Technical Information
Malicious functions:
Substitutes application name for:
- /bin/busybox
Kills system processes:
- sshd
Kills the following processes:
- <SAMPLE>
- agetty
- /bin/busybox
- exim4
- bash
- run.sh
- systemd
Network activity:
Establishes connection:
- 18#.###.110.230:9090
- 15#.##.127.150:52869
- 15#.###.197.149:52869
- 41.#.#27.150:52869
- 19#.###.62.101:52869
- 19#.###.194.137:52869
- 19#.###.163.99:52869
- 15#.#.122.45:52869
- 41.###.242.6:52869
- 15#.##.8.122:52869
- 15#.###.76.178:52869
- 15#.###.178.10:52869
- 19#.###.16.217:52869
- 41.###.177.90:52869
- 41.##.136.178:52869
- 15#.##.35.86:52869
- 41.###.243.63:52869
- 15#.##.220.101:52869
- 41.###.126.153:52869
- 41.###.56.177:52869
- 41.##.173.173:52869
- 41.##.134.170:52869
- 41.##.121.222:52869
- 41.###.140.80:52869
- 41.##.158.199:52869
- 41.###.91.205:52869
- 19#.###.195.70:52869
- 19#.###.121.49:52869
- 41.###.68.216:52869
- 15#.##.97.53:52869
- 15#.#.84.63:52869
- 41.###.191.3:52869
- 41.###.226.204:52869
- 41.###.76.129:52869
- 15#.##.182.250:52869
- 15#.##.226.195:52869
- 41.###.114.88:52869
- 15#.##5.8.190:52869
- 15#.###.88.117:52869
- 41.##.8.225:52869
- 41.###.122.128:52869
- 15#.###.165.146:52869
- 15#.#.197.94:52869
- 15#.##0.86.10:52869
- 15#.##.50.66:52869
- 41.##.123.225:52869
- 19#.###.136.32:52869
- 15#.#.236.151:52869
- 41.###.60.119:52869
- 15#.##.235.3:52869
- 15#.###.207.111:52869
- 19#.###.148.85:52869
- 19#.##.109.137:52869
- 19#.##.232.177:52869
- 41.###.254.233:52869
- 19#.##.16.145:52869
- 15#.###.22.117:52869
- 19#.##1.41.12:52869
- 15#.##.52.103:52869
- 19#.###.243.41:52869
- 41.#.#3.27:52869
- 41.##.172.92:52869
- 41.###.180.212:52869
- 41.##.48.57:52869
- 41.###.241.132:52869
- 41.##.235.185:52869
- 41.##.112.59:52869
- 15#.###.188.255:52869
- 41.###.63.201:52869
- 19#.##0.25.80:52869
- 41.###.193.42:52869
- 15#.###.252.172:52869
- 19#.###.86.246:52869
- 15#.##8.95.35:52869
- 19#.###.236.16:52869
- 41.###.114.31:52869
- 41.##.223.39:52869
- 41.##.6.174:52869
- 41.###.122.103:52869
- 19#.###.229.39:52869
- 19#.###.25.122:52869
- 19#.##7.49.31:52869
- 19#.##4.1.155:52869
- 15#.##.30.31:52869
- 41.##.126.18:52869
- 15#.###.185.153:52869
- 19#.##.53.217:52869
- 15#.###.171.65:52869
- 15#.###.240.192:52869
- 41.###.122.24:52869
- 15#.###.169.189:52869
- 15#.###.209.39:52869
- 19#.###.146.55:52869
- 41.###.133.195:52869
- 15#.###.249.41:52869
- 41.###.46.196:52869
- 41.###.47.22:52869
- 19#.###.28.181:52869
- 41.##.200.189:52869
- 15#.##1.58.26:52869
- 19#.###.196.73:52869
- 19#.#.100.243:52869
- 41.###.167.13:52869
- 19#.###.104.206:52869
- 15#.###.245.136:52869
- 41.###.118.127:52869
- 41.###.149.9:52869
- 15#.###.135.71:52869
- 19#.###.250.17:52869
- 41.###.114.130:52869
- 41.###.174.70:52869
- 41.###.12.103:52869
- 15#.###.136.108:52869
- 19#.##.77.141:52869
- 19#.##.92.13:52869
- 15#.##.198.22:52869
- 41.##.210.40:52869
- 15#.###.233.93:52869
- 19#.###.255.99:52869
- 15#.###.37.161:52869
- 19#.###.56.132:52869
- 41.###.207.151:52869
- 41.###.87.178:52869
- 15#.##4.219.8:52869
- 19#.##.239.1:52869
- 19#.##6.59.60:52869
- 19#.##.186.229:52869
- 41.##.87.29:52869
- 15#.###.230.49:52869
- 15#.##.63.55:52869
- 19#.##.246.161:52869
- 19#.###.18.191:52869
- 19#.##2.2.14:52869
- 41.###.80.190:52869
- 41.###.188.131:52869
- 15#.##.137.60:52869
- 41.##.14.179:52869
- 41.###.77.192:52869
- 41.###.108.78:52869
- 41.##.122.89:52869
- 15#.###.182.214:52869
- 41.##.204.14:52869
- 19#.###.194.113:52869
- 19#.##.56.30:52869
- 19#.##.251.190:52869
- 19#.##.45.147:52869
- 15#.###.105.37:52869
- 15#.###.66.244:52869
- 19#.##.32.18:52869
- 19#.##.53.166:52869
- 15#.###.181.218:52869
- 15#.###.126.200:52869
- 15#.##.226.10:52869
- 19#.##0.93.73:52869
- 41.###.115.13:52869
- 19#.###.190.202:52869
- 15#.#.249.35:52869
- 41.##.215.238:52869
- 15#.##.158.103:52869
- 41.##.100.183:52869
- 19#.###.35.224:52869
- 41.###.45.117:52869
- 15#.##2.5.156:52869
- 41.##.74.218:52869
- 15#.##.127.181:52869
- 19#.###.134.30:52869
- 15#.###.37.223:52869
- 15#.##.205.61:52869
- 41.###.26.235:52869
- 41.###.68.242:52869
- 15#.###.98.190:52869
- 19#.##8.2.152:52869
- 15#.##.141.50:52869
- 19#.##.120.119:52869
- 19#.###.200.45:52869
- 41.##.233.77:52869
- 41.###.228.233:52869
- 41.##.62.253:52869
- 15#.##9.33.57:52869
- 15#.###.168.97:52869
- 15#.##.195.72:52869
- 41.##.181.110:52869
- 41.###.190.14:52869
- 41.##.71.207:52869
- 41.##.47.62:52869
- 19#.###.173.216:52869
- 41.###.177.199:52869
- 19#.##.225.167:52869
- 19#.###.41.105:52869
- 41.###.18.237:52869
- 15#.##.103.70:52869
- 19#.###.214.11:52869
- 19#.###.197.131:52869
- 19#.###.117.120:52869
- 41.###.60.110:52869
- 15#.##.152.146:52869
- 19#.#.35.101:52869
- 19#.###.197.108:52869
- 41.#.#4.105:52869
- 41.##.80.172:52869
- 41.##.54.163:52869
- 15#.###.119.214:52869
- 41.##.98.77:52869
- 15#.##.216.94:52869
- 19#.###.106.76:52869
- 15#.###.119.196:52869
- 15#.###.109.88:52869
- 15#.###.205.227:52869
- 19#.###.245.168:52869
- 41.###.3.144:52869
- 41.###.97.165:52869
- 41.###.10.233:52869
- 15#.##7.3.121:52869
- 19#.#.10.211:52869
- 15#.###.117.45:52869
- 15#.###.107.74:52869
- 41.###.210.192:52869
- 41.##.141.215:52869
- 19#.##6.79.13:52869
- 19#.##2.62.57:52869
- 41.###.10.44:52869
- 19#.###.72.190:52869
- 15#.###.188.193:52869
- 41.###.95.129:52869
- 15#.###.136.185:52869
- 41.###.68.139:52869
- 19#.##.14.142:52869
- 15#.##.225.116:52869
- 15#.##.187.52:52869
- 19#.##.194.22:52869
- 41.##.252.109:52869
- 19#.###.226.122:52869
- 41.###.158.211:52869
- 15#.##6.46.61:52869
- 41.##.150.50:52869
- 19#.##.153.3:52869
- 41.###.161.184:52869
- 19#.###.65.194:52869
- 41.##.181.186:52869
- 19#.##7.93.96:52869
- 15#.##.94.66:52869
- 19#.##.151.82:52869
- 19#.##8.236.4:52869
- 41.###.235.21:52869
- 19#.###.52.198:52869
- 41.##.29.171:52869
- 15#.##.113.228:52869
- 19#.##.148.196:52869
- 41.###.215.3:52869
- 41.##.142.217:52869
- 19#.###.166.116:52869
- 19#.###.37.204:52869
- 41.###.146.64:52869
- 41.##.188.243:52869
- 19#.#.111.153:52869
- 15#.#.167.194:52869
- 15#.##0.3.66:52869
- 19#.###.129.163:52869
- 19#.###.100.105:52869
- 15#.###.122.153:52869
- 19#.###.143.127:52869
- 19#.##.212.48:52869
- 15#.###.135.35:52869
- 41.##.126.238:52869
- 19#.##.15.124:52869
- 19#.##.60.24:52869
- 19#.##.142.7:52869
- 15#.###.168.165:52869
- 15#.###.58.153:52869
- 15#.###.167.214:52869
- 15#.##3.23.61:52869
- 19#.###.192.29:52869
- 41.##.1.154:52869
- 41.##.104.7:52869
- 19#.##.201.92:52869
- 19#.##2.20.17:52869
- 41.###.214.30:52869
- 19#.##0.81.16:52869
- 41.###.157.186:52869
- 15#.###.66.211:52869
- 15#.###.229.35:52869
- 19#.###.170.74:52869
- 15#.##.229.15:52869
- 41.###.147.46:52869
- 19#.##0.78.76:52869
- 15#.##5.87.77:52869
- 41.###.50.117:52869
- 41.###.13.232:52869
- 19#.#.221.106:52869
- 41.##.93.209:52869
- 41.#.#76.127:52869
- 19#.###.203.32:52869
- 41.###.131.125:52869
- 41.##.166.156:52869
- 15#.###.174.104:52869
- 15#.##.246.105:52869
- 19#.###.215.30:52869
- 19#.##0.62.94:52869
- 19#.###.168.50:52869
- 41.#.#88.205:52869
- 19#.###.175.162:52869
- 41.###.189.148:52869
- 15#.##.177.248:52869
- 41.##.145.81:52869
- 41.###.35.235:52869
- 15#.###.80.137:52869
- 15#.###.129.126:52869
- 19#.##.173.253:52869
- 19#.###.181.89:52869
- 41.##.83.79:52869
- 19#.##.82.82:52869
- 41.##.57.72:52869
- 19#.##.16.115:52869
- 15#.##.120.253:52869
- 19#.##.108.18:52869
- 19#.###.164.222:52869
- 19#.##1.21.57:52869
- 19#.##2.8.74:52869
- 15#.#.233.92:52869
- 19#.###.17.165:52869
- 41.##.217.177:52869
- 15#.##.195.69:52869
- 19#.###.245.62:52869
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
HTTP POST requests:
- http://##.###.###.120/ctrlt/DeviceUpgrade_1
Sends data to the following servers:
- 18#.###.110.230:9090
Other:
Collects information about network activity
