Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.279

Added to the Dr.Web virus database: 2019-01-15

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Launches processes:
  • /usr/bin/getconf CLK_TCK
  • <SAMPLE_FULL_PATH>
  • /usr/bin/lsb_release
  • dpkg-query -f ${Version} ${Provides
Performs operations with the file system:
Creates folders:
  • /tmp/.ddg
  • /root/.ssh
Creates or modifies files:
  • /tmp/.ddg/3017.lock
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • 21#.#39.38.21:9
  • 95.##1.0.137:9
  • [2#######0:c000:1000::501]:9
  • 95.##1.0.145:9
  • 66.###.248.178:9
  • 21#.#39.32.21:9
  • 52.###.143.163:9
  • 21#.#39.34.21:9
  • 21#.#39.36.21:9
  • 52.##0.125.74:9
  • 34.##3.102.38:9
  • 34.##6.82.108:9
  • 18.##3.42.138:9
  • 52.###.139.131:9
  • 95.###.190.198:7946
  • 59.#.#7.151:7947
  • 12#.##.248.21:7946
  • 47.###.96.62:7946
HTTP GET requests:
  • v4.##ent.me/
  • ip##.#canhazip.com/
  • wh#####yip.akamai.com/
  • ip####.net/plain
  • ip###o.io/ip
  • bo#.####ismyipaddress.com/
  • ch#####.amazonaws.com/
Sends data to the following servers:
  • 8.#.8.8:53
  • 59.#.#7.151:7947
  • [:######39.106.56.3]:7946
  • [:#######03.106.203.133]:7947
  • [:######45.55.88.41]:7947
  • [:#######22.152.204.51]:7946
  • [:#######20.76.103.100]:7946
  • [:######117.73.2.85]:7947
  • [:#######88.131.136.193]:7946
  • [:######58.83.224.86]:7946
  • [:#######0.171.240.113]:7947
  • [:#######16.62.175.140]:7947
  • [:######123.207.59.54]:7947
  • [:#######11.231.115.187]:7946
  • [:#######32.232.48.113]:7946
  • [:######120.79.44.67]:7946
  • [:######106.14.42.48]:7947
  • [:######119.9.77.151]:7946
  • [:######120.78.75.192]:7947
  • [:######115.29.77.254]:7946
  • [:######123.56.155.51]:7946
  • [:######1.180.2.170]:7946
  • [:#######20.25.164.145]:7946
  • [:#######11.231.209.131]:7947
  • [:######60.188.26.12]:7946
  • [:######114.112.93.54]:7947
  • [:#######21.194.132.98]:7946
  • [:#######93.112.158.185]:7946
  • [:#######18.126.105.177]:7947
  • [:#######92.144.187.66]:7946
  • [:######111.76.66.244]:7947
  • [:#######93.112.36.166]:7946
  • [:#######39.199.128.104]:7947
  • [:######139.129.8.24]:7947
  • [:#######03.247.10.117]:7947
  • [:######202.91.34.183]:7946
  • [:#######39.199.166.197]:7946
  • [:#######93.112.106.126]:7946
  • [:######47.97.20.112]:7946
  • [:######159.89.36.171]:7947
  • [:#######82.16.103.114]:7946
  • [:######47.93.192.13]:7946
  • [:#######39.162.48.148]:7946
  • [:#######22.114.130.111]:7946
  • [:#######20.78.231.128]:7947
  • [:######47.88.60.88]:7946
  • [:#######11.230.177.57]:7946
  • [:######112.35.26.129]:7946
  • [:######117.73.2.123]:7947
  • [:#######7.106.151.255]:7946
  • [:#######15.47.153.114]:7947
  • [:#######13.73.134.103]:7946
  • [:######117.73.3.239]:7947
  • [:######120.78.83.168]:7946
  • [:######112.74.128.9]:7946
  • [:#######11.230.171.60]:7946
  • [:######115.159.38.23]:7946
  • [:######106.13.35.115]:7947
  • [:#######01.201.76.199]:7946
  • [:#######50.109.74.114]:7947
  • [:#######17.239.70.196]:7946
  • [:######39.105.2.247]:7946
  • [:######111.76.66.8]:7947
  • [:#######11.230.153.238]:7947
  • [:######60.172.95.184]:7946
  • [:#######20.76.216.235]:7946
  • [:#######22.152.204.97]:7947
  • [:######61.145.57.16]:7947
  • [:######139.199.18.70]:7946
  • [:######120.76.141.71]:7947
  • [:#######62.243.125.126]:7946
  • [:#######02.38.173.121]:7946
  • [:######47.93.27.241]:7946
  • [:#######23.57.173.243]:7947
  • [:#######20.78.143.252]:7946
  • [:#######40.143.195.99]:7947
  • [:######101.200.53.83]:7946
  • [:######120.92.40.245]:7946
  • [:######101.37.16.47]:7946
  • [:######118.24.231.39]:7946
  • [:#######11.230.18.117]:7947
  • [:#######40.143.136.14]:7946
  • [:######119.10.73.26]:7946
  • [:#######72.96.214.231]:7947
  • [:######47.96.117.194]:7947
  • [:#######9.106.154.243]:7947
  • [:#######39.196.240.40]:7946
  • [:######47.96.255.179]:7946
  • [:######103.56.19.56]:7946
  • [:######119.28.52.46]:7947
  • [:######120.79.122.29]:7946
  • [:#######20.26.196.239]:7946
  • [:######119.29.245.52]:7946
  • [:#######7.106.135.124]:7946
  • [:#######34.175.227.68]:7946
  • [:######118.27.32.230]:7946
  • [:######47.95.9.162]:7946
  • [:#######75.102.179.12]:7947
  • [:######106.15.52.71]:7946
  • [:######118.25.90.216]:7946
  • [:######106.12.83.187]:7947
  • [:#######20.79.157.154]:7946
  • [:#######22.186.129.125]:7946
  • [:#######04.194.83.222]:7946
  • [:#######22.114.192.55]:7947
  • [:######171.80.0.139]:7946
  • [:#######10.216.61.138]:7946
  • [:#######11.231.62.201]:7947
  • [:######103.45.7.177]:7946
  • [:#######93.112.110.93]:7946
  • [:#######23.206.201.67]:7946
  • [:#######11.230.92.132]:7946
  • [:#######7.254.130.252]:7947
  • [:#######19.27.162.127]:7946
  • [:#######20.25.102.203]:7946
  • [:#######39.59.209.147]:7947
  • [:######182.61.15.252]:7946
  • [:######180.76.244.78]:7946
  • [:######124.42.72.91]:7946
  • [:######47.93.254.164]:7947
  • [:######39.96.4.80]:7946
  • [:#######19.59.127.150]:7947
  • [:######211.114.21.89]:7947
  • [:#######21.194.132.100]:7946
  • [:#######03.124.106.188]:7946
  • [:#######23.57.139.170]:7947
  • [:######120.27.97.248]:7947
  • [:######123.57.237.76]:7946
  • [:#######9.108.122.254]:7946
  • [:#######06.12.109.237]:7946
  • [:######117.146.60.20]:7947
  • [:######123.57.29.80]:7946
  • [:######118.24.154.82]:7946
  • [:######115.159.52.39]:7947
  • [:#######23.206.191.170]:7947
  • [:#######21.132.82.122]:7947
  • [:######47.100.54.161]:7947
  • [:#######18.126.108.24]:7946
  • [:######103.96.3.33]:7946
  • [:#######11.230.28.175]:7947
  • [:######123.57.33.212]:7946
  • [:#######9.107.203.227]:7946
  • [:#######23.57.244.251]:7946
  • [:######121.41.99.187]:7947
  • [:######39.108.109.58]:7946
  • [:#######40.143.90.154]:7947
  • [:#######20.78.240.211]:7946
  • [:#######04.131.163.57]:7947
  • [:######103.39.77.236]:7946
  • [:######58.192.69.35]:7947
  • [:######120.55.80.204]:7946
  • [:#######23.207.47.115]:7946
  • [:#######03.190.154.110]:7946
  • [:#######23.206.18.228]:7947
  • [:######118.25.3.28]:7947
  • [:#######20.78.144.233]:7946
  • [:######59.36.145.206]:7946
  • [:######125.5.178.157]:7946
  • [:#######11.231.230.65]:7947
  • [:#######9.108.245.223]:7947
  • [:######218.4.237.108]:7947
  • [:######119.9.77.75]:7946
  • [:#######24.192.161.179]:7946
  • [:#######21.40.252.119]:7946
  • [:######47.100.27.211]:7946
  • [:######45.78.77.106]:7947
  • [:#######02.162.221.174]:7947
  • [:######35.243.119.96]:7946
  • [:#######14.115.137.180]:7947
  • [:######120.78.148.10]:7946
  • [:######60.205.209.24]:7947
  • [:######118.89.217.77]:7946
  • [:######114.55.43.61]:7946
  • [:######47.104.17.82]:7946
  • [:######119.3.52.198]:7947
  • [:######39.108.212.30]:7946
  • [:#######40.143.100.90]:7946
  • [:######182.92.67.222]:7946
  • [:######120.77.8.118]:7946
  • [:#######11.231.240.76]:7946
  • [:######119.29.98.155]:7946
  • [:######58.87.91.127]:7946
  • [:######103.242.0.146]:7947
  • [:######120.24.7.6]:7946
  • [:######120.76.155.15]:7947
  • [:######60.205.146.36]:7947
  • [:#######23.206.41.168]:7947
  • [:#######11.26.195.101]:7946
  • [:#######39.199.190.59]:7946
  • [:#######39.162.219.43]:7947
  • [:######47.52.28.132]:7947
  • [:######134.175.6.68]:7946
  • [:#######03.240.182.42]:7946
  • [:######116.62.127.4]:7946
  • [:######47.96.128.28]:7946
  • [:#######82.140.132.133]:7947
  • [:######182.16.92.171]:7947
  • [:######117.48.197.10]:7946
  • [:######121.42.248.21]:7946
  • [:#######17.42.126.254]:7947
  • [:#######82.140.132.134]:7946
  • [:#######11.230.231.130]:7947
  • [:######103.72.164.86]:7947
  • [:######114.112.93.59]:7947
  • [:#######14.215.29.120]:7947
  • [:#######06.14.157.115]:7946
  • [:#######82.254.151.111]:7947
  • [:#######03.21.140.244]:7946
  • [:#######23.126.156.61]:7947
  • [:######39.106.26.23]:7946
  • [:######69.171.76.144]:7947
  • [:#######01.132.172.48]:7946
  • [:#######14.215.70.222]:7946
  • [:#######39.199.100.28]:7946
  • [:#######18.24.118.135]:7947
  • [:#######20.24.223.164]:7947
  • [:#######40.143.237.108]:7946
  • [:#######10.16.189.131]:7946
  • [:#######39.199.61.237]:7946
  • [:######120.132.56.15]:7947
  • [:######58.87.87.155]:7946
  • [:######117.141.5.87]:7947
  • [:######118.25.2.114]:7946
  • [:#######7.100.174.105]:7947
  • [:#######39.162.96.133]:7946
  • [:#######18.25.226.173]:7946
  • [:######120.26.83.158]:7947
  • [:#######29.204.15.186]:7947
  • [:#######40.143.228.224]:7947
  • [:#######15.159.189.241]:7946
  • [:#######23.147.221.101]:7947
  • [:#######5.163.204.146]:7946
  • [:######47.107.132.49]:7946
  • [:#######32.232.127.22]:7947
  • [:#######06.12.210.182]:7947
  • [:######47.104.96.62]:7946
  • [:######47.107.161.86]:7946
  • [:######39.104.165.91]:7947
  • [:#######93.112.109.119]:7947
  • [:#######40.143.148.16]:7946
  • [:#######39.196.30.145]:7946
  • [:######117.50.74.84]:7946
  • [:######103.242.1.42]:7946
  • [:#######23.206.85.224]:7947
  • [:######47.104.67.252]:7948
  • [:#######23.207.242.78]:7947
  • [:######47.98.197.215]:7946
  • [:######58.49.232.213]:7946
  • [:#######18.126.105.116]:7947
  • [:#######03.219.112.66]:7946
  • [:######182.61.13.176]:7946
  • [:######118.178.85.50]:7947
  • [:######123.207.99.21]:7946
  • [:######47.99.181.195]:7947
  • [:#######11.231.140.214]:7946
  • [:#######39.162.233.127]:7946
  • [:######47.93.206.239]:7946
  • [:#######7.104.193.204]:7946
  • [:#######06.245.142.117]:7946
  • [:######47.106.97.25]:7946
  • [:######119.9.106.27]:7946
  • 47.###.96.62:7946
  • [:######36.25.34.76]:7947
  • [:#######13.160.211.56]:7947
  • [:######120.76.41.109]:7946
  • [:######47.100.117.86]:7946
  • [:######123.56.16.227]:7946
  • [:#######18.126.115.245]:7946
  • [:#######9.108.208.110]:7947
  • [:#######03.193.151.239]:7947
  • [:######47.104.213.65]:7947
  • [:#######93.112.109.40]:7947
  • [:#######39.199.174.250]:7946
  • [:#######19.29.118.247]:7946
  • [:######39.108.71.221]:7946
  • [:#######22.186.169.147]:7946
  • [:#######03.51.160.130]:7946
  • [:######180.76.57.239]:7946
  • [:#######7.107.137.244]:7946
  • [:#######11.231.84.214]:7946
  • [:######218.86.60.114]:7946
  • [:#######11.149.241.144]:7947
  • [:#######11.230.222.151]:7946
Receives data from the following servers:
  • 8.#.8.8:53
  • 59.#.#7.151:7947
  • 47.###.96.62:7946
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number