マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Packed.550

Added to the Dr.Web virus database: 2019-08-11

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • -1
  • vuwwiu
  • 69
Modifies firewall settings:
  • iptables -F
Launches processes:
  • sh -c rm -rf /tmp/.* ; rm -rf /tmp/* ; crontab -r ; for i in `atq | awk '{print $1}'`; do atrm $i; done ; chattr -R -i /tmp/* ; rm -rf /tmp/.* ; rm -rf /dev/shm/* ; rm -rf /dev/shm/* ; rm -rf /var/tmp/* ; rm -rf /var/tmp/.* ; chattr -R -i /var/spool/*/* ; rm -rf /var/spool/*/*/* ; >/dev/null 2>&1
  • sh -c rm -rf /home/*/.ss*/.kn* ; rm -rf /root/.ss*/.kn* ; rm -rf /var/spool/cr*/* ; rm -rf /etc/cron.*/* ; rm -rf /var/spool/anacro*/*/* ; crontab -r ; iptables -F ; iptables-save ; >/dev/null 2>&1
  • rm -rf /home/*/.ss*/.kn*
  • rm -rf /root/.ss*/.kn*
  • rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs
  • rm -rf /etc/cron.daily/apt /etc/cron.daily/aptitude /etc/cron.daily/bsdmainutils /etc/cron.daily/dpkg /etc/cron.daily/exim4-base /etc/cron.daily/logrotate /etc/cron.daily/man-db /etc/cron.daily/mlocate /etc/cron.daily/passwd /etc/cron.weekly/man-db
  • rm -rf /var/spool/anacro*/*/*
  • crontab -r
  • iptables-save
  • sh -c /root/qkvvbl
  • /root/qkvvbl
Kills system processes:
  • sshd
Kills the following processes:
  • run.sh
  • bash
  • /bin/sh
  • Unknown process with PID: 4294967295
Performs operations with the file system:
Modifies file access rights:
  • /usr/bin/wget
  • /dev/urandom
  • /usr/bin/perl
  • /usr/bin/python3.4
  • /usr/bin/python2.7
  • /usr/bin/mawk
  • /usr/bin/xargs
  • /bin/sed
  • /usr/bin/crontab
  • /root/qkvvbl
  • /bin/nc.traditional
  • /etc/crontab
Creates or modifies files:
  • /root/qkvvbl
Deletes files:
  • /home/*/.ss*/.kn*
  • /root/.ss*/.kn*
  • /root/.SEQ
  • /etc/cron.daily/apt
  • /etc/cron.daily/aptitude
  • /etc/cron.daily/bsdmainutils
  • /etc/cron.daily/dpkg
  • /etc/cron.daily/exim4-base
  • /etc/cron.daily/logrotate
  • /etc/cron.daily/man-db
  • /etc/cron.daily/mlocate
  • /etc/cron.daily/passwd
  • /etc/cron.weekly/man-db
  • /var/spool/anacro*/*/*
  • /usr/bin/perl
  • /bin/nc
  • /bin/netcat
  • /etc/crontab
Network activity:
HTTP GET requests:
  • 14#.##.34.25/c/cf

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number