Linux.Siggen.3422

Technical Information

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

sshd

Modifies firewall settings:

iptables -I INPUT -p tcp --destination-port 51231 -j ACCEPT
iptables -I OUTPUT -p tcp --source-port 51231 -j ACCEPT
iptables -I PREROUTING -t nat -p tcp --destination-port 51231 -j ACCEPT

Launches processes:

sh -c killall -9 telnetd utelnetd scfgmgr
sh -c iptables -I INPUT -p tcp --destination-port 51231 -j ACCEPT
sh -c iptables -I OUTPUT -p tcp --source-port 51231 -j ACCEPT
sh -c iptables -I PREROUTING -t nat -p tcp --destination-port 51231 -j ACCEPT

Attempts to kill the following processes:

killall -9 telnetd utelnetd scfgmgr

Performs operations with the file system:

Creates or modifies files:

/root/.ips

Network activity:

Awaits incoming connections on ports:

127.0.0.1:14737
0.0.0.0:33445
0.0.0.0:51231

Establishes connection:

8.#.8.8:53
14#.##7.7.114:8443
17#.##1.104.124:80
81.##.105.85:60001
38.##.57.23:8080
21#.##.128.132:8443
47.###.242.158:8443
15#.###.206.112:8080
87.###.193.137:60001
19#.#5.13.61:80
82.###.225.79:8080
66.##.246.201:8080
20#.###.24.138:37215
81.###.45.247:52869
65.###.77.106:8080
16#.##.97.131:81
22.###.236.194:8080
99.###.52.236:8181
13.###.3.52:5555
17#.##8.134.24:8080
16#.##.234.172:80
17#.##7.37.46:80
84.###.100.60:80
18#.##.41.197:8080
13#.#.194.101:8081
20#.##5.210.6:80
12#.##6.137.21:5555
48.###.245.226:49152
17#.##4.156.226:80
53.##.239.11:80
36.##.96.131:8080
19#.###.100.207:8081
21#.###.118.131:8443
20#.##.249.131:7574
14#.#.86.223:8081
22#.##.166.199:80
43.##.140.145:8080
21#.##4.139.24:8081
21#.#10.8.43:80
12#.###.206.162:8080
16#.##.162.58:37215
57.#.#44.39:8080
8.##.57.254:80
16#.#.120.179:8080
29.###.148.73:80
18#.##.71.204:7574
19#.##1.31.169:7574
14#.##.106.179:8080
13#.##1.184.82:8080
49.###.90.53:8080
34.###.33.183:80
18#.##9.13.243:80
13#.##5.86.17:80
2.###.190.3:8080
20.###.179.191:60001
15#.##.224.212:52869
13#.##.135.106:80
76.###.48.248:8080
15#.###.149.171:8443
21#.##.152.28:80
27.##.23.242:52869
12#.##.73.20:8080
21#.##.221.100:8181
72.##.135.111:8080
18#.##9.103.142:80
11#.##7.225.5:80
47.###.152.211:8080
83.###.37.50:8443
13#.#.51.134:8081
16.###.112.51:8181
17#.##9.93.223:8080
73.###.78.197:80
10#.##8.40.55:8080
12#.##.86.224:8080
15#.##.179.238:80
65.###.17.43:8443
71.##.114.201:80
34.##.217.83:8080
43.##.249.124:80
60.###.240.122:49152
38.##.151.183:60001
16#.##.167.165:37215
3.###.131.60:8181
34.###.143.223:5555
13#.##.135.34:8080
13#.##6.170.126:80
51.###.109.110:8443
14#.##.107.189:37215
16#.###.96.192:52869
11#.##.186.84:80
15#.###.117.113:37215
11#.##.248.237:52869
82.###.220.111:37215
18#.##6.127.226:80
10#.##9.121.72:80
15#.##6.205.3:8080
96.###.204.90:8080
43.###.169.240:80
77.###.237.171:8080
19#.###.48.200:49152
71.#.46.6:7574
44.###.215.251:37215
73.##9.227.3:80
18#.##8.86.36:80
19#.##6.158.61:80
7.###.16.183:8080
17#.##.245.18:80
40.###.132.18:80
12#.##.182.131:80
21.###.188.148:80
3.##.92.53:80
19#.###.217.56:60001
70.###.246.107:7574
95.###.117.155:8081
11#.##1.4.166:52869
77.##.208.130:8080
47.##.19.137:8081
14#.###.172.240:52869
83.##.105.165:80
13.###.101.240:8080
<LOCAL_GATE>13:8081
42.###.104.177:8443
61.###.185.157:5555
18#.##3.212.114:81
13#.###.176.79:49152
17#.##3.205.233:80
93.#.246.41:81
59.###.185.237:8080
57.##.170.47:8181
83.##.105.44:8080
48.##.10.30:8081
94.##.106.160:8443
4.##.2.151:8080
31.###.205.152:80
29.###.171.88:80
10#.##.59.111:80
48.##.147.191:7574
51.##.177.225:8080
82.###.59.49:8080
20#.###.246.232:8080
19#.##8.86.62:8443
80.###.106.153:8080
64.###.70.83:8181
20#.##0.158.88:5555
21#.##.133.171:81
48.##.241.64:80
11#.##0.246.54:7574
15#.##1.176.229:80
19#.###.242.193:8080
20.###.183.98:60001
79.###.144.29:49152
18#.###.109.157:7574
79.###.164.242:8081
91.###.192.6:7574
11#.##7.93.179:80
95.###.111.39:8181
98.###.182.16:8081
15#.##8.87.172:80
77.###.7.144:8081
12#.##3.182.162:80
88.###.177.67:7574
15#.##5.57.231:80
21#.##9.100.119:80
13#.##5.201.92:8080
19#.##0.73.131:80
37.###.67.21:8080
14#.##2.67.112:80
14#.###.142.194:8081
14#.##.10.217:80
16#.###.187.237:7574
21#.##2.77.44:7574
15#.##0.105.161:80
14#.##9.39.148:8080
22.###.71.4:49152
63.###.194.128:37215
17#.##3.244.40:8080
16#.##.106.148:8181
28.##.215.243:80
41.##.58.71:49152
57.##.134.104:8080
19#.##5.188.8:8181
12#.#0.18.71:80
51.##.141.17:52869
67.##.51.76:80
19#.##.158.159:52869
16#.###.43.137:60001
7.###.13.20:80
17#.##6.16.238:8181
10#.##.202.6:8080
18#.##9.58.170:80
76.##7.53.12:80
12#.###.176.223:8080
3.###.209.215:8080
18#.##.224.80:80
17#.###.180.185:8080
32.###.48.157:8080
16.###.141.20:8181
35.###.116.201:80
10#.##.108.122:80
88.###.78.109:5555
10#.##3.243.234:81
17#.###.102.150:8181
28.###.51.27:60001
19#.##9.252.79:80
18#.##0.108.53:80
16#.##0.183.89:81
98.###.10.4:8080
28.##.224.31:7574
6.##.#20.240:8080
53.###.161.209:52869
20#.##3.54.39:8080
18#.##2.99.160:8080
12.###.236.58:8080
10#.##.182.105:80
22#.##.104.238:80
17#.###.209.115:49152
12#.##.241.222:8080
15#.##.163.159:80
17#.###.244.119:8081
17.###.2.251:8443
50.##.136.56:8080
12#.##2.98.61:8080
33.##.238.53:8181
21.##.86.60:7574
16.##9.232.6:81
19#.##9.100.156:80
77.###.229.250:80
14#.###.176.247:8080
45.###.191.184:8080
21#.##4.176.210:80
17#.##.73.183:80
45.###.240.72:80
19#.##.121.76:80
18#.###.172.146:8080
18#.###.102.236:8080
17#.##.147.77:80
11.##.250.50:8443
29.##.172.209:37215
11#.##.192.32:80
82.###.183.143:80
20#.##.38.110:8181
20#.##.173.237:8080
58.##5.52.15:80
31.###.39.169:80
16#.##7.241.9:37215
42.###.83.130:8080
10#.##4.209.203:80
6.##.#98.142:60001
13#.##.194.139:8181
12#.##.240.231:8080
56.###.38.232:8080
17#.##.4.130:8443
18#.##3.18.213:8443
21#.##.7.234:49152
12#.##1.9.174:60001
90.###.76.113:8080
19.###.143.145:8081
68.###.98.125:80
86.###.15.220:8080
22#.###.172.197:8080
60.###.35.78:8080
11#.##6.176.61:8081
18#.##3.131.42:8443
15#.##.186.1:5555
11#.##2.173.16:81
5.###.134.144:80
24.##.30.147:8080
83.##.209.169:8181
20#.##2.65.47:80
17#.##.249.240:80
21#.###.251.107:5555
18#.##9.74.149:5555
9.###.9.170:8080
52.###.85.202:8181
10#.##6.121.68:8080
15#.##.14.123:8080
13#.##2.20.210:81
21.###.73.160:8443
10#.##.109.109:80
47.###.166.156:52869
77.###.233.120:80
16#.##.224.107:5555
75.###.82.144:52869
60.##.122.94:8080
42.###.10.44:8181
46.###.235.43:49152
41.###.201.180:81
45.###.237.53:80
21#.##0.3.81:8080
58.###.173.249:80
17#.##.31.33:8081
92.##1.14.72:23
17#.##.193.2:8443

HTTP POST requests:

127.0.0.1:80/GponForm/diag_Form?images/

Sends data to the following servers:

23#.###.255.250:1900
11#.###.226.141:1023
80.###.245.105:23
20#.##.227.61:23
10#.#5.113.6:23
17#.##8.134.8:23
73.###.249.83:1023
19.##1.8.212:23
16#.#.161.130:23
15#.##.65.219:23
20#.##.223.98:23
35.###.116.201:80
78.###.73.23:1023
82.###.21.169:23
16#.##6.158.89:23
12#.##.103.220:23
58.##.79.124:23
32.###.44.46:1023
90.##.183.140:23
21#.##4.180.33:23
19#.##2.105.139:23
17#.##0.156.209:23
16#.##.53.141:1023
80.###.99.181:23
73.###.37.108:23
19#.##3.185.165:23
90.###.95.133:23
18.###.147.119:1023
63.###.81.187:23
64.##.43.236:23
16#.##.152.181:23
20.##3.85.2:23
18#.##0.140.35:1023
22#.##.205.186:23
64.##.220.154:23
16#.##.254.120:23
13#.##.34.104:23
13#.##.14.119:1023
10#.##1.77.179:23
16#.##.201.87:23
95.###.44.180:23
21#.##.196.241:23
86.##.189.56:1023
60.##.244.123:23
15#.##2.99.207:23
92.##1.14.72:23
14.###.174.39:23
62.###.7.223:1023
20#.##0.209.140:23
14#.##2.136.151:23
34.##.4.34:23
12#.##1.85.20:23
16#.###.226.220:1023
14#.##5.122.192:23
16#.##0.113.122:23
75.###.198.210:23
18#.#70.98.6:23
15#.##7.38.25:1023
36.###.193.189:23
12#.##.155.222:23
18#.##.252.176:23
12#.##.234.244:23

Receives data from the following servers:

35.###.116.201:80

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations