JavaScript support is required for our site to be fully operational in your browser.
Linux.Packed.227
Added to the Dr.Web virus database:
2018-11-16
Virus description added:
2018-11-16
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/hmpkczxqxh
/etc/cron.hourly/gcc4.sh
/etc/crontab
/etc/init.d/jzyyxuoxwt
Creates or modifies the following symlinks:
/etc/rc1.d/S90hmpkczxqxh
/etc/rc2.d/S90hmpkczxqxh
/etc/rc3.d/S90hmpkczxqxh
/etc/rc4.d/S90hmpkczxqxh
/etc/rc5.d/S90hmpkczxqxh
/etc/rc1.d/S90jzyyxuoxwt
/etc/rc2.d/S90jzyyxuoxwt
Malicious functions:
Removes itself
Launches itself as a daemon
Manages services:
update-rc.d hmpkczxqxh defaults
update-rc.d hmpkczxqxh remove
Launches processes:
/usr/bin/hmpkczxqxh
chkconfig --add hmpkczxqxh
sh -c sed -i '/\/etc\/cron.hourly\/gcc4.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc4.sh' >> /etc/crontab
sed -i /\/etc\/cron.hourly\/gcc4.sh/d /etc/crontab
/usr/bin/tffcbogewy ifconfig 688
/usr/bin/tffcbogewy ls -la 688
/usr/bin/tffcbogewy ifconfig eth0 688
/usr/bin/tffcbogewy sh 688
/usr/bin/tffcbogewy id 688
/sbin/insserv hmpkczxqxh
chkconfig --del hmpkczxqxh
/usr/bin/vfjrtpjbmu
/usr/bin/jzyyxuoxwt
/bin/vfjrtpjbmu
/usr/bin/zspvwirxim sh 736
Kills the following processes:
Performs operations with the file system:
Modifies file access rights:
Creates or modifies files:
/lib/libudev4.so
/usr/bin/hmpkczxqxh
/etc/sedw1BQ6y
/var/run/gcc4.pid
/run/gcc4.pid
/usr/bin/tffcbogewy
/usr/bin/vfjrtpjbmu
/usr/bin/jzyyxuoxwt
/bin/vfjrtpjbmu
/bin/jzyyxuoxwt
/tmp/vfjrtpjbmu
Deletes files:
/etc/rc1.d/S90hmpkczxqxh
/etc/rc2.d/S90hmpkczxqxh
/etc/rc3.d/S90hmpkczxqxh
/etc/rc4.d/S90hmpkczxqxh
/etc/rc5.d/S90hmpkczxqxh
/etc/rc.d/rc1.d/S90hmpkczxqxh
/etc/rc.d/rc2.d/S90hmpkczxqxh
/etc/rc.d/rc3.d/S90hmpkczxqxh
/etc/rc.d/rc4.d/S90hmpkczxqxh
/etc/rc.d/rc5.d/S90hmpkczxqxh
/usr/bin/tffcbogewy
/usr/bin/hmpkczxqxh
/etc/init.d/hmpkczxqxh
/etc/rc1.d/S90jzyyxuoxwt
/etc/rc2.d/S90jzyyxuoxwt
/tmp/vfjrtpjbmu
Other:
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK