Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.908

Added to the Dr.Web virus database: 2020-09-20

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • sshd
Modifies firewall settings:
  • iptables -I INPUT -p tcp --destination-port 38123 -j ACCEPT
  • iptables -I OUTPUT -p tcp --source-port 38123 -j ACCEPT
  • iptables -I PREROUTING -t nat -p tcp --destination-port 38123 -j ACCEPT
Launches processes:
  • sh -c killall -9 telnetd utelnetd scfgmgr
  • sh -c iptables -I INPUT -p tcp --destination-port 38123 -j ACCEPT
  • sh -c iptables -I OUTPUT -p tcp --source-port 38123 -j ACCEPT
  • sh -c iptables -I PREROUTING -t nat -p tcp --destination-port 38123 -j ACCEPT
Attempts to kill the following processes:
  • killall -9 telnetd utelnetd scfgmgr
Performs operations with the file system:
Creates or modifies files:
  • /root/.ips
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:14737
  • 0.0.0.0:33445
  • 0.0.0.0:38123
Establishes connection:
  • 8.#.8.8:53
  • 21#.##.12.76:8080
  • 19#.##8.218.34:8443
  • 61.##.195.43:80
  • 13#.##.142.4:8080
  • 19#.##.173.142:80
  • 87.###.189.15:52869
  • 14#.###.62.135:52869
  • 14#.##5.190.68:8080
  • 37.###.172.73:52869
  • 20#.##4.212.30:7574
  • 23.##.227.13:8443
  • 21.##.231.188:8443
  • 14#.##2.15.217:80
  • 97.###.46.208:80
  • 11#.##6.17.63:80
  • 54.##.108.75:80
  • 18#.##4.237.34:80
  • 19#.##4.172.84:5555
  • 37.###.60.7:8080
  • 25.###.35.27:8080
  • 16#.###.237.123:52869
  • 19#.##6.72.62:49152
  • 74.###.200.230:80
  • 17#.##.179.100:5555
  • 12#.##0.143.53:8080
  • 21#.##3.166.2:5555
  • 56.##.40.89:37215
  • 48.##.112.187:37215
  • 20#.##.55.252:8080
  • 13#.##.238.182:8443
  • 63.###.118.17:52869
  • 50.###.86.28:8080
  • 22#.#3.61.27:80
  • 95.##.211.249:81
  • 26.###.237.182:7574
  • 59.##.151.88:8080
  • 87.###.105.237:8080
  • 44.###.243.214:7574
  • 11#.#0.51.96:80
  • 57.###.222.37:8080
  • 17.###.8.245:52869
  • 87.###.50.215:37215
  • 53.#.50.0:49152
  • 16#.###.211.34:52869
  • 41.###.116.245:8080
  • 13#.#.171.125:5555
  • 12#.###.140.210:8080
  • 14#.###.248.225:8080
  • 15#.##2.187.215:81
  • 76.###.128.76:7574
  • 15#.###.164.151:8080
  • 15#.##9.129.52:8443
  • 13#.###.134.35:49152
  • 35.##.6.178:81
  • 13.##.79.181:80
  • 19#.##.19.254:52869
  • 20#.##.229.28:80
  • 19#.##2.176.223:80
  • 48.###.244.52:8080
  • 11#.##6.68.99:8443
  • 19#.##1.110.44:80
  • 11#.##9.92.126:8080
  • 54.##8.4.98:80
  • 7.###.147.232:80
  • 53.###.56.92:5555
  • 72.##.213.238:49152
  • 16#.##.229.156:80
  • 19#.##0.33.59:8080
  • 4.###.163.222:80
  • 83.###.209.225:37215
  • 16#.#.242.146:80
  • 21#.##2.32.73:80
  • 18#.##8.20.2:8080
  • 69.###.114.49:8080
