Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Linux.Lady.23

Added to the Dr.Web virus database: 2017-11-18

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Launches processes:
  • /usr/bin/getconf CLK_TCK
  • <SAMPLE_FULL_PATH>
  • /usr/bin/lsb_release
  • dpkg-query -f ${Version} ${Provides
  • /sbin/sysctl -n kernel.random.boot_id
Performs operations with the file system:
Creates or modifies files:
  • /root/.ddg/2003.db
Locks files:
  • /root/.ddg/2003.db
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 10#.##.134.239:8443
  • 39.###.56.56:8443
  • 11#.#.88.79:8443
  • 54.###.188.56:8443
  • 12#.##.91.4:8443
  • 47.##.147.21:8443
  • 12#.##7.22.73:8443
  • 19#.##9.226.28:8443
  • 75.###.190.180:8443
  • 15#.##.69.197:8443
  • 72.##.37.30:8443
  • 11#.##9.26.181:8443
  • 18#.##.110.206:8443
  • 10#.##.37.165:8443
  • 11#.##3.25.89:8443
  • 10#.#.159.247:8443
  • 11#.##.61.252:8443
  • 47.##.6.230:8443
  • 36.###.38.180:8443
  • 93.###.246.224:8443
  • 54.###.97.177:8443
  • 11#.##.209.222:8443
  • 11#.##.88.72:8443
  • 10#.###.143.126:8443
  • 13#.##9.167.32:8443
  • 11#.##.37.140:8443
  • 18#.##.175.24:8443
  • 11#.##.224.197:8443
  • 13#.##9.18.218:8443
  • 52.#.199.2:8443
  • 18#.##2.135.11:8443
  • 11#.##3.87.18:8443
  • 12#.##9.114.4:8443
  • 10#.###.120.211:8443
  • 10#.##0.53.85:8443
  • 12#.##.56.125:8443
  • 47.##.26.128:8443
  • 11#.##1.41.63:8443
  • 17#.##2.235.66:8443
  • 12#.##7.53.152:8443
  • 47.##.42.86:8443
  • 11#.##.157.39:8443
  • 11#.##.179.58:8443
  • 19#.##5.59.29:8443
  • 11#.##.46.137:8443
  • 11#.##3.48.114:8443
  • 81.#.#49.228:8443
  • 12#.##1.68.31:8443
  • 20#.###.182.198:8443
  • 22#.##2.108.47:8443
  • 21#.##5.26.45:8443
  • 90.##.255.160:8443
  • 64.##.133.26:8443
  • 14#.##.106.215:8443
  • 11#.##.78.93:8443
  • 54.###.178.110:8443
  • 10#.##.71.242:8443
  • 52.###.52.232:8443
  • 13#.##9.94.67:8443
  • 20#.##2.76.6:8443
  • 16#.###.131.116:8443
  • 10#.##.50.195:8443
  • 12#.##.227.4:8443
  • 52.###.62.47:8443
  • 12#.##.74.218:8443
  • 54.###.75.92:8443
  • 11#.##.244.130:8443
  • 16#.##.149.91:8443
  • 40.###.206.145:8443
  • 18#.###.202.134:8443
  • 11#.##2.83.55:8443
  • 12#.##7.23.209:8443
  • 12#.##.26.184:8443
  • 12#.##4.35.79:8443
  • 11#.#.116.208:8443
  • 12#.##7.241.55:8443
  • 12#.##.45.254:8443
  • 65.##.153.103:8443
  • 22#.##3.184.41:8443
  • 12#.##.18.192:8443
  • 47.##.148.15:8443
  • 35.###.117.10:8443
  • 87.###.219.23:8443
  • 12#.##6.64.46:8443
  • 11#.##.7.114:8443
  • 21#.##.133.167:8443
  • 59.##.185.142:8443
  • 21#.###.168.254:8443
