Technical Information
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
- dpkg-query -f ${Version} ${Provides
- /sbin/sysctl -n kernel.random.boot_id
Performs operations with the file system:
Creates or modifies files:
- /tmp/.ddg/2020.db
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 47.##.149.2:8443
- 52.###.109.60:8443
- 12#.##.214.145:8443
- 12#.##.1.34:8443
- 10#.##.19.169:8443
- 10#.###.152.209:8443
- 47.##.105.210:8443
- 47.##.142.185:8443
- 10#.##7.3.227:8443
- 20#.##.162.88:8443
- 17#.##.23.192:8443
- 13.##.180.154:8443
- 18#.##0.186.71:8443
- 50.###.38.96:8443
- 11#.##.108.152:8443
- 10#.###.242.196:8443
- 11#.##.244.130:8443
- 21#.###.168.254:8443
- 20#.###.172.162:8443
- 70.##.99.2:8443
- 10#.##.227.96:8443
- 11#.##1.41.72:8443
- 11#.##.77.98:8443
- 10#.##0.238.77:8443
- 58.##.175.171:8443
- 40.##.34.233:8443
- 12#.##.181.1:8443
- 11#.##.38.229:8443
- 11#.##.231.212:8443
- 10#.###.229.153:8443
- 20#.##1.169.98:8443
- 10#.##.221.21:8443
- 18#.##6.20.28:8443
- 10#.###.231.181:8443
- 10#.##.49.92:8443
- 12#.##2.48.194:8443
- 59.###.92.23:8443
- 11#.##6.91.96:8443
- 11#.##6.69.38:8443
- 10#.###.152.166:8443
- 13.###.6.47:8443
- 11#.##5.204.81:8443
- 17#.##4.76.66:8443
- 21#.##9.63.166:8443
- 23.##.98.54:8443
- 21#.##8.40.228:8443
- 19#.#.98.175:8443
- 43.###.126.26:8443
- 61.##.107.171:8443
- 16#.##.169.181:8443
- 12#.##.249.186:8443
- 15#.#.64.243:8443
- 11#.##2.83.55:8443
- 18#.##.57.23:8443
- 12#.###.229.137:8443
- 11#.##.228.142:8443
- 10#.##.37.164:8443
- 52.##.121.30:8443
HTTP GET requests:
- v4.##ent.me/
DNS ASK:
- v4.#dent.me
Sends data to the following servers:
- 20#.##1.169.98:8443
- 21#.##8.40.228:8443
Receives data from the following servers:
- 20#.##1.169.98:8443
- 21#.##8.40.228:8443
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity