La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Linux.Packed.549

Aggiunto al database dei virus Dr.Web: 2019-08-11

La descrizione è stata aggiunta:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • -1
  • twebwu
  • qeiw
  • * **
Modifies firewall settings:
  • iptables -F
Launches processes:
  • sh -c rm -rf /tmp/.* ; rm -rf /tmp/* ; crontab -r ; for i in `atq | awk '{print $1}'`; do atrm $i; done ; chattr -R -i /tmp/* ; rm -rf /tmp/.* ; rm -rf /dev/shm/* ; rm -rf /dev/shm/* ; rm -rf /var/tmp/* ; rm -rf /var/tmp/.* ; chattr -R -i /var/spool/*/* ; rm -rf /var/spool/*/*/* ; rm -rf /run/*/* ; rm -rf /var/run/*/*/*/* ; > /dev/null 2>&1
  • rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
  • rm -rf /tmp/*
  • crontab -r
  • sh -c rm -rf /home/*/.ss*/.kn* ; rm -rf /root/.ss*/.kn* ; rm -rf /var/spool/cr*/* ; rm -rf /etc/cron.*/* ; rm -rf /var/spool/anacro*/*/* ; crontab -r ; iptables -F ; iptables-save >/dev/null 2>&1
  • rm -rf /home/*/.ss*/.kn*
  • rm -rf /root/.ss*/.kn*
  • rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs
  • rm -rf /etc/cron.daily/apt /etc/cron.daily/aptitude /etc/cron.daily/bsdmainutils /etc/cron.daily/dpkg /etc/cron.daily/exim4-base /etc/cron.daily/logrotate /etc/cron.daily/man-db /etc/cron.daily/mlocate /etc/cron.daily/passwd /etc/cron.weekly/man-db
  • rm -rf /var/spool/anacro*/*/*
  • sh -c /root/gxplpe
  • iptables-save
  • /root/gxplpe
  • sh -c crontab -r ; rm -rf /var/spool/cr*/* ; rm -rf /etc/cron.*/* ; rm -rf /var/spool/anacro*/*/* ; for i in `atq | awk '{print $1}'`; do atrm $i; done ; > /dev/null
  • rm -rf /var/spool/cr*/*
  • rm -rf /etc/cron.*/*
  • sh -c /root/ydctqo mrfs
  • /root/ydctqo mrfs
  • sh -c /root/ewco
  • /root/ewco
Kills system processes:
  • sshd
Kills the following processes:
  • run.sh
  • bash
  • /bin/sh
  • systemd
  • <SAMPLE>
  • /bin/rm
  • (sd-pam)
  • /root/ydctqo
  • /root/ewco
  • Unknown process with PID: 0
Performs operations with the file system:
Modifies file access rights:
  • /usr/bin/wget
  • /dev/urandom
  • /usr/bin/perl
  • /usr/bin/python3.4
  • /usr/bin/python2.7
  • /usr/bin/mawk
  • /usr/bin/xargs
  • /bin/sed
  • /usr/bin/crontab
  • /root/gxplpe
  • /root/ydctqo
  • /root/ewco
Creates or modifies files:
  • /root/jdxegs
  • /root/gxplpe
  • /root/ydctqo
  • /root/c
  • /root/ewco
  • /root/smvfmm
Deletes files:
  • /tmp/*
  • /home/*/.ss*/.kn*
  • /root/.ss*/.kn*
  • /var/spool/cron/.SEQ
  • /etc/cron.daily/apt
  • /etc/cron.daily/aptitude
  • /etc/cron.daily/bsdmainutils
  • /etc/cron.daily/dpkg
  • /etc/cron.daily/exim4-base
  • /etc/cron.daily/logrotate
  • /etc/cron.daily/man-db
  • /etc/cron.daily/mlocate
  • /etc/cron.daily/passwd
  • /etc/cron.weekly/man-db
  • /var/spool/anacro*/*/*
  • /var/spool/cr*/*
  • /root/ydctqo
  • /root/c
Network activity:
HTTP GET requests:
  • 14#.##.34.25/c/cf
  • 16#.##.69.25/c/cdc
  • 16#.##.69.25/c/coooc
  • 12#.###.217.239/c/nap

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number