  • 12#.###.138.201:8443
  • 49.###.147.113:8443
  • 61.##.191.22:8443
  • 10#.###.231.181:8443
  • 12#.##.51.227:8443
  • 11#.##.229.114:8443
  • 11#.##.130.8:8443
  • 21#.##8.40.228:8443
  • 35.###.190.241:8443
  • 10#.##.11.18:8443
  • 21#.###.195.116:8443
  • 14#.##6.80.4:8443
  • 11#.###.233.119:8443
  • 12#.##9.76.119:8443
  • 12#.###.253.251:8443
  • 12#.##.84.14:8443
  • 47.##.50.228:8443
  • 12#.##.68.17:8443
  • 18#.##0.186.71:8443
  • 11#.##.51.43:8443
  • 13#.##9.71.175:8443
  • 12#.##7.12.170:8443
  • 11#.##.43.68:8443
  • 13#.##9.26.214:8443
  • 21#.##5.181.92:8443
  • 12#.##.83.20:8443
  • 12#.##7.84.171:8443
  • 47.##.219.207:8443
  • 12#.##7.89.187:8443
  • 13#.###.189.214:8443
  • 15#.##3.26.156:8443
  • 52.##.148.234:8443
  • 16#.##4.77.205:8443
  • 69.##.233.144:8443
  • 54.###.143.108:8443
  • 16#.###.157.157:8443
  • 12#.##9.162.47:8443
  • 13#.###.165.224:8443
  • 11#.##.137.32:8443
  • 92.##.27.9:8443
  • 43.###.208.129:8443
  • 13#.##9.196.23:8443
  • 10#.##4.147.0:8443
  • 13#.##9.18.70:8443
  • 54.###.211.36:8443
  • 62.###.242.243:8443
  • 12#.##.74.213:8443
  • 18#.##.143.154:8443
  • 10#.##.177.233:8443
  • 11#.##.68.92:8443
  • 21#.##.168.164:8443
  • 54.###.250.239:8443
  • 20#.##1.169.98:8443
  • 11#.##.68.123:8443
  • 12#.##.141.71:8443
  • 54.###.159.38:8443
  • 12#.##.52.179:8443
  • 45.##.19.181:8443
  • 11#.##.65.199:8443
  • 12#.##.46.195:8443
  • 11#.##.239.71:8443
  • 11#.##.204.12:8443
  • 12#.##.84.41:8443
  • 69.###.85.114:8443
  • 11#.##.20.149:8443
  • 12#.##.100.33:8443
  • 45.##.223.204:8443
  • 47.##.7.232:8443
  • 11#.##.73.200:8443
  • 18#.##0.3.127:8443
  • 12#.##7.25.56:8443
  • 18#.##6.68.193:8443
HTTP GET requests:
  • v4.##ent.me/
DNS ASK:
  • v4.#dent.me
  • 5D###5BSMRD.COM
  • De#####Notepad567.com
  • UN###S1748.COM
Sends data to the following servers:
  • 19#.##9.226.28:8443
  • 93.###.246.224:8443
  • 81.#.#49.228:8443
  • 90.##.255.160:8443
  • 10#.##.50.195:8443
  • 12#.##.18.192:8443
  • 35.###.117.10:8443
  • 21#.##8.40.228:8443
  • 10#.##.11.18:8443
  • 15#.##3.26.156:8443
  • 62.###.242.243:8443
  • 21#.##.168.164:8443
  • 18#.##6.68.193:8443
Receives data from the following servers:
  • 19#.##9.226.28:8443
  • 93.###.246.224:8443
  • 81.#.#49.228:8443
  • 90.##.255.160:8443
  • 10#.##.50.195:8443
  • 12#.##.18.192:8443
  • 35.###.117.10:8443
  • 21#.##8.40.228:8443
  • 10#.##.11.18:8443
  • 15#.##3.26.156:8443
  • 62.###.242.243:8443
  • 21#.##.168.164:8443
  • 18#.##6.68.193:8443
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number