Linux.Packed.227
Added to the Dr.Web virus database:
2018-11-16
Virus description added:
2018-11-16
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/hmpkczxqxh
- /etc/cron.hourly/gcc4.sh
- /etc/crontab
- /etc/init.d/jzyyxuoxwt
Creates or modifies the following symlinks:
- /etc/rc1.d/S90hmpkczxqxh
- /etc/rc2.d/S90hmpkczxqxh
- /etc/rc3.d/S90hmpkczxqxh
- /etc/rc4.d/S90hmpkczxqxh
- /etc/rc5.d/S90hmpkczxqxh
- /etc/rc1.d/S90jzyyxuoxwt
- /etc/rc2.d/S90jzyyxuoxwt
Malicious functions:
Removes itself
Launches itself as a daemon
Manages services:
- update-rc.d hmpkczxqxh defaults
- update-rc.d hmpkczxqxh remove
Launches processes:
- /usr/bin/hmpkczxqxh
- chkconfig --add hmpkczxqxh
- sh -c sed -i '/\/etc\/cron.hourly\/gcc4.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc4.sh' >> /etc/crontab
- sed -i /\/etc\/cron.hourly\/gcc4.sh/d /etc/crontab
- /usr/bin/tffcbogewy ifconfig 688
- /usr/bin/tffcbogewy ls -la 688
- /usr/bin/tffcbogewy ifconfig eth0 688
- /usr/bin/tffcbogewy sh 688
- /usr/bin/tffcbogewy id 688
- /sbin/insserv hmpkczxqxh
- chkconfig --del hmpkczxqxh
- /usr/bin/vfjrtpjbmu
- /usr/bin/jzyyxuoxwt
- /bin/vfjrtpjbmu
- /usr/bin/zspvwirxim sh 736
Kills the following processes:
Performs operations with the file system:
Modifies file access rights:
Creates or modifies files:
- /lib/libudev4.so
- /usr/bin/hmpkczxqxh
- /etc/sedw1BQ6y
- /var/run/gcc4.pid
- /run/gcc4.pid
- /usr/bin/tffcbogewy
- /usr/bin/vfjrtpjbmu
- /usr/bin/jzyyxuoxwt
- /bin/vfjrtpjbmu
- /bin/jzyyxuoxwt
- /tmp/vfjrtpjbmu
Deletes files:
- /etc/rc1.d/S90hmpkczxqxh
- /etc/rc2.d/S90hmpkczxqxh
- /etc/rc3.d/S90hmpkczxqxh
- /etc/rc4.d/S90hmpkczxqxh
- /etc/rc5.d/S90hmpkczxqxh
- /etc/rc.d/rc1.d/S90hmpkczxqxh
- /etc/rc.d/rc2.d/S90hmpkczxqxh
- /etc/rc.d/rc3.d/S90hmpkczxqxh
- /etc/rc.d/rc4.d/S90hmpkczxqxh
- /etc/rc.d/rc5.d/S90hmpkczxqxh
- /usr/bin/tffcbogewy
- /usr/bin/hmpkczxqxh
- /etc/init.d/hmpkczxqxh
- /etc/rc1.d/S90jzyyxuoxwt
- /etc/rc2.d/S90jzyyxuoxwt
- /tmp/vfjrtpjbmu
Other:
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
このウェブサイトを継続して訪問する場合、訪問者に関する統計データを収集するためのCookieファイルおよび他のテクノロジーを弊社が利用することに同意したものとします。詳細