Technical Information
Malicious functions:
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
Performs operations with the file system:
Creates folders:
- /var/lib/.ivoz
- /root/.ssh
Creates or modifies files:
- /var/lib/.ivoz/.local
Deletes files:
- /tmp/.X11-unix
Network activity:
Establishes connection:
- 13#.###.127.223:33189
- 39.###.122.233:36857
- 22#.#.5.5:53
- 20#.##.222.222:443
- 1.#.1.1:53
- 8.#.8.8:53
- 11#.#9.29.29:53
- 13#.##4.56.255:9
- 14#.#5.47.199:9
- 11#.###.219.250:23903
- 21#.#39.36.21:9
- 21#.#39.38.21:9
- 52.###.182.174:9
- 52.##6.184.85:9
- 66.###.248.178:9
- [2#######0:c000:1000::501]:9
- 11#.##.13.208:38101
- 21#.#39.34.21:9
- 21#.#39.32.21:9
- 52.##4.109.97:9
- 23.##.252.178:9
- 34.##2.7.28:9
- 23.##.27.29:9
- 34.##0.69.241:9
- 2.##.242.243:9
- 2.##.194.168:9
- 2.##.194.136:9
- 18.##3.3.145:9
- 52.##.197.7:9
- 3.###.126.94:9
- 2.##.242.202:9
- 18.###.161.181:9
- 47.###.214.241:40370
- 18.##9.89.50:9
- 2.##.24.171:9
- 2.##.24.153:9
HTTP GET requests:
- v4.##ent.me/
- ip##.#canhazip.com/
- bo#.####ismyipaddress.com/
- ip####.net/plain
- ip###o.io/ip
- wh#####yip.akamai.com/
- ch#####.amazonaws.com/
DNS ASK:
- ip##ho.net
- ip##fo.io
- ip##.#canhazip.com
- v4.#dent.me
- ch#####.amazonaws.com
- bo#.####ismyipaddress.com
- wh#####yip.akamai.com
Sends data to the following servers:
- 20#.##.222.222:443
- 1.#.1.1:53
Receives data from the following servers:
- 1.#.1.1:53
- 20#.##.222.222:443
Other:
Collects information about network activity