Linux.Lady.36

Техническая информация

Вредоносные функции:

Запускает себя в качестве демона

Получает доступ к ключам SSH

/root/.ssh/authorized_keys

Запускает процессы:

/usr/bin/getconf CLK_TCK
<SAMPLE_FULL_PATH>
/usr/bin/lsb_release
dpkg-query -f ${Version} ${Provides

Выполняет операции с файловой системой:

Создает папки:

/tmp/.fmt
/root/.ssh

Создает или модифицирует файлы:

/tmp/.fmt/3019.lock

Сетевая активность:

Устанавливает соединение:

<LOCAL_DNS_SERVER>
[2#######0:c000:1000::501]:9
66.###.248.178:9
21#.#39.32.21:9
21#.#39.34.21:9
21#.#39.36.21:9
21#.#39.38.21:9
52.###.139.131:9
34.##3.102.38:9
18.##3.42.138:9
52.##0.125.74:9
34.##6.82.108:9
52.#.208.170:9
85.##2.113.43:9
85.##2.113.42:9
95.###.190.198:7946
13#.###.174.250:7946
47.##.112.243:7946

HTTP GET-запросы:

v4.##ent.me/
ip####.net/plain
ip##.#canhazip.com/
bo#.####ismyipaddress.com/
ip###o.io/ip
wh#####yip.akamai.com/
ch#####.amazonaws.com/

DNS ASK:

v4.#dent.me
ch#####.amazonaws.com
bo#.####ismyipaddress.com
ip##.#canhazip.com
wh#####yip.akamai.com
ip##fo.io
ip##ho.net

Посылает данные следующим серверам:

