Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.241

Added to the Dr.Web virus database: 2018-12-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /var/spool/cron/crontabs/root
  • /etc/rc.local
Creates or modifies the following symlinks:
  • /etc/rc6.d/S20loop
Malicious functions:
Launches processes:
  • /root/.loop
  • sh -c crontab -l >/dev/null 2>&1
  • crontab -l
  • sh -c crontab -r >/dev/null 2>&1
  • crontab -r
  • sh -c (echo \"*/5 * * * * /root/.loop\" ; crontab -l)| crontab > /dev/null 2>&1
  • crontab
  • sh -c
Performs operations with the file system:
Modifies file access rights:
  • /root/.loop
  • /var/spool/cron/crontabs/tmp.HaPSvQ
  • /tmp/rc.local1
Creates or modifies files:
  • /tmp/.runned
  • /root/.loop
  • /root/.LTMP
  • /root/.hash
  • /tmp/.tmpcronFile
  • /var/spool/cron/crontabs/tmp.HaPSvQ
  • /tmp/rc.local1
Deletes files:
  • /root/.loop
  • /root/.LTMP
  • /tmp/rc.local1
Locks files:
  • /tmp/.runned
Network activity:
HTTP GET requests:
  • 11#.##.141.104/version
  • http://###.##.###.#########.###############################################72D636B7432302028726F6F7440626F782D616D6436342920286763632076657273696F6E20342E392E32202844656269616E20342E392E322D313029202920233220534D502053756E204D61722032302031323A32323A3537204D534B2032303136&
  • 11#.##.###.####token.php?user=1S6OXSUFF007CKME&ver=1.19
Other:
Collects OS information
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number