Technical Information
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
- dpkg-query -f ${Version} ${Provides
Kills the following processes:
- /usr/bin/lsb_release
Performs operations with the file system:
Creates folders:
- /tmp/.fmt
- /root/.ssh
Creates or modifies files:
- /tmp/.fmt/3018.lock
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 10#.#0.16.242:9
- 10#.#0.17.242:9
- 66.###.248.178:9
- 21#.#39.34.21:9
- 21#.#39.36.21:9
- 21#.#39.38.21:9
- 21#.#39.32.21:9
- 16#.##5.74.171:9
- 16#.##5.74.169:9
- 52.###.139.131:9
- 34.##3.102.38:9
- 52.##0.125.74:9
- 52.###.161.133:9
- [2#######0:c000:1000::501]:9
- 52.#.79.229:9
- 18.##1.215.84:9
- 95.###.190.199:7946
- 10#.##7.63.7:7946
- 18#.##.49.167:7946
- 60.###.209.24:7946
- 12#.##9.203.31:7947
- 14#.##3.225.49:7947
- 11#.##.140.89:7946
HTTP GET requests:
- ip##.#canhazip.com/
- v4.##ent.me/
- ip####.net/plain
- ip###o.io/ip
- wh#####yip.akamai.com/
- ch#####.amazonaws.com/
- bo#.####ismyipaddress.com/
DNS ASK:
- ip##.#canhazip.com
- bo#.####ismyipaddress.com
- ch#####.amazonaws.com
- wh#####yip.akamai.com
- ip##ho.net
- ip##fo.io
- v4.#dent.me
Sends data to the following servers:
- 11#.##.140.89:7946
Receives data from the following servers:
- 11#.##.140.89:7946
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity