Linux.Packed.279

Technical Information

Malicious functions:

Launches itself as a daemon

Gets access to SSH keys

/root/.ssh/authorized_keys

Launches processes:

/usr/bin/getconf CLK_TCK
<SAMPLE_FULL_PATH>
/usr/bin/lsb_release
dpkg-query -f ${Version} ${Provides

Performs operations with the file system:

Creates folders:

/tmp/.ddg
/root/.ssh

Creates or modifies files:

/tmp/.ddg/3017.lock

Network activity:

Establishes connection:

8.#.8.8:53
21#.#39.38.21:9
95.##1.0.137:9
[2#######0:c000:1000::501]:9
95.##1.0.145:9
66.###.248.178:9
21#.#39.32.21:9
52.###.143.163:9
21#.#39.34.21:9
21#.#39.36.21:9
52.##0.125.74:9
34.##3.102.38:9
34.##6.82.108:9
18.##3.42.138:9
52.###.139.131:9
95.###.190.198:7946
59.#.#7.151:7947
12#.##.248.21:7946
47.###.96.62:7946

HTTP GET requests:

v4.##ent.me/
ip##.#canhazip.com/
wh#####yip.akamai.com/
ip####.net/plain
ip###o.io/ip
bo#.####ismyipaddress.com/
ch#####.amazonaws.com/

Sends data to the following servers:

8.#.8.8:53
59.#.#7.151:7947
[:######39.106.56.3]:7946
[:#######03.106.203.133]:7947
[:######45.55.88.41]:7947
[:#######22.152.204.51]:7946
[:#######20.76.103.100]:7946
[:######117.73.2.85]:7947
[:#######88.131.136.193]:7946
[:######58.83.224.86]:7946
[:#######0.171.240.113]:7947
[:#######16.62.175.140]:7947
[:######123.207.59.54]:7947
[:#######11.231.115.187]:7946
[:#######32.232.48.113]:7946
[:######120.79.44.67]:7946
[:######106.14.42.48]:7947
[:######119.9.77.151]:7946
[:######120.78.75.192]:7947
[:######115.29.77.254]:7946
[:######123.56.155.51]:7946
[:######1.180.2.170]:7946
[:#######20.25.164.145]:7946
[:#######11.231.209.131]:7947
[:######60.188.26.12]:7946
[:######114.112.93.54]:7947
[:#######21.194.132.98]:7946
[:#######93.112.158.185]:7946
[:#######18.126.105.177]:7947
[:#######92.144.187.66]:7946
[:######111.76.66.244]:7947
[:#######93.112.36.166]:7946
[:#######39.199.128.104]:7947
[:######139.129.8.24]:7947
[:#######03.247.10.117]:7947
[:######202.91.34.183]:7946
[:#######39.199.166.197]:7946
[:#######93.112.106.126]:7946
[:######47.97.20.112]:7946
[:######159.89.36.171]:7947
[:#######82.16.103.114]:7946
[:######47.93.192.13]:7946
[:#######39.162.48.148]:7946
[:#######22.114.130.111]:7946
[:#######20.78.231.128]:7947
[:######47.88.60.88]:7946
[:#######11.230.177.57]:7946
[:######112.35.26.129]:7946
[:######117.73.2.123]:7947
[:#######7.106.151.255]:7946
[:#######15.47.153.114]:7947
[:#######13.73.134.103]:7946
[:######117.73.3.239]:7947
[:######120.78.83.168]:7946
[:######112.74.128.9]:7946
[:#######11.230.171.60]:7946
[:######115.159.38.23]:7946
[:######106.13.35.115]:7947
[:#######01.201.76.199]:7946
[:#######50.109.74.114]:7947
[:#######17.239.70.196]:7946
[:######39.105.2.247]:7946
[:######111.76.66.8]:7947
[:#######11.230.153.238]:7947
[:######60.172.95.184]:7946
[:#######20.76.216.235]:7946
[:#######22.152.204.97]:7947
[:######61.145.57.16]:7947
[:######139.199.18.70]:7946
[:######120.76.141.71]:7947
[:#######62.243.125.126]:7946
[:#######02.38.173.121]:7946
[:######47.93.27.241]:7946
[:#######23.57.173.243]:7947
[:#######20.78.143.252]:7946
[:#######40.143.195.99]:7947
[:######101.200.53.83]:7946
[:######120.92.40.245]:7946
[:######101.37.16.47]:7946
[:######118.24.231.39]:7946
[:#######11.230.18.117]:7947
[:#######40.143.136.14]:7946
[:######119.10.73.26]:7946
[:#######72.96.214.231]:7947
[:######47.96.117.194]:7947
[:#######9.106.154.243]:7947
[:#######39.196.240.40]:7946
[:######47.96.255.179]:7946
[:######103.56.19.56]:7946
[:######119.28.52.46]:7947
[:######120.79.122.29]:7946
[:#######20.26.196.239]:7946
[:######119.29.245.52]:7946
[:#######7.106.135.124]:7946
[:#######34.175.227.68]:7946
[:######118.27.32.230]:7946
[:######47.95.9.162]:7946
[:#######75.102.179.12]:7947
[:######106.15.52.71]:7946
[:######118.25.90.216]:7946
[:######106.12.83.187]:7947
[:#######20.79.157.154]:7946
[:#######22.186.129.125]:7946
[:#######04.194.83.222]:7946
[:#######22.114.192.55]:7947
[:######171.80.0.139]:7946
[:#######10.216.61.138]:7946
[:#######11.231.62.201]:7947
[:######103.45.7.177]:7946
[:#######93.112.110.93]:7946
[:#######23.206.201.67]:7946
[:#######11.230.92.132]:7946
[:#######7.254.130.252]:7947
[:#######19.27.162.127]:7946
[:#######20.25.102.203]:7946
[:#######39.59.209.147]:7947
[:######182.61.15.252]:7946
[:######180.76.244.78]:7946
[:######124.42.72.91]:7946
[:######47.93.254.164]:7947
[:######39.96.4.80]:7946
[:#######19.59.127.150]:7947
[:######211.114.21.89]:7947
[:#######21.194.132.100]:7946
[:#######03.124.106.188]:7946
[:#######23.57.139.170]:7947
[:######120.27.97.248]:7947
[:######123.57.237.76]:7946
[:#######9.108.122.254]:7946
[:#######06.12.109.237]:7946
[:######117.146.60.20]:7947
[:######123.57.29.80]:7946
[:######118.24.154.82]:7946
[:######115.159.52.39]:7947
[:#######23.206.191.170]:7947
[:#######21.132.82.122]:7947
[:######47.100.54.161]:7947
[:#######18.126.108.24]:7946
[:######103.96.3.33]:7946
[:#######11.230.28.175]:7947
[:######123.57.33.212]:7946
[:#######9.107.203.227]:7946
[:#######23.57.244.251]:7946
[:######121.41.99.187]:7947
[:######39.108.109.58]:7946
[:#######40.143.90.154]:7947
[:#######20.78.240.211]:7946
[:#######04.131.163.57]:7947
[:######103.39.77.236]:7946
[:######58.192.69.35]:7947
[:######120.55.80.204]:7946
[:#######23.207.47.115]:7946
[:#######03.190.154.110]:7946
[:#######23.206.18.228]:7947
[:######118.25.3.28]:7947
[:#######20.78.144.233]:7946
[:######59.36.145.206]:7946
[:######125.5.178.157]:7946
[:#######11.231.230.65]:7947
[:#######9.108.245.223]:7947
[:######218.4.237.108]:7947
[:######119.9.77.75]:7946
[:#######24.192.161.179]:7946
[:#######21.40.252.119]:7946
[:######47.100.27.211]:7946
[:######45.78.77.106]:7947
[:#######02.162.221.174]:7947
[:######35.243.119.96]:7946
[:#######14.115.137.180]:7947
[:######120.78.148.10]:7946
[:######60.205.209.24]:7947
[:######118.89.217.77]:7946
[:######114.55.43.61]:7946
[:######47.104.17.82]:7946
[:######119.3.52.198]:7947
[:######39.108.212.30]:7946
[:#######40.143.100.90]:7946
[:######182.92.67.222]:7946
[:######120.77.8.118]:7946
[:#######11.231.240.76]:7946
[:######119.29.98.155]:7946
[:######58.87.91.127]:7946
[:######103.242.0.146]:7947
[:######120.24.7.6]:7946
[:######120.76.155.15]:7947
[:######60.205.146.36]:7947
[:#######23.206.41.168]:7947
[:#######11.26.195.101]:7946
[:#######39.199.190.59]:7946
[:#######39.162.219.43]:7947
[:######47.52.28.132]:7947
[:######134.175.6.68]:7946
[:#######03.240.182.42]:7946
[:######116.62.127.4]:7946
[:######47.96.128.28]:7946
[:#######82.140.132.133]:7947
[:######182.16.92.171]:7947
[:######117.48.197.10]:7946
[:######121.42.248.21]:7946
[:#######17.42.126.254]:7947
[:#######82.140.132.134]:7946
[:#######11.230.231.130]:7947
[:######103.72.164.86]:7947
[:######114.112.93.59]:7947
[:#######14.215.29.120]:7947
[:#######06.14.157.115]:7946
[:#######82.254.151.111]:7947
[:#######03.21.140.244]:7946
[:#######23.126.156.61]:7947
[:######39.106.26.23]:7946
[:######69.171.76.144]:7947
[:#######01.132.172.48]:7946
[:#######14.215.70.222]:7946
[:#######39.199.100.28]:7946
[:#######18.24.118.135]:7947
[:#######20.24.223.164]:7947
[:#######40.143.237.108]:7946
[:#######10.16.189.131]:7946
[:#######39.199.61.237]:7946
[:######120.132.56.15]:7947
[:######58.87.87.155]:7946
[:######117.141.5.87]:7947
[:######118.25.2.114]:7946
[:#######7.100.174.105]:7947
[:#######39.162.96.133]:7946
[:#######18.25.226.173]:7946
[:######120.26.83.158]:7947
[:#######29.204.15.186]:7947
[:#######40.143.228.224]:7947
[:#######15.159.189.241]:7946
[:#######23.147.221.101]:7947
[:#######5.163.204.146]:7946
[:######47.107.132.49]:7946
[:#######32.232.127.22]:7947
[:#######06.12.210.182]:7947
[:######47.104.96.62]:7946
[:######47.107.161.86]:7946
[:######39.104.165.91]:7947
[:#######93.112.109.119]:7947
[:#######40.143.148.16]:7946
[:#######39.196.30.145]:7946
[:######117.50.74.84]:7946
[:######103.242.1.42]:7946
[:#######23.206.85.224]:7947
[:######47.104.67.252]:7948
[:#######23.207.242.78]:7947
[:######47.98.197.215]:7946
[:######58.49.232.213]:7946
[:#######18.126.105.116]:7947
[:#######03.219.112.66]:7946
[:######182.61.13.176]:7946
[:######118.178.85.50]:7947
[:######123.207.99.21]:7946
[:######47.99.181.195]:7947
[:#######11.231.140.214]:7946
[:#######39.162.233.127]:7946
[:######47.93.206.239]:7946
[:#######7.104.193.204]:7946
[:#######06.245.142.117]:7946
[:######47.106.97.25]:7946
[:######119.9.106.27]:7946
47.###.96.62:7946
[:######36.25.34.76]:7947
[:#######13.160.211.56]:7947
[:######120.76.41.109]:7946
[:######47.100.117.86]:7946
[:######123.56.16.227]:7946
[:#######18.126.115.245]:7946
[:#######9.108.208.110]:7947
[:#######03.193.151.239]:7947
[:######47.104.213.65]:7947
[:#######93.112.109.40]:7947
[:#######39.199.174.250]:7946
[:#######19.29.118.247]:7946
[:######39.108.71.221]:7946
[:#######22.186.169.147]:7946
[:#######03.51.160.130]:7946
[:######180.76.57.239]:7946
[:#######7.107.137.244]:7946
[:#######11.231.84.214]:7946
[:######218.86.60.114]:7946
[:#######11.149.241.144]:7947
[:#######11.230.222.151]:7946

Receives data from the following servers:

8.#.8.8:53
59.#.#7.151:7947
47.###.96.62:7946

Other:

Collects OS information

Collects CPU information

Collects RAM information

Collects information about network activity

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations