Technical Information
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
- dpkg-query -f ${Version} ${Provides
- /sbin/sysctl -n kernel.random.boot_id
Kills the following processes:
- /usr/bin/lsb_release
Performs operations with the file system:
Creates or modifies files:
- /root/.ddg/2004.db
Locks files:
- /root/.ddg/2004.db
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 39.###.56.56:8443
- 10#.#.159.247:8443
- 10#.##.134.239:8443
- 54.###.188.56:8443
- 12#.##.91.4:8443
- 47.##.147.21:8443
- 12#.##7.22.73:8443
- 19#.##9.226.28:8443
- 75.###.190.180:8443
- 15#.##.69.197:8443
- 72.##.37.30:8443
- 11#.##9.26.181:8443
- 18#.##.110.206:8443
- 10#.##.37.165:8443
- 11#.##3.25.89:8443
- 11#.##.61.252:8443
- 47.##.6.230:8443
- 36.###.38.180:8443
- 93.###.246.224:8443
- 54.###.97.177:8443
- 11#.##.209.222:8443
- 11#.##.88.72:8443
- 10#.###.143.126:8443
- 13#.##9.167.32:8443
- 11#.##.37.140:8443
- 18#.##.175.24:8443
- 11#.##.224.197:8443
- 11#.#.88.79:8443
- 13#.##9.18.218:8443
- 54.###.178.110:8443
- 52.#.199.2:8443
- 18#.##2.135.11:8443
- 11#.##3.87.18:8443
- 12#.##9.114.4:8443
- 10#.###.120.211:8443
- 12#.##.56.125:8443
- 47.##.26.128:8443
- 11#.##1.41.63:8443
- 17#.##2.235.66:8443
- 12#.##7.53.152:8443
- 47.##.42.86:8443
- 10#.##0.53.85:8443
- 11#.##.179.58:8443
- 19#.##5.59.29:8443
- 11#.##.46.137:8443
- 11#.##3.48.114:8443
- 81.#.#49.228:8443
- 12#.##1.68.31:8443
- 20#.###.182.198:8443
- 22#.##2.108.47:8443
- 21#.##5.26.45:8443
- 90.##.255.160:8443
- 64.##.133.26:8443
- 14#.##.106.215:8443
- 11#.##.78.93:8443
- 22#.##3.184.41:8443
- 10#.##.71.242:8443
- 52.###.52.232:8443
- 11#.##.157.39:8443
- 20#.##2.76.6:8443
- 16#.###.131.116:8443
- 10#.##.50.195:8443
- 12#.##.227.4:8443
- 52.###.62.47:8443
- 12#.##.74.218:8443
- 54.###.75.92:8443
- 11#.##.244.130:8443
- 16#.##.149.91:8443
- 40.###.206.145:8443
- 18#.###.202.134:8443
- 11#.##2.83.55:8443
- 12#.##7.23.209:8443
- 12#.##.26.184:8443
HTTP GET requests:
- v4.##ent.me/
DNS ASK:
- v4.#dent.me
Sends data to the following servers:
- 19#.##9.226.28:8443
- 93.###.246.224:8443
- 81.#.#49.228:8443
- 90.##.255.160:8443
- 10#.##.50.195:8443
Receives data from the following servers:
- 19#.##9.226.28:8443
- 93.###.246.224:8443
- 81.#.#49.228:8443
- 90.##.255.160:8443
- 10#.##.50.195:8443
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity