Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
Kills the following processes:
- /usr/bin/lsb_release
Performs operations with the file system:
Creates folders:
- /root/.ddg
- /root/.ssh
Creates or modifies files:
- /root/.ddg/4000.db
Network activity:
Establishes connection:
- 22#.#.5.5:53
- 20#.##.222.222:443
- 1.#.1.1:53
- 11#.#9.29.29:53
- 8.#.8.8:53
- 52.###.139.131:9
- [2#######0:c000:1000::501]:9
- 21#.#39.32.21:9
- 21#.#39.34.21:9
- 21#.#39.36.21:9
- 21#.#39.38.21:9
- 13#.#78.68.38:9
- 13#.#78.82.59:9
- 52.##0.125.74:9
- 52.###.161.133:9
- 18.##1.215.84:9
- 52.#.79.229:9
- 34.##3.102.38:9
- 66.###.248.178:9
- 23.##.99.33:9
- 20#.##7.140.144:9
- 20#.##7.140.170:9
- 23.##.3.226:9
- 23.##.3.224:9
- 23.##.99.40:9
- 2.##.146.139:9
- 2.##.146.152:9
- 95.###.190.199:7946
- 22#.##8.72.45:7946
- 11#.##9.91.69:7946
- 11#.##.168.237:7946
- 12#.###.172.180:7946
- 11#.##.242.181:7946
HTTP GET requests:
- v4.##ent.me/
- ch#####.amazonaws.com/
- bo#.####ismyipaddress.com/
- ip####.net/plain
- ip###o.io/ip
- wh#####yip.akamai.com/
- ip##.#canhazip.com/
DNS ASK:
- ip##ho.net
- v4.#dent.me
- ip##.#canhazip.com
- ch#####.amazonaws.com
- bo#.####ismyipaddress.com
- ip##fo.io
- wh#####yip.akamai.com
Sends data to the following servers:
- 20#.##.222.222:443
- 1.#.1.1:53
- 11#.##.242.181:7946
- [:#######75.198.211.135]:7946
- [:######154.8.198.236]:7946
- [:######172.86.71.152]:7946
- [:#######32.232.39.149]:7946
- [:######36.7.88.94]:7946
- [:#######78.128.207.115]:7946
- [:#######12.164.119.246]:7946
- [:#######62.144.117.202]:7946
- [:######122.114.53.8]:7946
- [:######154.8.219.207]:7946
- [:#######23.58.240.146]:7946
- [:######122.114.6.136]:7946
- [:#######72.104.128.184]:7946
- [:#######83.239.175.146]:7946
- [:#######32.232.100.177]:7946
- [:######103.45.111.59]:7946
- [:######115.159.93.67]:7946
- [:######103.73.160.75]:7946
- [:######125.91.35.134]:7946
- [:######68.168.138.63]:7946
- [:#######03.21.143.156]:7946
- [:#######22.114.186.250]:7946
- [:#######78.128.54.128]:7946
- [:#######18.24.155.174]:7946
- [:#######11.231.87.228]:7946
Receives data from the following servers:
- 20#.##.222.222:443
- 1.#.1.1:53
- 11#.##.242.181:7946
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity