Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
Performs operations with the file system:
Creates folders:
- /var/lib/.ecnk
- /root/.ssh
Creates or modifies files:
- /var/lib/.ecnk/.local
Deletes files:
- /tmp/.X11-unix
Network activity:
Establishes connection:
- 10#.##.42.77:55418
- 10#.##.42.31:37679
- 22#.#.5.5:53
- 20#.##.222.222:443
- 1.#.1.1:53
- 8.#.8.8:53
- 11#.#9.29.29:53
- 15#.##3.88.67:37527
DNS ASK:
- ip##fo.io
- ip##.#canhazip.com
- ip##ho.net
- v4.#dent.me
- ch#####.amazonaws.com
- bo#.####ismyipaddress.com
- wh#####yip.akamai.com
Other:
Collects information about network activity