Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- iptables -A INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
- /var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
- /usr/sbin/xtables-nft-multi iptables -L OUTPUT -t raw --line-numbers
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
- iptables -D INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -I INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -C INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
- iptables -D INPUT -p tcp --syn -j DROP
- iptables -D INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
- iptables -L OUTPUT -t raw --line-numbers
- /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
- iptables -t raw -I OUTPUT -p tcp --sport 46759 -j NOTRACK
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
- iptables -A INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -j DROP
- iptables -A INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
- iptables -D INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
- iptables -D INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
- iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
- iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
- iptables -I INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -A INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -D OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
- iptables -D OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -t raw -I OUTPUT -p tcp --sport 46759 -j NOTRACK
- iptables -D INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
- iptables -A INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -j DROP
- iptables -A INPUT -p tcp --syn -j DROP
- iptables -L INPUT --line-numbers
- iptables -D INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
- iptables -C INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
- /usr/sbin/xtables-nft-multi iptables -L INPUT --line-numbers
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
Creates or modifies files:
- /var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
- /dev/watchdog
- /proc/sys/net/netfilter/nf_conntrack_max
- /proc/sys/net/ipv4/ip_forward
Deletes files:
- /var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
Mounts file systems:
- /boot/none
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:65528
- 127.0.0.1:65531
Establishes connection:
- 45.##.146.93:82
- 8.#.8.8:53
- 45.##.146.93:81
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
- 0.#.#.#0.in-addr.arpa
- 0.#.##.100.in-addr.arpa
- 0.#.#.#27.in-addr.arpa
- 0.#.##.172.in-addr.arpa
- 0.#.#.#92.in-addr.arpa
Sends data to the following servers:
- 45.##.146.93:82
- 45.##.146.93:81
- 45.##.146.93:8083
- 10.#.193.37:23
- 10.#.0.222:23
- 10.###.113.173:23
- 10.##8.66.67:23
- 10.##4.1.158:23
- 10.###.81.213:23
- 10.##3.99.16:23
- 10.###.226.128:23
- 10.#.112.125:23
- 10.###.17.198:23
- 10.###.178.53:23
- 10.###.231.217:23
- 10.###.70.104:23
- 10.###.76.187:23
- 10.###.231.59:23
- 10.###.246.109:23
- 10.###.247.220:23
- 10.###.54.126:23
- 10.###.113.240:23
- 10.###.199.254:23
- 10.###.157.25:23
- 10.###.53.115:23
- 10.##9.62.61:23
- 10.##3.49.51:23
- 10.##9.1.188:23
- 10.###.182.12:23
- 10.###.64.150:23
- 10.###.102.24:23
- 10.###.71.147:23
- 10.##0.51.48:23
- 10.###.210.182:23
- 10.###.177.100:23
- 10.###.49.240:23
- 10.###.161.251:23
- 10.###.151.49:23
- 10.##7.7.149:23
- 10.###.17.119:23
- 10.###.232.16:23
- 10.###.49.142:23
- 10.##3.80.87:23
- 10.###.80.106:23
- 10.###.236.186:23
- 10.###.54.231:23
- 10.###.112.242:23
- 10.##5.61.63:23
- 10.##1.55.62:23
- 10.###.66.119:23
- 10.###.144.51:23
- 10.###.184.121:23
- 10.###.119.15:23
- 10.###.247.90:23
- 10.##0.6.34:23
- 10.###.237.113:23
- 10.###.130.64:23
- 10.###.224.116:23
- 10.###.192.245:23
- 10.##1.7.92:23
- 10.###.114.126:23
- 10.###.126.208:23
- 10.###.120.83:23
- 10.###.13.201:23
- 10.###.162.162:23
- 10.###.253.205:23
- 10.###.231.245:23
- 10.###.166.56:23
- 10.###.193.225:23
- 10.###.241.96:23
- 10.##7.25.12:23
- 10.##3.23.21:23
- 10.###.39.162:23
- 10.##4.72.25:23
- 10.###.145.176:23
- 10.###.215.176:23
- 10.###.118.36:23
- 10.###.247.233:23
- 10.###.152.83:23
- 10.###.231.110:23
- 10.###.38.247:23
- 10.###.240.68:23
- 10.###.161.244:23
- 10.##0.2.14:23
- 10.###.161.132:23
- 10.###.119.69:23
- 10.##8.146.6:23
- 10.###.194.90:23
- 10.###.178.188:23
- 10.###.205.245:23
- 10.###.215.202:23
- 10.###.45.156:23
- 10.###.65.155:23
- 10.###.209.116:23
- 10.###.93.175:23
- 10.###.152.173:23
- 10.###.225.122:23
- 10.###.129.170:23
- 10.###.161.101:23
- 10.###.210.91:23
- 10.###.151.241:23
- 10.##6.34.35:23
- 10.##2.97.61:23
- 10.###.97.253:23
- 10.###.114.48:23
- 10.###.130.85:23
- 10.###.225.222:23
- 10.###.48.188:23
- 10.##2.1.163:23
- 10.###.174.111:23
- 10.##0.98.48:23
- 10.###.77.216:23
- 10.###.49.168:23
- 10.###.62.254:23
- 10.###.215.32:23
- 10.###.97.102:23
- 10.###.161.163:23
- 10.##8.34.75:23
- 10.###.97.172:23
- 10.###.114.96:23
- 10.###.96.228:23
- 10.###.183.121:23
- 10.###.248.131:23
- 10.##5.104.6:23
- 10.##8.50.51:23
- 10.##7.67.78:23
- 10.###.67.117:23
- 10.##9.45.64:23
- 10.###.224.70:23
- 10.##7.97.75:23
- 10.###.225.27:23
- 10.###.114.18:23
- 10.###.227.56:23
- 10.##4.1.99:23
- 10.###.80.114:23
- 10.###.193.16:23
- 10.###.166.87:23
- 10.###.241.132:23
- 10.###.177.82:23
- 10.###.130.98:23
- 10.##5.1.75:23
- 10.###.80.240:23
- 10.###.209.39:23
- 10.###.93.173:23
- 10.###.161.91:23
- 10.##5.2.144:23
- 10.###.237.134:23
- 10.###.61.231:23
- 10.###.246.149:23
Receives data from the following servers:
- 45.##.146.93:82
- 45.##.146.93:81