Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Linux.Lady.26

Added to the Dr.Web virus database: 2017-12-12

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Launches processes:
  • /usr/bin/getconf CLK_TCK
  • <SAMPLE_FULL_PATH>
  • /usr/bin/lsb_release
  • dpkg-query -f ${Version} ${Provides
  • /sbin/sysctl -n kernel.random.boot_id
Performs operations with the file system:
Creates folders:
  • /root/.ssh
  • /tmp/.ddg
Creates or modifies files:
  • /tmp/.ddg/2021.db
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 52.###.109.60:8443
  • 10#.###.152.209:8443
  • 47.##.149.2:8443
  • 12#.##.1.34:8443
  • 12#.##.214.145:8443
  • 10#.##.227.96:8443
  • 10#.##.19.169:8443
  • 47.##.142.185:8443
  • 10#.##7.3.227:8443
  • 20#.##.162.88:8443
  • 17#.##.23.192:8443
  • 13.##.180.154:8443
  • 18#.##0.186.71:8443
  • 50.###.38.96:8443
  • 11#.##.108.152:8443
  • 10#.###.242.196:8443
  • 11#.##.244.130:8443
  • 21#.###.168.254:8443
  • 20#.###.172.162:8443
  • 70.##.99.2:8443
  • 40.##.34.233:8443
  • 11#.##1.41.72:8443
  • 11#.##.77.98:8443
  • 10#.##0.238.77:8443
  • 58.##.175.171:8443
  • 18#.##.57.23:8443
  • 12#.##.181.1:8443
  • 11#.##.38.229:8443
  • 47.##.105.210:8443
  • 10#.###.229.153:8443
  • 20#.##1.169.98:8443
  • 10#.##.221.21:8443
  • 18#.##6.20.28:8443
  • 10#.###.231.181:8443
  • 10#.##.49.92:8443
  • 12#.##2.48.194:8443
  • 11#.##.231.212:8443
  • 11#.##6.91.96:8443
  • 11#.##6.69.38:8443
  • 10#.###.152.166:8443
  • 13.###.6.47:8443
  • 11#.##5.204.81:8443
  • 17#.##4.76.66:8443
  • 21#.##9.63.166:8443
  • 23.##.98.54:8443
  • 21#.##8.40.228:8443
  • 19#.#.98.175:8443
  • 43.###.126.26:8443
  • 61.##.107.171:8443
  • 16#.##.169.181:8443
  • 12#.##.249.186:8443
  • 15#.#.64.243:8443
  • 11#.##2.83.55:8443
  • 12#.##.81.73:8443
  • 12#.###.229.137:8443
  • 11#.##.228.142:8443
  • 10#.##.37.164:8443
  • 52.##.121.30:8443
  • 45.##.19.3:8443
  • 18#.###.158.233:8443
  • 11#.###.195.121:8443
  • 10#.##.232.131:8443
  • 59.###.92.23:8443
  • 13.###.174.26:8443
  • 16#.##.48.42:8443
  • 45.##.124.197:8443
  • 12#.##.144.36:8443
  • 17#.##4.86.254:8443
  • 13#.###.246.243:8443
  • 13#.##0.103.93:8443
  • 13.###.246.230:8443
  • 18#.###.158.234:8443
  • 35.###.117.10:8443
  • 10#.##.52.72:8443
  • 12#.##.76.100:8443
  • 10#.##.14.30:8443
  • 11#.###.140.118:8443
  • 81.###.213.61:8443
  • 17#.##7.13.110:8443
  • 10#.###.134.109:8443
  • 11#.##.179.58:8443
  • 47.##.242.3:8443
  • 10#.##1.232.44:8443
  • 21#.##.214.247:8443
  • 13.###.99.28:8443
  • 61.###.11.93:8443
  • 11#.##6.115.88:8443
  • 14#.##.106.215:8443
  • 18#.##9.168.17:8443
  • 52.##.148.234:8443
  • 54.##.5.248:8443
  • 12#.##.92.51:8443
  • 13#.###.230.205:8443
  • 54.##.5.251:8443
  • 52.##.242.77:8443
  • 43.###.126.8:8443
  • 54.###.61.239:8443
  • 11#.##.125.150:8443
  • 59.###.127.86:8443
  • 50.##.125.202:8443
  • 13#.##9.77.218:8443
  • 59.##.80.211:8443
  • 47.##.218.199:8443
  • 11#.###.191.147:8443
  • 61.###.254.101:8443
  • 12#.##6.20.181:8443
  • 13.###.26.214:8443
  • 11#.##.142.179:8443
  • 17#.##4.170.8:8443
  • 10#.###.135.227:8443
  • 11#.##.228.106:8443
  • 11#.##.252.210:8443
  • 10#.##.151.237:8443
  • 13.###.9.227:8443
  • 45.##.68.34:8443
  • 10#.###.151.191:8443
  • 54.##.98.121:8443
  • 96.##.51.21:8443
  • 45.##.127.44:8443
  • 20#.##.162.99:8443
  • 11#.###.115.145:8443
  • 35.###.190.241:8443
  • 10#.##.177.232:8443
  • 27.###.94.59:8443
  • 11#.##4.101.52:8443
  • 12#.##.221.92:8443
  • 10#.##.186.157:8443
  • 13.###.67.196:8443
  • 12#.##.114.215:8443
  • 12#.#.164.231:8443
  • 19#.##.250.101:8443
  • 11#.##.45.105:8443
  • 17#.##7.29.78:8443
  • 45.##.99.170:8443
  • 13#.##8.9.134:8443
  • 11#.##6.120.38:8443
  • 11#.##.100.187:8443
  • 52.##.201.85:8443
  • 78.##.88.166:8443
  • 52.##.166.41:8443
  • 21#.###.195.116:8443
  • 16#.##4.77.205:8443
  • 58.###.61.42:8443
  • 27.###.99.190:8443
  • 21#.##.151.65:8443
  • 13.###.214.65:8443
  • 45.##.222.163:8443
  • 12#.##.27.192:8443
  • 12#.##7.10.165:8443
  • 42.###.127.186:8443
  • 18#.##.68.199:8443
  • 10#.##.8.200:8443
  • 11#.##.146.15:8443
  • 13#.##9.28.246:8443
  • 12#.##7.35.82:8443
  • 12#.##.51.227:8443
  • 12#.###.164.134:8443
  • 11#.###.107.198:8443
  • 11#.##1.203.12:8443
  • 11#.##9.70.173:8443
  • 12#.###.129.220:8443
  • 12#.##.193.138:8443
  • 11#.##.135.10:8443
  • 18#.##.110.206:8443
  • 58.###.101.211:8443
  • 13.###.152.204:8443
  • 54.###.242.200:8443
  • 14#.###.155.191:8443
  • 16#.###.157.157:8443
  • 52.###.213.45:8443
  • 12#.##2.67.170:8443
  • 12#.##.212.215:8443
  • 1.###.225.176:8443
  • 51.##.137.192:8443
  • 21#.##6.244.92:8443
  • 11#.##.226.241:8443
  • 54.###.34.71:8443
  • 12#.##7.140.56:8443
  • 18#.##.143.154:8443
  • 18#.##.61.195:8443
  • 11#.##9.42.117:8443
  • 10#.###.143.126:8443
  • 11#.##.53.102:8443
  • 22#.###.244.162:8443
  • 13#.##9.61.237:8443
  • 12#.###.240.202:8443
  • 19#.#.98.176:8443
  • 47.##.149.104:8443
  • 12#.##.100.33:8443
HTTP GET requests:
  • v4.##ent.me/
DNS ASK:
  • v4.#dent.me
Sends data to the following servers:
  • 16#.##.48.42:8443
  • 10#.##.52.72:8443
  • 10#.###.151.191:8443
Receives data from the following servers:
  • 10#.###.151.191:8443
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number