Technical Information
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
- /sbin/sysctl -n kernel.random.boot_id
Kills the following processes:
- /usr/bin/lsb_release
Performs operations with the file system:
Creates or modifies files:
- /root/.ddg/2005.db
Locks files:
- /root/.ddg/2005.db
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 19#.##9.226.28:8443
- 39.###.56.56:8443
- 10#.##.134.239:8443
- 54.###.188.56:8443
- 12#.##.91.4:8443
- 47.##.147.21:8443
- 12#.##7.22.73:8443
- 11#.##.61.252:8443
- 75.###.190.180:8443
- 15#.##.69.197:8443
- 72.##.37.30:8443
- 11#.##9.26.181:8443
- 18#.##.110.206:8443
- 10#.##.37.165:8443
- 11#.##3.25.89:8443
- 10#.#.159.247:8443
- 13#.##9.18.218:8443
- 47.##.6.230:8443
- 36.###.38.180:8443
- 93.###.246.224:8443
- 54.###.97.177:8443
- 11#.##.209.222:8443
- 11#.##.88.72:8443
- 10#.###.143.126:8443
- 13#.##9.167.32:8443
- 11#.##.37.140:8443
- 18#.##.175.24:8443
- 11#.##.224.197:8443
- 11#.#.88.79:8443
- 52.#.199.2:8443
- 18#.##2.135.11:8443
- 11#.##3.87.18:8443
- 12#.##9.114.4:8443
- 10#.###.120.211:8443
- 12#.##.56.125:8443
- 47.##.26.128:8443
- 11#.##1.41.63:8443
- 17#.##2.235.66:8443
- 12#.##7.53.152:8443
- 47.##.42.86:8443
- 10#.##0.53.85:8443
- 11#.##.179.58:8443
- 19#.##5.59.29:8443
- 11#.##.46.137:8443
- 11#.##3.48.114:8443
- 81.#.#49.228:8443
- 12#.##1.68.31:8443
- 20#.###.182.198:8443
- 22#.##2.108.47:8443
- 21#.##5.26.45:8443
- 90.##.255.160:8443
- 64.##.133.26:8443
- 14#.##.106.215:8443
- 11#.##.78.93:8443
- 54.###.178.110:8443
- 10#.##.71.242:8443
- 52.###.52.232:8443
- 11#.##.157.39:8443
- 20#.##2.76.6:8443
- 16#.###.131.116:8443
- 10#.##.50.195:8443
- 12#.##.227.4:8443
- 52.###.62.47:8443
- 12#.##.74.218:8443
- 54.###.75.92:8443
- 11#.##.244.130:8443
- 16#.##.149.91:8443
- 40.###.206.145:8443
- 18#.###.202.134:8443
- 11#.##2.83.55:8443
- 12#.##7.23.209:8443
- 12#.##.26.184:8443
- 12#.##4.35.79:8443
- 11#.#.116.208:8443
- 12#.##7.241.55:8443
- 12#.##.45.254:8443
- 65.##.153.103:8443
- 22#.##3.184.41:8443
- 12#.##.18.192:8443
- 47.##.148.15:8443
- 35.###.117.10:8443
- 87.###.219.23:8443
- 12#.##6.64.46:8443
- 11#.##.7.114:8443
- 21#.##.133.167:8443
- 59.##.185.142:8443
- 21#.###.168.254:8443
- 12#.###.138.201:8443
- 49.###.147.113:8443
- 61.##.191.22:8443
- 10#.###.231.181:8443
- 12#.##.51.227:8443
- 11#.##.229.114:8443
- 11#.##.130.8:8443
- 21#.##8.40.228:8443
- 35.###.190.241:8443
- 10#.##.11.18:8443
- 21#.###.195.116:8443
- 14#.##6.80.4:8443
- 11#.###.233.119:8443
- 12#.##9.76.119:8443
- 12#.###.253.251:8443
- 12#.##.84.14:8443
- 47.##.50.228:8443
- 12#.##.68.17:8443
- 18#.##0.186.71:8443
- 11#.##.51.43:8443
- 13#.##9.71.175:8443
- 12#.##7.12.170:8443
- 13#.##9.94.67:8443
- 13#.##9.26.214:8443
- 21#.##5.181.92:8443
- 12#.##.83.20:8443
- 12#.##7.84.171:8443
- 47.##.219.207:8443
- 12#.##7.89.187:8443
- 13#.###.189.214:8443
- 15#.##3.26.156:8443
- 52.##.148.234:8443
- 16#.##4.77.205:8443
- 69.##.233.144:8443
- 54.###.143.108:8443
- 16#.###.157.157:8443
- 12#.##9.162.47:8443
- 13#.###.165.224:8443
- 11#.##.137.32:8443
- 92.##.27.9:8443
- 43.###.208.129:8443
- 13#.##9.196.23:8443
- 10#.##4.147.0:8443
- 13#.##9.18.70:8443
- 54.###.211.36:8443
- 11#.##.43.68:8443
- 62.###.242.243:8443
- 12#.##.74.213:8443
- 18#.##.143.154:8443
- 10#.##.177.233:8443
- 11#.##.68.92:8443
- 21#.##.168.164:8443
- 54.###.250.239:8443
- 12#.##.141.71:8443
- 20#.##1.169.98:8443
- 11#.##.68.123:8443
- 54.###.159.38:8443
- 12#.##.52.179:8443
- 45.##.19.181:8443
- 11#.##.65.199:8443
- 12#.##.46.195:8443
- 11#.##.239.71:8443
- 45.##.223.204:8443
- 11#.##.204.12:8443
- 12#.##.84.41:8443
- 69.###.85.114:8443
- 11#.##.20.149:8443
- 12#.##.100.33:8443
- 47.##.7.232:8443
- 11#.##.73.200:8443
- 18#.##0.3.127:8443
- 12#.##7.25.56:8443
- 18#.##6.68.193:8443
HTTP GET requests:
- v4.##ent.me/
DNS ASK:
- v4.#dent.me
- 5D###5BSMRD.COM
- De#####Notepad567.com
- UN###S1748.COM
Sends data to the following servers:
- 19#.##9.226.28:8443
- 93.###.246.224:8443
- 81.#.#49.228:8443
- 90.##.255.160:8443
- 10#.##.50.195:8443
- 12#.##.18.192:8443
- 21#.##8.40.228:8443
- 10#.##.11.18:8443
- 15#.##3.26.156:8443
- 62.###.242.243:8443
- 21#.##.168.164:8443
- 20#.##1.169.98:8443
- 45.##.223.204:8443
- 18#.##6.68.193:8443
Receives data from the following servers:
- 93.###.246.224:8443
- 19#.##9.226.28:8443
- 81.#.#49.228:8443
- 90.##.255.160:8443
- 10#.##.50.195:8443
- 12#.##.18.192:8443
- 21#.##8.40.228:8443
- 10#.##.11.18:8443
- 15#.##3.26.156:8443
- 62.###.242.243:8443
- 21#.##.168.164:8443
- 20#.##1.169.98:8443
- 45.##.223.204:8443
- 18#.##6.68.193:8443
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