  • 12#.##1.47.243:8080
  • 14#.##.61.123:5555
  • 54.##.233.153:80
  • 17#.###.71.239:49152
  • 19#.###.155.45:49152
  • 86.##.34.96:80
  • 3.###.82.82:80
  • 66.###.69.238:81
  • 75.###.142.115:80
  • 68.###.199.28:49152
  • 37.##.146.72:8080
  • 34.###.111.54:8080
  • 19#.###.198.22:37215
  • 16#.##4.166.94:8080
  • 14#.#.125.10:5555
  • 16#.##7.25.121:5555
  • 19#.##4.187.38:80
  • 83.###.32.139:8080
  • 19#.##2.20.188:8080
  • 35.###.156.110:52869
  • 2.###.129.122:81
  • 47.###.129.86:37215
  • 19#.##8.163.161:80
  • 92.###.145.185:7574
  • 16#.##7.77.110:80
  • 18#.###.197.171:37215
  • 23.##.78.188:52869
  • 13#.###.158.138:5555
  • 39.##.225.206:80
  • 86.###.35.233:8080
  • 19#.##4.149.6:81
  • 50.###.120.131:80
  • 34.#.#61.54:49152
  • 17#.##.51.205:81
  • 19#.##7.175.59:7574
  • 85.###.132.61:5555
  • 11#.##.148.111:8080
  • 12#.##6.63.29:80
  • 80.###.162.41:37215
  • 73.##.252.161:80
  • 20#.#64.7.44:81
  • 14#.##7.146.239:80
  • 83.##.112.228:5555
  • 76.##.62.89:49152
  • 1.###.170.23:52869
  • 13#.##8.76.63:49152
  • 60.###.8.195:7574
  • 70.##.149.105:49152
  • 10#.##4.208.136:81
  • 18.##.67.55:80
  • 20.###.190.168:49152
  • 45.###.150.229:80
  • 18#.#2.37.25:80
  • 18#.###.198.146:37215
  • 15#.##1.228.113:80
  • 11#.##.121.63:80
  • 16#.##9.176.156:81
  • 14.##.12.237:7574
  • 53.##3.92.42:80
  • 79.###.73.26:52869
  • 12#.###.153.143:5555
  • 10#.###.28.124:52869
  • 20#.##.165.136:52869
  • 41.###.209.241:80
  • 4.###.242.207:5555
  • 12#.##5.39.159:80
  • 11#.##8.224.96:8443
  • 79.##.107.60:8080
  • 11#.##3.33.250:81
  • 12#.##1.86.46:81
  • 21#.##.139.144:52869
  • 39.###.128.16:49152
  • 23.###.152.81:8080
  • 89.##.177.158:81
  • 18#.##.117.165:37215
  • 16#.##.194.60:37215
  • 17#.##.238.196:52869
  • 11#.#.95.223:49152
  • 38.###.186.51:80
  • 39.##.29.56:8443
  • 10#.###.147.116:49152
  • 20#.##7.73.79:37215
  • 71.###.243.161:80
  • 18#.##.165.229:8080
  • 16#.###.97.234:37215
  • 18#.##0.234.126:80
  • 45.##.98.254:80
  • 19#.###.239.222:8080
  • 20#.##0.134.81:7574
  • 15#.##.74.206:49152
  • 10#.##9.115.7:8080
  • 61.##.152.172:37215
  • 22.##.127.97:8443
  • 15#.##1.21.98:8080
  • 21.###.238.242:52869
  • 26.###.215.108:8080
  • 74.##.94.219:80
  • 70.###.5.133:49152
  • 12#.##9.0.143:8443
  • 13#.##1.55.26:5555
  • 3.###.146.31:8080
  • 47.###.225.252:49152
  • 16#.##.72.190:81
  • 59.##.64.235:80
  • 50.###.130.72:80
  • 19#.##.78.240:8080
  • 17#.##.174.103:8443
  • 18#.##7.142.139:80
  • 21#.##.47.109:80
  • 22#.##.94.20:8080
  • 17#.###.137.138:37215
  • 20#.###.147.54:37215
  • 3.###.106.228:5555
  • 10#.##2.39.117:80
  • 66.##7.142.5:80
  • 16#.##1.145.59:5555
  • 2.###.46.135:37215
  • 11#.###.231.149:7574
  • 21#.##7.100.35:80
  • 13#.##6.205.7:80
  • 56.###.153.176:52869
  • 20.##.242.248:7574
  • 20#.##1.110.105:80
  • 13#.###.187.133:52869
  • 50.###.96.209:5555
  • 21#.##6.104.29:8443
  • 18#.##0.141.156:80
  • 31.#.98.25:8080
  • 29.##.135.6:52869
  • 21#.##6.229.33:7574
  • 80.###.107.21:49152
  • 10#.##.59.164:7574
  • 16#.#.72.41:81
  • 11#.##7.75.102:8443
  • 16#.##.128.199:8443
  • 15#.###.224.140:5555
  • 19#.##3.40.244:7574
  • 19#.###.125.254:5555
  • 11#.##2.122.3:52869
  • 64.###.14.231:81
  • 52.##.208.184:8080
  • 75.##.129.208:8080
  • 59.##.90.75:8080
  • 20#.##3.44.92:7574
  • 65.###.13.206:80
  • 12#.##.253.121:8443
  • 10#.##4.99.216:7574
  • 11#.###.35.253:52869
  • 20#.##.78.188:49152
  • 50.###.31.118:37215
  • 81.###.253.169:80
  • 48.##.206.223:80
  • 97.##.184.234:80
  • 66.###.105.149:37215
  • 14#.##.243.247:8080
  • 19#.###.133.89:52869
  • 10#.##.8.250:5555
  • 43.###.55.207:80
  • 21#.##9.149.88:80
  • 96.###.232.219:81
  • 13#.###.187.137:8080
  • 55.##.139.236:80
  • 17#.##8.95.49:80
  • 74.###.154.37:8080
  • 18#.##8.162.24:8080
  • 14#.##.205.16:7574
  • 10#.##8.178.0:49152
  • 14#.##3.81.240:80
  • 11#.##8.150.37:8080
  • 30.###.228.121:81
  • 20.###.85.81:7574
  • 11#.##9.65.238:81
  • 17#.##.101.182:80
  • 15#.##.246.73:5555
  • 41.##.144.56:8080
  • 12#.##6.92.40:80
  • 89.##9.146.2:80
  • 72.###.207.61:8080
  • 18#.##2.139.219:81
  • 79.###.115.89:7574
  • 17#.##1.169.3:8080
  • 8.###.65.146:8080
  • 21#.##6.214.138:80
  • 84.###.241.125:5555
  • 18#.##.163.197:37215
  • 17#.###.107.124:37215
  • 56.###.149.84:37215
  • 13#.##2.218.6:7574
  • 16#.##6.216.3:8080
  • 13#.#0.60.71:80
  • 14#.##.65.16:8443
  • 12#.##8.241.69:7574
  • 14#.###.131.171:8080
  • 66.###.86.234:52869
  • 21#.##.105.204:7574
  • 16#.#.44.57:37215
  • 36.###.205.5:7574
  • 83.##.218.166:8080
  • 20#.##.179.113:8080
  • 21#.##0.174.160:80
  • 30.###.12.225:8080
  • 26.##.115.58:80
  • 44.###.149.171:5555
  • 13.###.51.155:8080
  • 22#.##8.243.241:80
  • 20.###.50.195:8080
  • 86.##.48.78:80
  • 81.##.185.222:8080
  • 21#.###.105.173:8080
  • 49.###.91.184:7574
  • 49.###.21.116:7574
  • 18#.###.134.131:8080
  • 12#.##2.66.227:81
  • 19#.###.35.138:49152
  • 18#.##7.84.14:8080
  • 44.##.227.209:49152
  • 21#.##6.12.55:5555
  • 11#.##.243.98:8080
  • 1.##.#3.205:7574
  • 14#.##.97.188:52869
  • 45.##.220.161:8080
  • 29.##.214.56:8080
  • 12#.#7.85.8:81
  • 14#.##.232.208:80
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
HTTP POST requests:
  • 127.0.0.1:80/GponForm/diag_Form?images/
Sends data to the following servers:
  • 23#.###.255.250:1900
  • 38.##.208.110:1023
  • 18#.##.207.98:2323
  • 62.###.44.170:2323
  • 17#.##6.35.109:2323
  • 18#.##.206.23:2323
  • 79.#.#7.213:2323
  • 67.###.196.215:2323
  • 46.###.231.204:2323
  • <LOCAL_GATE>73:2323
  • 12#.##.141.142:2323
  • 14#.##.158.31:2323
  • 11#.##.173.163:2323
  • 17#.##.232.200:2323
  • 8.###.175.178:1023
  • 89.###.162.37:2323
  • 16#.#.27.248:2323
  • 53.###.167.61:2323
  • 54.##.110.110:1023
  • 14.###.146.211:2323
  • 10#.##.61.211:2323
  • 10#.##3.40.124:2323
  • 23.###.76.83:2323
  • 21#.###.100.170:2323
  • 16#.##.105.190:2323
  • 17#.##.89.125:2323
  • 15#.###.186.188:2323
  • 10#.##6.6.122:2323
  • 91.###.215.80:2323
  • 22#.##5.134.39:2323
  • 17#.##0.14.203:2323
  • 8.###.50.102:1023
  • 81.###.127.183:2323
  • 16#.##6.105.5:2323
  • 18#.##.158.25:2323
  • 18#.##.78.153:1023
  • 16#.##.9.142:2323
  • 17#.###.182.240:2323
  • 21#.##.216.3:2323
  • <LOCAL_GATE>95:2323
  • 63.##.109.207:2323
  • 21#.##.83.192:2323
  • 20#.###.139.173:2323
  • 32.##.50.129:2323
  • 12#.##3.33.183:2323
  • 21#.##0.39.50:2323
  • 95.##.103.227:2323
  • 99.###.219.239:2323
  • 82.#.#67.156:1023
  • 78.###.99.17:2323
  • 17#.##1.101.79:2323
  • 38.#.#30.122:2323
  • 12#.###.195.250:1023
  • 18#.##7.89.91:2323
  • 76.##.100.71:2323
  • 5.##.#12.191:2323
  • 90.###.79.239:2323
  • 74.###.98.211:2323
  • 91.##.65.162:2323
  • 12.##.198.113:2323
  • 78.###.173.76:2323
  • 19#.###.148.180:2323
  • 15#.##7.18.78:2323
  • 10#.##9.184.84:2323
  • 89.##.208.137:2323
  • 20#.#.21.195:1023
  • 84.###.6.68:2323
  • 19.##.251.247:2323
  • 10#.##.11.235:2323
  • 39.##.162.151:1023
  • 17#.##1.173.234:23
  • 13#.##7.177.59:23
  • 15#.##2.96.101:2323
  • 16#.##4.210.164:23
  • 11#.##7.17.144:23
  • 18#.##.201.183:2323
  • 10#.##.161.16:23
  • 17#.##.204.52:23
  • 15#.##7.30.131:2323
  • 21#.##9.122.155:23
  • 20#.##7.239.194:23
  • 19#.##.245.170:2323
  • 19#.##.90.179:23
  • 15#.##7.35.26:23
  • 14#.##6.15.97:2323
  • 16#.##8.178.91:23
  • 21#.##0.105.138:23
  • 12#.##.150.115:2323
  • 13.###.140.202:23
  • 20#.##0.27.102:23
  • 48.###.118.253:2323
  • 10#.##.58.176:23
  • 98.##1.6.34:23
  • 18#.###.200.143:2323
  • 71.##.160.197:23
  • 10#.##.253.180:23
  • 94.###.36.243:2323
  • 15#.##6.230.86:23
  • 18#.##1.154.154:23
  • 57.###.231.94:2323
  • 12#.##.72.248:23
  • 19#.##9.23.148:23
  • 11#.##.168.214:2323
  • 81.##.113.163:23
  • 17#.##1.91.111:23
  • 5.##.#05.152:2323
  • 20#.##.213.54:1023
  • 12#.##1.251.3:23
  • 20#.##0.108.27:2323
  • 44.##6.31.23:23
  • 68.##.220.155:23
  • 68.#.#3.194:2323
  • 14#.##3.160.215:23
  • 16#.##0.207.158:23
  • 17#.##1.98.135:2323
  • 15#.##2.45.147:23
  • 99.##.184.70:23

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number