La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Linux.Lady.21

Aggiunto al database dei virus Dr.Web: 2017-11-04

La descrizione è stata aggiunta:

Technical Information

Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Launches processes:
  • /usr/bin/getconf CLK_TCK
  • <SAMPLE_FULL_PATH>
  • /usr/bin/lsb_release
  • dpkg-query -f ${Version} ${Provides
  • /sbin/sysctl -n kernel.random.boot_id
Performs operations with the file system:
Creates or modifies files:
  • /tmp/.ddg/2020.db
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 47.##.149.2:8443
  • 52.###.109.60:8443
  • 12#.##.214.145:8443
  • 12#.##.1.34:8443
  • 10#.##.19.169:8443
  • 10#.###.152.209:8443
  • 47.##.105.210:8443
  • 47.##.142.185:8443
  • 10#.##7.3.227:8443
  • 20#.##.162.88:8443
  • 17#.##.23.192:8443
  • 13.##.180.154:8443
  • 18#.##0.186.71:8443
  • 50.###.38.96:8443
  • 11#.##.108.152:8443
  • 10#.###.242.196:8443
  • 11#.##.244.130:8443
  • 21#.###.168.254:8443
  • 20#.###.172.162:8443
  • 70.##.99.2:8443
  • 10#.##.227.96:8443
  • 11#.##1.41.72:8443
  • 11#.##.77.98:8443
  • 10#.##0.238.77:8443
  • 58.##.175.171:8443
  • 40.##.34.233:8443
  • 12#.##.181.1:8443
  • 11#.##.38.229:8443
  • 11#.##.231.212:8443
  • 10#.###.229.153:8443
  • 20#.##1.169.98:8443
  • 10#.##.221.21:8443
  • 18#.##6.20.28:8443
  • 10#.###.231.181:8443
  • 10#.##.49.92:8443
  • 12#.##2.48.194:8443
  • 59.###.92.23:8443
  • 11#.##6.91.96:8443
  • 11#.##6.69.38:8443
  • 10#.###.152.166:8443
  • 13.###.6.47:8443
  • 11#.##5.204.81:8443
  • 17#.##4.76.66:8443
  • 21#.##9.63.166:8443
  • 23.##.98.54:8443
  • 21#.##8.40.228:8443
  • 19#.#.98.175:8443
  • 43.###.126.26:8443
  • 61.##.107.171:8443
  • 16#.##.169.181:8443
  • 12#.##.249.186:8443
  • 15#.#.64.243:8443
  • 11#.##2.83.55:8443
  • 18#.##.57.23:8443
  • 12#.###.229.137:8443
  • 11#.##.228.142:8443
  • 10#.##.37.164:8443
  • 52.##.121.30:8443
HTTP GET requests:
  • v4.##ent.me/
DNS ASK:
  • v4.#dent.me
Sends data to the following servers:
  • 20#.##1.169.98:8443
  • 21#.##8.40.228:8443
Receives data from the following servers:
  • 20#.##1.169.98:8443
  • 21#.##8.40.228:8443
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number