Technical Information
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
- /root/.ssh/config
Performs operations with the file system:
Modifies file access rights:
- /tmp/tmate-0/AOkCJg
Creates folders:
- /tmp/tmate-0
Creates or modifies files:
- /tmp/tmate-0/AOkCJg.lock
Deletes files:
- /tmp/tmate-0/AOkCJg
- /tmp/tmate-0/AOkCJg.lock
Locks files:
- /tmp/tmate-0/AOkCJg.lock
Network activity:
Establishes connection:
- 20#.##9.246.93:22
- 13#.##9.128.51:22
- 15#.##0.72.130:22
- 18#.##6.207.127:22
DNS ASK:
- sS#.#MaTE.Io