Technical Information
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- /usr/bin/getconf CLK_TCK
- <SAMPLE_FULL_PATH>
- /usr/bin/lsb_release
- dpkg-query -f ${Version} ${Provides
- /sbin/sysctl -n kernel.random.boot_id
Performs operations with the file system:
Creates folders:
- /root/.ssh
- /tmp/.ddg
Creates or modifies files:
- /tmp/.ddg/2021.db
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
- 52.###.109.60:8443
- 10#.###.152.209:8443
- 47.##.149.2:8443
- 12#.##.1.34:8443
- 12#.##.214.145:8443
- 10#.##.227.96:8443
- 10#.##.19.169:8443
- 47.##.142.185:8443
- 10#.##7.3.227:8443
- 20#.##.162.88:8443
- 17#.##.23.192:8443
- 13.##.180.154:8443
- 18#.##0.186.71:8443
- 50.###.38.96:8443
- 11#.##.108.152:8443
- 10#.###.242.196:8443
- 11#.##.244.130:8443
- 21#.###.168.254:8443
- 20#.###.172.162:8443
- 70.##.99.2:8443
- 40.##.34.233:8443
- 11#.##1.41.72:8443
- 11#.##.77.98:8443
- 10#.##0.238.77:8443
- 58.##.175.171:8443
- 18#.##.57.23:8443
- 12#.##.181.1:8443
- 11#.##.38.229:8443
- 47.##.105.210:8443
- 10#.###.229.153:8443
- 20#.##1.169.98:8443
- 10#.##.221.21:8443
- 18#.##6.20.28:8443
- 10#.###.231.181:8443
- 10#.##.49.92:8443
- 12#.##2.48.194:8443
- 11#.##.231.212:8443
- 11#.##6.91.96:8443
- 11#.##6.69.38:8443
- 10#.###.152.166:8443
- 13.###.6.47:8443
- 11#.##5.204.81:8443
- 17#.##4.76.66:8443
- 21#.##9.63.166:8443
- 23.##.98.54:8443
- 21#.##8.40.228:8443
- 19#.#.98.175:8443
- 43.###.126.26:8443
- 61.##.107.171:8443
- 16#.##.169.181:8443
- 12#.##.249.186:8443
- 15#.#.64.243:8443
- 11#.##2.83.55:8443
- 12#.##.81.73:8443
- 12#.###.229.137:8443
- 11#.##.228.142:8443
- 10#.##.37.164:8443
- 52.##.121.30:8443
- 45.##.19.3:8443
- 18#.###.158.233:8443
- 11#.###.195.121:8443
- 10#.##.232.131:8443
- 59.###.92.23:8443
- 13.###.174.26:8443
- 16#.##.48.42:8443
- 45.##.124.197:8443
- 12#.##.144.36:8443
- 17#.##4.86.254:8443
- 13#.###.246.243:8443
- 13#.##0.103.93:8443
- 13.###.246.230:8443
- 18#.###.158.234:8443
- 35.###.117.10:8443
- 10#.##.52.72:8443
- 12#.##.76.100:8443
- 10#.##.14.30:8443
- 11#.###.140.118:8443
- 81.###.213.61:8443
- 17#.##7.13.110:8443
- 10#.###.134.109:8443
- 11#.##.179.58:8443
- 47.##.242.3:8443
- 10#.##1.232.44:8443
- 21#.##.214.247:8443
- 13.###.99.28:8443
- 61.###.11.93:8443
- 11#.##6.115.88:8443
- 14#.##.106.215:8443
- 18#.##9.168.17:8443
- 52.##.148.234:8443
- 54.##.5.248:8443
- 12#.##.92.51:8443
- 13#.###.230.205:8443
- 54.##.5.251:8443
- 52.##.242.77:8443
- 43.###.126.8:8443
- 54.###.61.239:8443
- 11#.##.125.150:8443
- 59.###.127.86:8443
- 50.##.125.202:8443
- 13#.##9.77.218:8443
- 59.##.80.211:8443
- 47.##.218.199:8443
- 11#.###.191.147:8443
- 61.###.254.101:8443
- 12#.##6.20.181:8443
- 13.###.26.214:8443
- 11#.##.142.179:8443
- 17#.##4.170.8:8443
- 10#.###.135.227:8443
- 11#.##.228.106:8443
- 11#.##.252.210:8443
- 10#.##.151.237:8443
- 13.###.9.227:8443
- 45.##.68.34:8443
- 10#.###.151.191:8443
- 54.##.98.121:8443
- 96.##.51.21:8443
- 45.##.127.44:8443
- 20#.##.162.99:8443
- 11#.###.115.145:8443
- 35.###.190.241:8443
- 10#.##.177.232:8443
- 27.###.94.59:8443
- 11#.##4.101.52:8443
- 12#.##.221.92:8443
- 10#.##.186.157:8443
- 13.###.67.196:8443
- 12#.##.114.215:8443
- 12#.#.164.231:8443
- 19#.##.250.101:8443
- 11#.##.45.105:8443
- 17#.##7.29.78:8443
- 45.##.99.170:8443
- 13#.##8.9.134:8443
- 11#.##6.120.38:8443
- 11#.##.100.187:8443
- 52.##.201.85:8443
- 78.##.88.166:8443
- 52.##.166.41:8443
- 21#.###.195.116:8443
- 16#.##4.77.205:8443
- 58.###.61.42:8443
- 27.###.99.190:8443
- 21#.##.151.65:8443
- 13.###.214.65:8443
- 45.##.222.163:8443
- 12#.##.27.192:8443
- 12#.##7.10.165:8443
- 42.###.127.186:8443
- 18#.##.68.199:8443
- 10#.##.8.200:8443
- 11#.##.146.15:8443
- 13#.##9.28.246:8443
- 12#.##7.35.82:8443
- 12#.##.51.227:8443
- 12#.###.164.134:8443
- 11#.###.107.198:8443
- 11#.##1.203.12:8443
- 11#.##9.70.173:8443
- 12#.###.129.220:8443
- 12#.##.193.138:8443
- 11#.##.135.10:8443
- 18#.##.110.206:8443
- 58.###.101.211:8443
- 13.###.152.204:8443
- 54.###.242.200:8443
- 14#.###.155.191:8443
- 16#.###.157.157:8443
- 52.###.213.45:8443
- 12#.##2.67.170:8443
- 12#.##.212.215:8443
- 1.###.225.176:8443
- 51.##.137.192:8443
- 21#.##6.244.92:8443
- 11#.##.226.241:8443
- 54.###.34.71:8443
- 12#.##7.140.56:8443
- 18#.##.143.154:8443
- 18#.##.61.195:8443
- 11#.##9.42.117:8443
- 10#.###.143.126:8443
- 11#.##.53.102:8443
- 22#.###.244.162:8443
- 13#.##9.61.237:8443
- 12#.###.240.202:8443
- 19#.#.98.176:8443
- 47.##.149.104:8443
- 12#.##.100.33:8443
HTTP GET requests:
- v4.##ent.me/
DNS ASK:
- v4.#dent.me
Sends data to the following servers:
- 16#.##.48.42:8443
- 10#.##.52.72:8443
- 10#.###.151.191:8443
Receives data from the following servers:
- 10#.###.151.191:8443
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
