Technical Information
Malicious functions:
Gains root privileges
Launches itself as a daemon
Launches processes:
- /sbin/xtables-multi iptables -X
- /sbin/xtables-multi iptables -t mangle -F
- /sbin/xtables-multi iptables -P INPUT ACCEPT
- /sbin/xtables-multi iptables -F
- /sbin/xtables-multi iptables -t nat -F
- /sbin/xtables-multi iptables -P OUTPUT ACCEPT
- /sbin/xtables-multi iptables -P FORWARD ACCEPT
- /bin/kmod /sbin/modprobe ip_tables
Kills the following processes:
- Unknown process with PID: 4294966478
Performs operations with the file system:
Modifies file access rights:
- /sbin/xtables-multi
Creates or modifies files:
- /etc/resolv.conf
Network activity:
Establishes connection:
- 8.#.8.8:53
- 5.###.80.126:16
Sends data to the following servers:
- 5.###.80.126:16
- 19#.###.145.144:52869
- 19#.###.42.144:52869
- 15#.###.88.166:52869
- 19#.###.88.141:52869
- 41.###.94.198:52869
- 19#.##.72.202:52869
- 19#.###.50.179:52869
- 15#.##1.42.90:52869
- 15#.###.179.18:52869
- 19#.###.124.14:52869
- 41.###.79.168:52869
- 19#.###.45.227:52869
- 41.###.112.21:52869
- 19#.##.158.138:52869
- 41.###.91.95:52869
- 19#.###.14.169:52869
- 15#.##.54.163:52869
- 15#.###.43.158:52869
- 19#.##.51.78:52869
- 19#.##2.9.242:52869
- 41.###.170.10:52869
- 41.###.159.46:52869
- 15#.###.124.81:52869
- 15#.##.189.156:52869
- 41.###.110.141:52869
- 41.###.187.165:52869
- 41.##.99.107:52869
- 19#.##.53.162:52869
- 19#.##0.219.8:52869
- 19#.##.207.99:52869
- 41.##.144.52:52869
- 15#.##.166.9:52869
- 15#.###.194.185:52869
- 15#.##.119.57:52869
- 41.##.50.189:52869
- 15#.##.16.244:52869
- 19#.##.222.68:52869
- 19#.###.249.108:52869
- 19#.###.142.19:52869
- 19#.###.255.210:52869
- 15#.##.241.9:52869
- 15#.##6.51.6:52869
- 15#.##.47.38:52869
- 41.###.207.87:52869
- 41.###.4.90:52869
- 19#.##.122.24:52869
- 41.##.225.215:52869
- 41.###.216.73:52869
- 41.###.121.43:52869
- 15#.##.223.0:52869
- 41.##.167.103:52869
- 19#.###.42.142:52869
- 19#.##7.38.39:52869
- 41.###.162.229:52869
- 41.##.148.204:52869
- 15#.##.54.85:52869
- 41.###.243.236:52869
- 41.###.4.82:52869
- 19#.###.185.149:52869
- 19#.##2.148.8:52869
- 15#.##9.78.87:52869
- 15#.###.128.100:52869
- 41.###.80.113:52869
- 15#.###.74.236:52869
- 41.##.182.91:52869
- 41.##.183.213:52869
- 19#.###.99.224:52869
- 15#.###.186.26:52869
- 19#.###.143.226:52869
- 41.###.116.89:52869
- 15#.###.241.46:52869
- 15#.##3.250.8:52869
- 15#.###.43.103:52869
- 15#.###.218.212:52869
- 41.###.61.30:52869
- 15#.##.33.9:52869
- 41.##.58.137:52869
- 41.##.47.222:52869
- 15#.###.160.24:52869
- 41.###.195.154:52869
- 19#.###.247.84:52869
- 15#.##2.28.68:52869
- 15#.##.169.182:52869
- 41.##.215.203:52869
- 41.##.228.88:52869
- 15#.##.16.176:52869
- 15#.##.167.179:52869
- 41.###.187.108:52869
- 41.###.135.72:52869
- 19#.##.220.166:52869
- 15#.##.35.44:52869
- 15#.###.86.173:52869
- 41.##.21.206:52869
- 15#.##7.222.1:52869
- 19#.##.181.239:52869
- 19#.###.125.86:52869
- 19#.##.193.225:52869
- 15#.###.198.53:52869
- 15#.###.110.121:52869
- 41.##.86.64:52869
- 15#.##7.6.191:52869
- 19#.###.132.214:52869
- 41.###.115.165:52869
- 19#.##.214.36:52869
- 41.###.53.179:52869
- 15#.###.179.151:52869
- 41.###.117.145:52869
- 41.##.105.169:52869
- 15#.###.186.33:52869
- 15#.##.88.27:52869
- 19#.##2.66.18:52869
- 41.##.157.23:52869
- 19#.###.51.143:52869
- 41.###.170.92:52869
- 41.###.134.217:52869
- 19#.###.128.212:52869
- 15#.###.35.182:52869
- 41.##.154.114:52869
- 19#.##.62.8:52869
- 41.##.121.39:52869
- 19#.###.244.12:52869
- 15#.###.241.43:52869
- 15#.##.123.222:52869
- 19#.##.254.186:52869
- 15#.##.121.171:52869
- 41.###.12.33:52869
- 15#.###.241.197:52869
- 41.###.249.239:52869
- 15#.##.41.249:52869
- 19#.###.43.106:52869
- 15#.##3.29.93:52869
- 19#.###.238.226:52869
- 41.##.45.205:52869
- 15#.##.180.109:52869
- 15#.##1.74.31:52869
- 41.##.143.35:52869
- 19#.##.123.24:52869
- 41.##.201.206:52869
- 41.###.21.231:52869
- 41.###.21.243:52869
- 19#.##.217.250:52869
- 15#.##6.1.114:52869
- 41.##.243.133:52869
- 41.###.248.138:52869
- 15#.###.210.164:52869
- 41.##.19.132:52869
- 15#.##.103.225:52869
- 15#.###.185.166:52869
- 19#.###.180.225:52869
- 41.###.249.132:52869
- 19#.#.95.72:52869
- 15#.##.98.99:52869
- 15#.##.224.121:52869
- 41.###.14.55:52869
- 41.##.26.169:52869
- 19#.##.52.34:52869
- 41.###.234.98:52869
- 15#.##.122.48:52869
- 19#.###.112.217:52869
- 41.##.68.11:52869
- 41.#.#85.223:52869
- 19#.#.36.0:52869
- 41.###.249.128:52869
- 41.##.153.89:52869
- 19#.###.114.161:52869
- 41.##.162.5:52869
- 19#.###.217.191:52869
- 19#.###.112.29:52869
- 41.##.70.91:52869
- 19#.##6.53.68:52869
- 15#.###.208.146:52869
- 19#.##.71.122:52869
- 41.###.10.194:52869
- 41.##.47.61:52869
- 15#.###.120.182:52869
- 15#.###.237.22:52869
- 41.###.67.151:52869
- 19#.###.212.49:52869
- 15#.###.32.110:52869
- 19#.##.85.255:52869
- 19#.#.164.177:52869
- 41.###.42.209:52869
- 41.###.186.35:52869
- 19#.##2.2.148:52869
- 41.###.221.47:52869
- 41.###.190.251:52869
- 15#.###.238.172:52869
- 19#.#.7.138:52869
- 41.##.187.190:52869
- 19#.##.161.248:52869
- 41.###.230.34:52869
- 19#.#.163.222:52869
- 15#.###.231.170:52869
- 19#.##.169.255:52869
- 41.###.143.142:52869
- 41.###.98.45:52869
- 15#.###.13.182:52869
- 15#.###.145.104:52869
- 15#.##.103.197:52869
- 15#.#.127.191:52869
- 41.###.197.133:52869
- 19#.##.24.166:52869
- 19#.##.138.144:52869
- 19#.###.113.189:52869
- 41.###.16.81:52869
- 41.###.170.133:52869
- 41.###.57.120:52869
- 19#.##5.9.160:52869
- 19#.###.53.224:52869
- 19#.##.129.244:52869
- 15#.##.221.64:52869
- 15#.##.26.117:52869
- 15#.##.141.19:52869
- 15#.###.234.99:52869
- 41.###.35.233:52869
- 15#.###.153.28:52869
- 41.###.199.93:52869
- 15#.##.252.2:52869
- 15#.##.129.202:52869
- 41.###.51.79:52869
- 41.##.71.235:52869
- 41.###.94.19:52869
- 19#.##5.4.31:52869
- 41.##.167.118:52869
- 19#.##.148.250:52869
- 15#.###.56.253:52869
- 41.##.246.193:52869
- 41.###.74.216:52869
- 41.###.115.103:52869
- 19#.###.47.116:52869
- 15#.###.247.57:52869
- 41.##.225.32:52869
- 15#.##.149.14:52869
- 41.##.84.158:52869
- 19#.##.63.63:52869
- 15#.##.125.110:52869
- 15#.##.199.46:52869
- 19#.##.166.17:52869
- 41.##.12.171:52869
- 41.###.255.40:52869
- 41.###.83.59:52869
- 15#.###.101.214:52869
- 41.###.25.178:52869
- 15#.###.67.245:52869
- 19#.##.164.33:52869
- 41.###.15.99:52869
- 19#.###.206.22:52869
- 19#.#.47.130:52869
- 41.##.31.67:52869
- 19#.###.11.103:52869
- 15#.#.215.112:52869
- 19#.###.246.19:52869
- 19#.###.54.146:52869
- 15#.###.241.153:52869
- 19#.##.186.73:52869
- 41.##.196.68:52869
- 15#.###.124.232:52869
- 41.###.97.218:52869
- 19#.##.173.248:52869
- 15#.###.243.46:52869
- 15#.##4.28.29:52869
- 41.###.86.126:52869
- 41.###.207.104:52869
- 19#.##.170.148:52869
- 15#.##.154.100:52869
- 41.###.58.49:52869
- 41.###.68.96:52869
- 15#.###.226.76:52869
- 15#.##.92.50:52869
- 41.###.126.217:52869
- 15#.###.106.138:52869
- 15#.##.221.13:52869
- 41.###.67.168:52869
- 41.##.170.128:52869
- 15#.###.142.156:52869
- 19#.###.12.224:52869
- 41.###.80.32:52869
- 41.##.128.206:52869
- 15#.##.74.129:52869
- 41.###.43.104:52869
- 15#.###.251.191:52869
- 19#.###.126.225:52869
- 19#.###.222.191:52869
- 41.###.82.34:52869
- 19#.###.186.97:52869
- 15#.###.138.52:52869
- 19#.###.176.246:52869
- 41.##.213.28:52869
- 41.###.26.41:52869
- 19#.##0.60.30:52869
- 15#.###.145.113:52869
- 15#.###.199.209:52869
- 19#.##9.89.2:52869
- 15#.###.47.225:52869
- 41.###.24.44:52869
- 19#.###.74.213:52869
- 41.###.213.234:52869
- 41.###.157.77:52869
- 41.##.132.172:52869
- 15#.###.130.157:52869
- 19#.##.25.204:52869
- 41.###.134.186:52869
- 15#.##.253.79:52869
- 15#.##.206.139:52869
- 15#.##7.20.31:52869
- 19#.###.153.202:52869
- 15#.##.10.111:52869
- 15#.##.150.105:52869
- 19#.###.180.253:52869
- 15#.##.50.248:52869
- 41.###.106.90:52869
- 41.###.169.118:52869
- 19#.###.163.156:52869
- 19#.##4.57.33:52869
- 15#.##.142.221:52869
- 15#.###.252.14:52869
- 41.###.207.40:52869
- 41.###.235.252:52869
- 15#.###.131.101:52869
- 41.###.52.95:52869
Receives data from the following servers:
- 5.###.80.126:16
