Technical Information
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates or modifies files:
- /root/.ddg/1009.db
Locks files:
- /root/.ddg/1009.db
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 10#.##0.219.87:9443
- 10#.##0.33.196:9443
- 10#.##1.75.161:9443
HTTP GET requests:
- v4.##ent.me/
DNS ASK:
- v4.#dent.me
Other:
Collects information about network activity