Threat Alert: DDG 3013 is Out
<p>DDG is a mining botnet mainly focusing on SSH, Redis databases and OrientDB database servers. We captured the first DDG botnet on October 25, 2017, and subsequently released several <a href="__GHOST_URL__/tag/ddg/">reports</a>. A recent <a href="__GHOST_URL__/old-botnets-never-die-and-ddg-refuse-to-fade-away/">report</a> was released in 2018-06, which reflected the newest version of DDG 3012 at that time.</p><p>This morning, we noticed that DDG version 3013 came out.</p><h4 id="ioc"><strong>IoC</strong></h4><p>C2</p><pre><code>149.56.106.215:8000    Canada/CA Pierrefonds   "AS16276 OVH SAS"  
</code></pre><p>Download URL</p><pre><code>hxxp://149.56.106.215:8000/i.sh               #fca88105ed6f1fc72d25cfb30a0080b8  
hxxp://149.56.106.215:8000/static/3011/ddgs.i686    #999fc24f53034b4c73866a0699be15fa  
hxxp://149.56.106.215:8000/static/3011/ddgs.x86_64  #55b1d7b0fa1c479c02660896e05db910  
hxxp://149.56.106.215:8000/static/3012/ddgs.i686    #e31c1d7a8025e7c3266a07e37c55a4ba  
hxxp://149.56.106.215:8000/static/3012/ddgs.x86_64  #26b3aef91bacfa082deff9812acf7875  
hxxp://149.56.106.215:8000/static/3013/ddgs.i686    #7fb5665a632fe3f91c65df960ef56d9f  
hxxp://149.56.106.215:8000/static/3013/ddgs.x86_64  #c090e30a008b6bc0ea323ba5928c4a62  
hxxp://149.56.106.215:8000/static/qW3xT             #c50d3e20b3519f096630e31277fefceb  
hxxp://149.56.106.215:8000/static/qW3xT.1           #532a35a8d0fe4944c24575c0336eff8a  
hxxp://149.56.106.215:8000/static/qW3xT.2           #0a63e48163056b04bf1d48420b7c8150  
</code></pre><p>New mining pool agent</p><pre><code>104.197.211.117:443 United States/US "AS15169 Google LLC"  
</code></pre><h4 id="infect-method"><strong>Infect Method</strong></h4><p>Using mis-configured Redis in the same way as previous versions of DDGs.</p><h4 id="monetization-method"><strong>Monetization method</strong></h4><p>Mining</p><ul><li>Mining Pool:Agent: 104.197.211.117</li><li>Wallet Address: 42d4D8pASAWghyTmUS8a9yZyErA4WB18TJ6Xd2rZt9HBio2aPmAAVpHcPM8yoDEYD9Fy7eRvPJhR7SKFyTaFbSYCNZ2t3ik</li></ul><h4 id="activities"><strong>Activities</strong></h4><p>In the past 24 hours, our ScanMon reported <a href="http://scan.netlab.360.com/#/dashboard?tsbeg=1533002400000&amp;tsend=1533088800000&amp;dstport=6379&amp;toplistname=srcas&amp;topn=10&amp;sortby=sum">471</a> scan sources, mainly from China mainland.</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2018/08/ddg_3013_infection.png" class="kg-image" alt loading="lazy"></figure><h4 id="contact-us"><strong>Contact Us</strong></h4><p>Readers can feel free to contact us on our <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> or WeChat <strong>360Netlab</strong> </p>
DDG is a mining botnet mainly focusing on SSH, Redis databases and OrientDB database servers. We captured the first DDG botnet on October 25, 2017, and subsequently released several reports. A recent report was released in 2018-06, which reflected the newest version of DDG 3012 at that time.

This morning, we noticed that DDG version 3013 came out.

IoC

C2

149.56.106.215:8000    Canada/CA Pierrefonds   "AS16276 OVH SAS"  


Download URL

hxxp://149.56.106.215:8000/i.sh               #fca88105ed6f1fc72d25cfb30a0080b8  
hxxp://149.56.106.215:8000/static/3011/ddgs.i686    #999fc24f53034b4c73866a0699be15fa  
hxxp://149.56.106.215:8000/static/3011/ddgs.x86_64  #55b1d7b0fa1c479c02660896e05db910  
hxxp://149.56.106.215:8000/static/3012/ddgs.i686    #e31c1d7a8025e7c3266a07e37c55a4ba  
hxxp://149.56.106.215:8000/static/3012/ddgs.x86_64  #26b3aef91bacfa082deff9812acf7875  
hxxp://149.56.106.215:8000/static/3013/ddgs.i686    #7fb5665a632fe3f91c65df960ef56d9f  
hxxp://149.56.106.215:8000/static/3013/ddgs.x86_64  #c090e30a008b6bc0ea323ba5928c4a62  
hxxp://149.56.106.215:8000/static/qW3xT             #c50d3e20b3519f096630e31277fefceb  
hxxp://149.56.106.215:8000/static/qW3xT.1           #532a35a8d0fe4944c24575c0336eff8a  
hxxp://149.56.106.215:8000/static/qW3xT.2           #0a63e48163056b04bf1d48420b7c8150  


New mining pool agent

104.197.211.117:443 United States/US "AS15169 Google LLC"  


Infect Method

Using mis-configured Redis in the same way as previous versions of DDGs.

Monetization method

Mining

 * Mining Pool:Agent: 104.197.211.117
 * Wallet Address: 42d4D8pASAWghyTmUS8a9yZyErA4WB18TJ6Xd2rZt9HBio2aPmAAVpHcPM8yoDEYD9Fy7eRvPJhR7SKFyTaFbSYCNZ2t3ik

Activities

In the past 24 hours, our ScanMon reported 471 scan sources, mainly from China mainland.

Contact Us

Readers can feel free to contact us on our twitter or WeChat 360Netlab
{"version":"0.3.1","atoms":[],"cards":[["code",{"code":"149.56.106.215:8000    Canada/CA Pierrefonds   \"AS16276 OVH SAS\"  \n"}],["code",{"code":"hxxp://149.56.106.215:8000/i.sh               #fca88105ed6f1fc72d25cfb30a0080b8  \nhxxp://149.56.106.215:8000/static/3011/ddgs.i686    #999fc24f53034b4c73866a0699be15fa  \nhxxp://149.56.106.215:8000/static/3011/ddgs.x86_64  #55b1d7b0fa1c479c02660896e05db910  \nhxxp://149.56.106.215:8000/static/3012/ddgs.i686    #e31c1d7a8025e7c3266a07e37c55a4ba  \nhxxp://149.56.106.215:8000/static/3012/ddgs.x86_64  #26b3aef91bacfa082deff9812acf7875  \nhxxp://149.56.106.215:8000/static/3013/ddgs.i686    #7fb5665a632fe3f91c65df960ef56d9f  \nhxxp://149.56.106.215:8000/static/3013/ddgs.x86_64  #c090e30a008b6bc0ea323ba5928c4a62  \nhxxp://149.56.106.215:8000/static/qW3xT             #c50d3e20b3519f096630e31277fefceb  \nhxxp://149.56.106.215:8000/static/qW3xT.1           #532a35a8d0fe4944c24575c0336eff8a  \nhxxp://149.56.106.215:8000/static/qW3xT.2           #0a63e48163056b04bf1d48420b7c8150  \n"}],["code",{"code":"104.197.211.117:443 United States/US \"AS15169 Google LLC\"  \n"}],["image",{"src":"__GHOST_URL__/content/images/2018/08/ddg_3013_infection.png","alt":"","title":""}]],"markups":[["a",["href","__GHOST_URL__/tag/ddg/"]],["a",["href","__GHOST_URL__/old-botnets-never-die-and-ddg-refuse-to-fade-away/"]],["strong"],["a",["href","http://scan.netlab.360.com/#/dashboard?tsbeg=1533002400000&tsend=1533088800000&dstport=6379&toplistname=srcas&topn=10&sortby=sum"]],["a",["href","https://twitter.com/360Netlab"]]],"sections":[[1,"p",[[0,[],0,"DDG is a mining botnet mainly focusing on SSH, Redis databases and OrientDB database servers. We captured the first DDG botnet on October 25, 2017, and subsequently released several "],[0,[0],1,"reports"],[0,[],0,". A recent "],[0,[1],1,"report"],[0,[],0," was released in 2018-06, which reflected the newest version of DDG 3012 at that time."]]],[1,"p",[[0,[],0,"This morning, we noticed that DDG version 3013 came out."]]],[1,"h4",[[0,[2],1,"IoC"]]],[1,"p",[[0,[],0,"C2"]]],[10,0],[1,"p",[[0,[],0,"Download URL"]]],[10,1],[1,"p",[[0,[],0,"New mining pool agent"]]],[10,2],[1,"h4",[[0,[2],1,"Infect Method"]]],[1,"p",[[0,[],0,"Using mis-configured Redis in the same way as previous versions of DDGs."]]],[1,"h4",[[0,[2],1,"Monetization method"]]],[1,"p",[[0,[],0,"Mining"]]],[3,"ul",[[[0,[],0,"Mining Pool:Agent: 104.197.211.117"]],[[0,[],0,"Wallet Address: 42d4D8pASAWghyTmUS8a9yZyErA4WB18TJ6Xd2rZt9HBio2aPmAAVpHcPM8yoDEYD9Fy7eRvPJhR7SKFyTaFbSYCNZ2t3ik"]]]],[1,"h4",[[0,[2],1,"Activities"]]],[1,"p",[[0,[],0,"In the past 24 hours, our ScanMon reported "],[0,[3],1,"471"],[0,[],0," scan sources, mainly from China mainland."]]],[10,3],[1,"h4",[[0,[2],1,"Contact Us"]]],[1,"p",[[0,[],0,"Readers can feel free to contact us on our "],[0,[4,2],2,"twitter"],[0,[],0," or WeChat "],[0,[2],1,"360Netlab"],[0,[],0," "]]]],"ghostVersion":"3.0"}