Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
Performs operations with the file system:
Creates folders:
- /var/lib/.hfpk
- /root/.ssh
Creates or modifies files:
- /var/lib/.hfpk/.local
Deletes files:
- /tmp/.X11-unix
Network activity:
Establishes connection:
- 14#.###.154.22:40688
- 12#.##.70.158:46632
- 22#.#.5.5:53
- 49.###.23.43:34441
- 20#.##.222.222:443
- 1.#.1.1:53
- 8.#.8.8:53
- 11#.#9.29.29:53
- 49.###.9.242:42549
- 21#.#39.32.21:9
- 21#.#39.34.21:9
- 21#.#39.36.21:9
- [2#######0:c000:1000::501]:9
- 21#.#39.38.21:9
- 11#.###.155.40:46707
- 11#.##2.55.106:9
- 11#.##2.244.153:9
- 3.###.27.10:9
- 23.##.47.155:9
- 34.##3.114.5:9
- 18.##5.80.73:9
- 2.##.242.243:9
- 2.##.242.202:9
- 66.###.248.178:9
- 3.##.247.111:9
- 47.###.56.99:36063
- 52.##.92.19:9
- 21#.##5.157.200:9
- 21#.##5.157.146:9
- 52.##.94.130:9
- 18.###.184.162:9
- 3.###.112.167:9
- 23.##.7.114:9
- 54.##7.99.255:9
- 34.##5.208.47:9
- 11#.##.72.167:54328
- 92.##3.77.80:9
- 92.##3.77.48:9
- 23.##.7.80:9
- 10#.#0.34.193:9
- 12#.##.245.11:45033
HTTP GET requests:
- v4.##ent.me/
- ip###o.io/ip
- wh#####yip.akamai.com/
- ip##.#canhazip.com/
- bo#.####ismyipaddress.com/
- ip####.net/plain
- ch#####.amazonaws.com/
DNS ASK:
- ip##ho.net
- ip##fo.io
- ip##.#canhazip.com
- v4.#dent.me
- bo#.####ismyipaddress.com
- ch#####.amazonaws.com
- wh#####yip.akamai.com
Sends data to the following servers:
- 14#.###.154.22:40688
- 12#.##.70.158:46632
- 20#.##.222.222:443
- 1.#.1.1:53
- 49.###.23.43:34441
- 11#.###.155.40:46707
- 47.###.56.99:36063
Receives data from the following servers:
- 14#.###.154.22:40688
- 12#.##.70.158:46632
- 1.#.1.1:53
- 20#.##.222.222:443
- 49.###.23.43:34441
- 11#.###.155.40:46707
- 47.###.56.99:36063
Other:
Collects information about network activity