13#.###.174.250:7946
[:######112.126.94.24]:7946
[:#######03.235.224.60]:7946
[:######139.59.61.185]:7946
[:######39.107.13.109]:7946
[:######106.13.2.133]:7946
[:#######39.162.191.218]:7946
[:#######03.53.231.138]:7946
[:######47.92.236.235]:7946
[:######47.97.16.196]:7946
[:######101.200.51.40]:7947
[:#######18.24.201.132]:7946
[:######47.92.253.27]:7946
[:######118.25.12.146]:7946
[:#######39.129.133.194]:7946
[:#######18.89.224.170]:7946
[:######120.79.106.57]:7946
[:#######53.122.51.195]:7946
[:######39.107.227.80]:7946
[:#######40.143.237.108]:7946
[:######58.87.77.182]:7946
[:######120.79.44.67]:7946
[:#######1.164.118.209]:7946
[:#######03.195.237.191]:7946
[:#######04.233.240.53]:7946
[:#######23.207.153.211]:7946
[:#######93.112.50.250]:7946
[:#######39.162.233.127]:7946
[:######47.100.52.194]:7946
[:######103.79.25.125]:7946
[:######111.76.64.30]:7946
[:######47.94.159.239]:7946
[:######111.19.131.3]:7946
[:######47.105.36.116]:7946
[:#######40.143.136.88]:7946
[:######120.77.8.118]:7946
[:######134.175.55.17]:7946
[:######39.107.112.41]:7946
[:######47.93.195.204]:7946
[:######47.96.128.28]:7946
[:######120.24.59.140]:7946
[:######47.90.2.42]:7946
[:######121.41.77.10]:7946
[:######139.129.38.55]:7946
[:######120.79.104.54]:7946
[:#######20.25.164.145]:7946
[:#######23.207.160.44]:7946
[:######182.61.53.47]:7946
[:######123.31.17.54]:7946
[:#######39.129.239.212]:7946
[:#######23.207.160.50]:7946
[:######119.28.1.135]:7946
[:#######22.186.169.147]:7946
[:######39.105.20.26]:7946
[:######47.93.188.110]:7946
[:#######23.30.210.196]:7946
[:######118.25.61.191]:7946
[:#######32.232.56.118]:7946
[:#######39.224.26.126]:7947
[:#######23.207.148.42]:7946
[:######140.143.20.58]:7946
[:######47.98.118.77]:7946
[:######47.93.35.139]:7947
[:######120.27.156.83]:7946
[:#######20.55.163.239]:7946
[:######47.98.150.108]:7947
[:#######11.230.99.193]:7946
[:######58.20.185.250]:7946
[:######47.94.100.28]:7946
[:#######23.207.162.197]:7946
[:######47.105.110.61]:7947
[:######47.96.4.77]:7946
[:######112.74.115.27]:7946
[:#######39.199.180.58]:7946
[:#######03.21.140.244]:7946
[:#######11.230.145.137]:7946
[:######119.61.7.90]:7946
[:#######72.81.243.231]:7946
[:######221.1.210.254]:7947
[:######132.232.62.80]:7946
[:#######32.232.242.147]:7946
[:#######21.235.189.205]:7946
[:######101.1.31.233]:7946
[:######47.92.138.56]:7947
[:#######75.102.179.12]:7946
[:######58.87.101.50]:7946
[:######118.31.36.55]:7946
[:#######9.107.102.117]:7946
[:#######9.108.129.177]:7946
[:######111.62.8.85]:7946
[:######59.110.238.9]:7946
[:######120.25.226.0]:7946
[:#######23.57.139.170]:7947
[:#######02.162.221.174]:7946
[:#######14.55.218.197]:7946
[:#######13.160.211.56]:7946
[:######118.25.107.71]:7946
[:#######50.95.128.220]:7946
[:######118.25.66.21]:7947
[:######139.59.15.91]:7946
[:######119.23.68.13]:7946
[:######150.109.77.76]:7946
[:#######11.231.110.168]:7946
[:#######00.98.201.208]:7946
[:######193.112.40.63]:7946
[:######106.12.14.230]:7946
[:######116.62.59.75]:7946
[:#######23.249.13.251]:7946
[:######172.93.42.160]:7946
[:#######11.230.231.130]:7946
[:#######16.208.53.182]:7946
[:######103.45.7.177]:7946
[:#######22.228.196.147]:7946
[:######47.96.78.93]:7946
[:######180.76.57.178]:7946
[:#######39.199.132.80]:7946
[:#######21.199.40.222]:7946
[:#######32.232.121.103]:7946
[:######111.230.9.229]:7946
[:#######39.199.166.197]:7946
[:######59.37.167.98]:7946
[:######116.120.156.5]:7946
[:#######39.162.41.145]:7946
[:#######11.231.81.129]:7946
[:#######18.24.139.215]:7946
[:######106.13.33.215]:7946
[:#######02.38.173.121]:7946
[:#######7.106.133.237]:7946
[:######117.73.3.33]:7946
[:######123.58.249.94]:7946
[:######47.254.30.152]:7946
[:######47.93.189.65]:7946
[:#######03.219.112.67]:7946
[:#######17.27.200.164]:7946
[:#######32.232.54.187]:7946
[:######117.73.3.239]:7946
[:######140.143.0.121]:7946
[:#######72.104.155.188]:7947
[:#######98.23.146.102]:7946
[:######47.98.174.134]:7946
[:#######11.230.45.207]:7946
[:#######39.199.100.28]:7946
[:######172.104.123.6]:7946
[:######120.78.76.177]:7946
[:######120.78.81.158]:7946
[:#######8.117.134.221]:7946
[:#######39.59.147.135]:7946
[:#######50.95.105.113]:7946
[:######123.57.136.84]:7946
[:######47.52.246.19]:7946
[:#######17.187.227.92]:7946
[:######58.87.87.155]:7946
[:######117.73.3.113]:7946
[:######103.45.7.47]:7946
[:#######93.112.36.166]:7946
[:######47.104.158.13]:7946
[:######47.92.193.95]:7946
[:######47.104.78.115]:7946
[:######120.79.140.68]:7947
[:######118.24.4.35]:7946
[:######47.98.200.222]:7947
[:######222.80.52.114]:7946
[:######103.85.23.157]:7946
[:#######21.207.138.245]:7946
[:#######39.162.76.204]:7946
[:#######11.230.171.60]:7946
[:#######8.218.213.136]:7946
[:######94.191.94.146]:7946
[:#######23.207.96.246]:7946
[:#######18.24.174.131]:7946
[:######193.112.43.49]:7946
[:#######20.79.187.211]:7946
[:######120.77.80.111]:7946
[:######47.100.82.106]:7946
[:######121.40.144.58]:7946
[:######47.92.79.140]:7946
[:######106.13.61.179]:7946
[:#######7.106.178.243]:7946
[:######117.73.3.137]:7946
[:######114.112.93.54]:7946
[:######120.78.83.168]:7946
[:######118.89.45.149]:7946
[:#######22.187.222.237]:7946
[:#######7.254.130.252]:7947
[:#######93.112.173.143]:7946
[:######114.67.22.172]:7946
[:#######9.105.215.252]:7946
[:#######01.200.48.220]:7946
[:######45.41.86.242]:7946
[:######58.17.58.183]:7946
[:######116.62.6.104]:7946
[:######58.218.66.21]:7946
[:######139.199.29.20]:7946
[:#######39.162.176.81]:7946
[:#######18.178.18.213]:7947
[:#######22.186.173.51]:7946
[:#######23.207.138.196]:7946
[:######58.87.114.119]:7946
[:######45.78.77.106]:7946
[:#######18.85.121.188]:7946
[:######112.220.73.44]:7946
[:#######39.199.129.197]:7946
[:######120.79.93.121]:7946
[:######119.23.174.19]:7946
[:#######40.143.148.16]:7946
[:#######11.231.209.47]:7946
[:######118.24.72.106]:7946
[:######123.57.159.36]:7946
[:######39.105.5.20]:7946
[:#######15.159.220.112]:7946
[:######112.74.38.229]:7946
[:#######3.252.231.191]:7946
[:#######11.231.209.131]:7946
[:#######20.171.11.196]:7946
[:#######93.112.109.40]:7946
[:######47.96.112.243]:7946
[:#######18.126.113.192]:7946
[:#######32.148.241.138]:7946
[:######45.56.114.28]:7946
[:#######7.100.240.207]:7946
[:######123.206.18.36]:7946
[:#######11.231.242.38]:7946
[:#######23.207.172.180]:7946
[:#######03.253.147.172]:7946
[:#######93.112.158.185]:7946
[:#######23.206.28.142]:7946
[:######114.112.34.30]:7946
[:#######32.232.134.214]:7946
[:#######7.106.118.117]:7946
[:#######18.24.121.114]:7946
[:#######18.24.134.162]:7946
[:######140.143.3.126]:7946
[:#######80.76.121.190]:7946
[:######47.104.187.37]:7946
[:######118.24.154.82]:7946
[:#######16.196.19.232]:7946
[:######47.93.254.166]:7946
[:######112.74.73.138]:7946
[:#######22.152.220.80]:7946
[:#######11.230.242.197]:7946
[:######120.79.180.10]:7946
47.##.112.243:7946
[:######111.62.84.153]:7946
[:#######22.187.239.98]:7946
[:#######39.199.195.129]:7946
[:#######22.114.233.111]:7946
[:#######14.107.20.203]:7946
[:######180.76.111.66]:7946
[:######122.114.10.3]:7946
[:#######14.67.227.234]:7946
[:######125.220.157.1]:7946
[:#######39.59.191.117]:7946
[:######120.24.42.58]:7946
[:######120.77.44.227]:7947
[:#######17.245.139.251]:7946
[:######119.29.98.155]:7946
[:#######32.232.106.49]:7946
[:#######11.231.103.89]:7946
[:#######20.77.246.209]:7946
[:#######9.104.150.214]:7946
[:#######39.224.208.108]:7947
[:######118.24.89.17]:7946
[:#######11.231.115.187]:7946
[:######118.25.3.28]:7946
[:######123.207.99.21]:7946
[:######154.8.170.73]:7946
[:######139.199.67.77]:7946
[:#######11.231.84.214]:7946
[:#######11.230.45.175]:7946
[:#######9.107.110.162]:7946
[:######118.24.89.47]:7946
[:#######11.166.23.115]:7946
[:######180.76.57.239]:7946
[:#######18.24.107.101]:7946
[:######223.113.4.252]:7946
[:######193.112.93.94]:7946
[:######47.94.4.179]:7946
[:######119.28.177.76]:7946
[:######47.94.18.182]:7947
[:#######22.112.198.197]:7946
[:######35.243.119.96]:7946
[:######118.25.46.165]:7946
[:#######17.144.157.92]:7946
[:######114.112.93.58]:7946
[:######103.85.21.114]:7946
[:#######28.199.203.31]:7946
[:#######11.231.142.17]:7946
[:######193.112.14.81]:7946
[:#######19.29.114.107]:7946
[:######103.124.136.3]:7946
[:#######18.24.247.130]:7946
[:######106.12.83.187]:7946
[:######47.100.45.48]:7946
[:######103.40.101.61]:7946
[:#######11.230.241.245]:7946
[:######39.106.144.39]:7946
[:######120.77.34.164]:7946
[:######123.138.73.62]:7946
[:######42.81.139.249]:7946
[:#######11.230.233.246]:7946
[:#######32.232.79.123]:7946
[:#######2.202.144.134]:7946
[:######45.55.88.41]:7946
[:######193.112.54.31]:7946
[:#######23.207.240.151]:7946
[:#######23.223.186.188]:7946
[:#######32.232.182.241]:7946
[:######123.207.59.54]:7946
[:######118.89.23.40]:7946
[:######39.105.3.111]:7946
[:######47.93.206.249]:7946
[:#######32.232.132.103]:7946
[:#######20.25.158.198]:7946
[:######120.77.216.31]:7946
[:######39.108.143.76]:7946
[:######120.25.98.240]:7947
[:#######20.78.143.252]:7946
[:#######22.114.120.222]:7946
[:#######16.196.87.118]:7946
[:######117.73.2.123]:7947
[:######58.87.108.27]:7946
[:######58.87.69.241]:7946
[:######106.13.62.90]:7946
[:#######32.232.34.246]:7946
[:#######16.62.135.237]:7946
[:######106.13.39.214]:7946
[:######178.128.85.79]:7946
[:#######19.28.134.162]:7946
[:#######20.133.35.122]:7946
[:#######20.77.247.155]:7946
[:#######32.232.39.149]:7946
[:#######15.29.214.141]:7947
[:#######62.243.125.126]:7946
[:#######40.143.120.226]:7946
[:#######20.24.246.118]:7946
[:######103.72.164.86]:7946
[:######47.107.111.34]:7946
[:######139.59.46.112]:7946
[:######117.73.3.168]:7946
[:######103.37.45.212]:7946
[:######123.206.45.47]:7946
[:#######03.18.245.171]:7946
[:#######18.184.11.244]:7946
[:#######20.78.240.211]:7946

Получает данные от следующих серверов:

13#.###.174.250:7946
47.##.112.243:7946

Прочее:

Собирает информацию об ОС

Собирает информацию о CPU

Собирает информацию об оперативной памяти

Собирает информацию о сетевой активности

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению