Linux.Packed.285
Added to the Dr.Web virus database:
2019-01-26
Virus description added:
2019-01-26
Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Launches processes:
- sh -c /var/tmp/hdd obky &
- /var/tmp/hdd obky
- sh -c /tmp/hdd ltje &
- /tmp/hdd ltje
- sh -c /var/tmp/hdd xgtj &
- /var/tmp/hdd xgtj
- sh -c /tmp/hdd uysm &
- /tmp/hdd uysm
- sh -c /root/skrq ilfs
- /root/skrq ilfs
- sh -c /root/xuqu xuqu
- /root/xuqu xuqu
Kills system processes:
Kills the following processes:
Performs operations with the file system:
Modifies file access rights:
- /var/tmp/hdd
- /tmp/hdd
- /root/skrq
- /root/xuqu
Creates or modifies files:
- /var/tmp/hdd
- /tmp/hdd
- /root/skrq
- /root/p
- /root/xuqu
Deletes files:
Network activity:
HTTP GET requests:
- 18#.##.68.100/jp/dld
- 18#.###.169.6/jp/jrd
- 18#.###.169.6/jp/jpp
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
このウェブサイトを継続して訪問する場合、訪問者に関する統計データを収集するためのCookieファイルおよび他のテクノロジーを弊社が利用することに同意したものとします。詳細