it kinda looks like you got a used device imho 
if you don’t trust it due to persistence flash the image via u-boot this will re-create all partitions.
edit: ^ also it is really important to use u-boot, because u-boot erase the partitions fully, just a upgrade will still have possibilities to keep persistence through things like /root/, or /etc/sysupgrade.conf
revsocks is a tool like shadowsocks, however and this is why you still need to see it as a threat no mather what.
it can also be done with the intention to man in the middle your traffic / spy on you, maybe tamper downloads by drive by.
it is not a virus, but clearly someone used this router before either with malicious intent or not.
wether it is a persistent threat or not, I think this is too early to know that.
often for many apt actors normal people are not super important unless you are a programmer with repo access (download servers) to infect as most of the people in a really fast time, a isp, a bussiness, or political reasons, or being a investor.
but it doesn’t mean they can make mistakes, or it is just a solo hacker with that intend.
I would advise to check your most critical devices such as Windows, comprehending what you have downloaded at the time presence, did you accept certificates on sites?, maybe reinstall if you don’t trust it, and check the connections to the outside if something is strange.
edit:
also I did some research on this ip.
according urlhaus virustotal its falling under the mirai botnet activity.
so report it and clean it 
