23
93.##1.76.1:23
75.##.149.192:23
25.##.34.123:23
11#.##7.12.119:23
16#.##4.116.56:23
11#.##.11.165:23
6.###.34.97:23
13#.#20.9.22:23
16#.##1.32.181:23
22#.##6.218.101:23
14#.##.137.28:23
21#.##2.214.247:23
22#.##.60.168:23
13#.##3.185.48:23
11#.#.157.19:23
21#.##.170.60:23
52.###.56.180:23
10#.#6.2.123:23
58.##4.5.245:23
73.##.84.42:23
17#.##4.238.21:23
14#.##.113.194:23
15#.#95.16.0:23
16#.##.147.222:23
25#.##0.176.84:23
89.###.63.138:23
24#.##1.151.78:23
14#.##.248.233:23
13.##.32.115:23
17#.##8.211.18:23
14#.##8.37.93:23
16#.##.179.166:23
18#.##.204.232:23
24.##.157.242:23
66.###.227.163:23
18#.##2.83.209:23
25#.##6.121.114:23
16#.##8.189.223:23
12#.##0.248.165:23
21#.##.129.121:23
67.##3.55.33:23
12#.##7.118.214:23
10#.##1.214.23:23
75.###.103.39:23
16#.##1.210.27:23
25#.#.5.108:23
23#.##4.194.130:23
25#.#94.5.84:23
98.#.48.0:23
20#.##7.109.185:23
16#.##.76.160:23
18#.##0.107.136:23
16#.##5.233.234:23
16#.##7.234.243:23
25#.##0.157.147:23
27.###.109.172:23
17#.##6.164.143:23
13#.##9.157.120:23
68.###.244.12:23
18#.##.225.81:23
24.##.39.244:23
35.##.172.110:23
17#.##.231.242:23
86.##3.98.76:23
12.###.151.251:23
32.##.247.193:23
15#.##7.198.92:23
13#.##.222.15:23
11.##.249.213:23
22.###.103.176:23
15#.##6.174.180:23
43.##.67.92:23
44.##.244.252:23
21#.#.188.196:23
16#.##8.21.90:23
13#.##.99.201:23
21#.##1.171.131:23
16#.##7.147.241:23
56.##.109.147:23
13#.##8.165.207:23
14#.##2.54.85:23
17#.##.128.231:23
76.##.108.40:23
11#.#3.96.56:23
25.###.64.174:23
83.###.115.115:23
19#.#01.0.72:23
20#.##5.224.219:23
25#.##9.109.162:23
25#.##9.189.65:23
25#.##.214.31:23
19#.#.180.250:23
23#.##.223.11:23
75.##1.0.173:23
49.##8.15.50:23
10.##.126.39:23
16#.##.246.247:23
1.##.216.97:23
98.###.49.181:23
22#.##.251.52:23
13#.##9.88.255:23
15#.##1.134.60:23
10#.##2.174.27:23
38.###.212.208:23
68.##7.0.189:23
23#.##8.161.132:23
34.###.77.222:23
17#.#25.2.69:23
16#.##.64.232:23
20#.#.158.220:23
25#.##1.249.28:23
11#.##.82.166:23
22.##.60.120:23
41.##0.74.83:23
23#.##5.158.15:23
37.##.215.41:23
82.###.40.145:23
48.###.42.199:23
18#.##.208.130:23
17#.##.232.113:23
24#.##0.197.194:23
16.##3.78.76:23
24.##.74.107:23
78.###.18.160:23
79.###.163.144:23
23#.##.225.141:23
18#.##.140.50:23
29.###.166.27:23
95.###.55.151:23
21#.##.231.70:23
11#.##0.126.90:23
20.##.82.126:23
15#.##9.120.24:23
20#.##7.53.155:23
10#.##.136.62:23
12#.##.37.199:23
89.##.50.154:23
18#.##3.234.17:23
74.###.204.219:23
48.##0.4.152:23
12#.##.251.22:23
16#.##.140.190:23
22#.##.216.143:23
65.###.207.111:23
24#.##5.46.75:23
24#.##5.253.195:23
17#.##.75.246:23
14#.#2.25.77:23
16#.##.94.114:23
18#.##4.146.175:23
22#.##9.241.114:23
16#.##1.122.115:23
17#.##8.185.237:23
19#.##3.85.134:23
16#.##0.36.223:23
22#.##.135.190:23
50.###.199.170:23
16#.##7.168.111:23
11.#.101.107:23
24#.##1.214.62:23
25#.##2.151.130:23
23#.##5.148.43:23
11#.#2.18.91:23
11#.#.11.171:23
23#.##6.99.109:23
12#.#9.207.5:23
57.#.50.80:23
24#.##.136.128:23
10#.##8.190.127:23
11#.##.57.242:23
76.###.171.194:23
14#.#8.70.4:23
19#.##.185.132:23
22#.##8.179.23:23
10#.##1.191.100:23
19#.##9.98.122:23
66.##1.213.8:23
13#.#.213.234:23
12#.##4.223.26:23
75.##.67.183:23
10#.##6.147.146:23
18#.##.137.81:23
59.###.245.35:23
93.###.170.80:23
16#.##0.202.67:23
80.##.70.127:23
18#.##.172.214:23
22#.##8.167.242:23
10.###.144.129:23
14#.##4.41.79:23
10#.##2.130.132:23
22.###.113.96:23
24#.##9.187.82:23
52.##.200.219:23
17#.##0.242.222:23
40.###.242.202:23
41.#.169.250:23
14#.##.14.253:23
82.##.32.140:23
10#.##8.106.168:23
13#.#.209.253:23
11#.##.140.109:23
14#.##1.40.214:23
24#.##0.110.237:23
11#.##8.173.86:23
11#.##4.207.115:23
19#.##2.34.131:23
23#.#67.36.2:23
89.###.175.73:23
9.###.23.182:23
14#.##3.165.157:23
77.###.239.51:23
21#.#0.27.45:23
16.#.142.212:23
90.##.99.131:23
18#.##0.231.159:23
54.###.167.162:23
19#.#.1.61:23
24#.##5.165.210:23
34.#.194.238:23
10#.##4.81.172:23
13#.##.86.171:23
19#.##.134.19:23
26.##4.89.51:23
11#.##.28.109:23
17#.##.20.159:23
23#.##0.144.212:23
85.###.226.176:23
25#.##5.144.212:23
22#.##.80.107:23
24#.#4.98.93:23
24#.##9.24.77:23
7.##.49.64:23
20#.##.134.153:23
25#.##4.18.219:23
35.###.156.99:23
19#.#.90.163:23
19#.##.57.129:23
20.##.197.47:23
80.##9.56.60:23
18#.##3.255.136:23
18#.##.170.95:23
21#.##8.223.116:23
79.##1.83.76:23
16#.##8.238.182:23
21#.##4.230.113:23
79.###.178.137:23
12#.##1.58.220:23
16#.##.188.212:23
21#.##.220.114:23
75.###.244.44:23
21#.##2.194.231:23
22#.##8.154.222:23
20#.#8.5.50:23
17#.##3.0.210:23
24.###.28.107:23
22#.##.56.126:23
37.###.12.128:23
40.##.30.64:23
19#.##0.135.164:23
83.##.115.221:23
38.##.181.112:23
15#.##0.43.117:23
11#.##.148.148:23
14#.##3.62.32:23
22#.##.28.126:23
23#.##2.136.240:23
13#.##0.202.123:23
38.###.109.36:23
91.###.236.125:23
20#.##4.22.26:23
16#.##2.152.177:23
14#.##9.240.113:23
10#.##1.202.234:23
52.##.234.34:23
11#.##9.88.27:23
20#.##5.244.56:23
18#.#.51.168:23
13#.##2.238.149:23
54.##.43.24:23
24#.##.133.195:23
59.##.222.246:23
16#.##8.196.242:23
22#.##0.250.115:23
14#.##2.22.224:23
15#.##.129.142:23
37.###.195.146:23
17#.##5.214.211:23
23#.#.178.211:23
22#.##.174.47:23
88.###.181.76:23
23.###.149.86:23
67.###.226.23:23
15#.#7.151.9:23
41.###.237.185:23
31.##6.2.186:23
20#.##6.124.99:23
20#.##4.46.122:23
14#.##6.152.155:23
16#.##1.140.45:23
77.###.181.135:23
24#.##2.145.157:23
51.###.173.182:23
19#.##.92.187:23
21#.##0.113.244:23
81.###.238.26:23
23#.##.133.228:23
16#.##.12.238:23
15#.##3.223.42:23
23#.##.184.63:23
11#.##.26.169:23
13#.##7.75.41:23
86.##.182.223:23
13#.##2.164.149:23
13#.##6.95.140:23
32.##.165.147:23
10#.##7.221.33:23
80.##3.85.9:23
21#.##5.116.162:23
67.##.136.231:23
10#.#.223.232:23
67.###.228.56:23
24#.##8.159.240:23
20#.##.225.218:23
19#.##2.134.127:23
15#.##7.209.175:23
43.##7.83.70:23
23#.##4.11.47:23
10#.##0.252.215:23
22#.##2.241.83:23

Receives data from the following servers:

18#.###.110.240:7685
18#.###.110.240:4321

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations