FOR CUSTOMERS

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

EN

RU CN DE EN ES FR IT JP KZ UZ PL BY
Close
Support services
Scanners
Dr.Web vxCube
Trial
VCI investigations
Virus library
Knowledge base

Technologies

Terminology

Training and education

Myths

News

Linux.Packed.280

Added to the Dr.Web virus database: 2019-01-16

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Launches processes:
  • /usr/bin/getconf CLK_TCK
  • <SAMPLE_FULL_PATH>
  • /usr/bin/lsb_release
Kills the following processes:
  • /usr/bin/lsb_release
Performs operations with the file system:
Creates folders:
  • /tmp/.ddg
  • /root/.ssh
Creates or modifies files:
  • /tmp/.ddg/3017.lock
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • [2#######0:c000:1000::501]:9
  • 66.###.248.178:9
  • 21#.#39.38.21:9
  • 21#.#39.32.21:9
  • 95.##1.0.137:9
  • 95.##1.0.145:9
  • 21#.#39.36.21:9
  • 21#.#39.34.21:9
  • 52.###.143.163:9
  • 34.##6.82.108:9
  • 52.###.139.131:9
  • 52.##0.125.74:9
  • 34.##3.102.38:9
  • 18.##3.42.138:9
  • 95.###.190.198:7946
  • 12#.###.219.178:7946
HTTP GET requests:
  • ip###o.io/ip
  • ip####.net/plain
  • v4.##ent.me/
  • ip##.#canhazip.com/
  • wh#####yip.akamai.com/
  • bo#.####ismyipaddress.com/
  • ch#####.amazonaws.com/
Sends data to the following servers:
  • 8.#.8.8:53
  • 12#.###.219.178:7946
  • [:#######39.199.222.50]:7946
  • [:#######20.26.211.107]:7946
  • [:#######50.95.128.220]:7947
  • [:#######18.190.169.61]:7946
  • [:######61.163.2.115]:7947
  • [:######103.69.71.139]:7946
  • [:######123.56.248.19]:7946
  • [:######193.112.14.81]:7947
  • [:#######10.209.125.138]:7947
  • [:######103.242.0.146]:7947
  • [:######193.112.28.89]:7946
  • [:#######18.25.178.184]:7946
  • [:######58.218.213.73]:7947
  • [:#######22.114.122.49]:7947
  • [:######218.86.60.118]:7946
  • [:######47.95.204.217]:7947
  • [:#######23.206.20.198]:7947
  • [:#######10.90.186.158]:7946
  • [:######47.92.31.45]:7946
  • [:#######18.24.196.242]:7946
  • [:#######15.29.163.143]:7946
  • [:#######15.159.127.177]:7947
  • [:#######23.206.93.119]:7946
  • [:######120.79.180.10]:7946
  • [:######125.5.178.157]:7947
  • [:#######39.129.133.194]:7946
  • [:######118.25.22.176]:7946
  • [:#######18.31.249.227]:7947
  • [:######118.25.57.128]:7946
  • [:#######50.109.74.118]:7947
  • [:######47.92.231.169]:7946
  • [:######39.107.13.109]:7946
  • [:#######23.206.80.104]:7947
  • [:######103.27.207.13]:7947
  • [:######123.206.88.40]:7946
  • [:#######24.192.161.179]:7946
  • [:#######80.188.197.45]:7947
  • [:######139.196.164.3]:7947
  • [:#######12.74.179.131]:7946
  • [:#######11.17.215.107]:7946
  • [:######47.93.189.65]:7946
  • [:#######18.190.42.134]:7946
  • [:######118.25.3.28]:7947
  • [:######117.73.3.19]:7947
  • [:######77.81.230.65]:7946
  • [:######58.87.91.127]:7947
  • [:#######23.206.53.106]:7946
  • [:######118.25.65.113]:7946
  • [:######39.105.32.75]:7946
  • [:######39.105.85.111]:7946
  • [:#######40.143.228.134]:7947
  • [:######120.76.155.15]:7947
  • [:######118.25.46.165]:7947
  • [:######47.104.78.115]:7946
  • [:#######39.196.104.119]:7947
  • [:######47.92.109.192]:7946
  • [:######119.23.68.13]:7946
  • [:#######04.194.83.222]:7947
  • [:#######32.232.175.65]:7947
  • [:#######23.207.64.215]:7946
  • [:######115.159.38.23]:7946
  • [:#######7.104.193.204]:7947
  • [:#######20.92.217.178]:7946
  • [:######42.62.84.109]:7946
  • [:######61.160.234.13]:7947
  • [:#######23.206.30.249]:7947
  • [:######223.113.4.252]:7946
  • [:######116.62.55.240]:7947
  • [:#######11.149.198.253]:7946
  • [:#######12.74.179.118]:7946
  • [:#######11.231.141.42]:7946
  • [:######58.87.127.24]:7946
  • [:######193.112.14.49]:7946
  • [:######114.215.44.29]:7947
  • [:######193.112.97.60]:7946
  • [:######47.52.35.111]:7946
  • [:######47.110.50.228]:7946
  • [:#######03.255.203.196]:7947
  • [:#######23.207.249.180]:7947
  • [:#######11.231.109.213]:7947
  • [:######47.96.12.140]:7946
  • [:#######22.152.204.97]:7946
  • [:######47.104.130.35]:7946
  • [:######123.57.29.80]:7946
  • [:#######29.204.15.186]:7947
  • [:######218.4.237.106]:7947
  • [:#######14.215.70.222]:7946
  • [:#######18.25.220.199]:7946
  • [:######118.24.47.225]:7946
  • [:######47.107.161.86]:7946
  • [:#######16.208.53.182]:7947
  • [:######59.36.145.206]:7946
  • [:#######18.24.108.193]:7946
  • [:######101.37.168.2]:7947
  • [:#######39.199.38.168]:7946
  • [:#######7.106.151.255]:7946
  • [:#######17.34.118.117]:7946
  • [:######222.73.142.10]:7946
  • [:######119.23.237.95]:7946
  • [:######120.26.83.158]:7947
  • [:######118.25.64.159]:7946
  • [:#######01.201.76.199]:7946
  • [:######118.24.52.178]:7946
  • [:######118.178.190.9]:7947
  • [:######123.206.32.44]:7946
  • [:######101.132.97.51]:7946
  • [:#######23.207.124.127]:7947
  • [:######116.62.127.4]:7946
  • [:#######9.110.158.128]:7946
  • [:#######7.106.158.251]:7947
  • [:######119.9.77.153]:7947
  • [:#######39.162.176.81]:7947
  • [:######116.62.65.149]:7946
  • [:#######32.232.44.124]:7946
  • [:######39.106.41.40]:7946
  • [:######123.57.79.43]:7946
  • [:######118.25.35.202]:7946
  • [:######106.14.26.215]:7947
  • [:#######20.79.178.135]:7947
  • [:######47.95.123.168]:7946
  • [:######120.76.40.31]:7946
  • [:######123.57.49.75]:7946
  • [:#######23.58.240.135]:7947
  • [:#######18.190.144.46]:7948
  • [:######39.105.5.20]:7946
  • [:#######20.78.222.240]:7946
  • [:#######39.199.195.71]:7946
  • [:#######18.190.47.132]:7946
  • [:#######23.207.68.211]:7947
  • [:#######11.231.240.76]:7946
  • [:#######20.76.153.215]:7947
  • [:######193.0.215.111]:7947
  • [:######47.98.182.205]:7946
  • [:######119.29.94.164]:7946
  • [:#######40.143.204.166]:7946
  • [:######118.24.44.125]:7947
  • [:#######32.232.127.22]:7947
  • [:#######7.104.252.215]:7946
  • [:#######92.144.203.228]:7947
  • [:#######20.176.75.130]:7946
  • [:######202.29.232.1]:7947
  • [:######47.107.149.84]:7946
  • [:######103.80.27.149]:7947
  • [:#######23.58.240.146]:7946
  • [:#######40.143.156.219]:7946
  • [:######123.207.33.14]:7946
  • [:######39.108.18.125]:7946
  • [:#######40.143.226.161]:7947
  • [:######139.129.8.24]:7946
  • [:#######21.229.166.68]:7946
  • [:######47.98.150.108]:7947
  • [:######118.89.17.225]:7947
  • [:######101.37.31.202]:7946
  • [:######222.73.142.10]:7947
  • [:######211.114.21.89]:7946
  • [:#######11.159.157.75]:7947
  • [:######121.41.99.187]:7947
  • [:#######7.104.247.210]:7946
  • [:######47.98.223.33]:7947
  • [:#######23.206.72.165]:7946
  • [:######114.112.93.54]:7947
  • [:#######18.244.196.29]:7946
  • [:######47.107.63.194]:7946
  • [:######47.97.23.184]:7946
  • [:######47.98.118.77]:7947
  • [:######120.25.237.80]:7947
  • [:#######18.24.168.206]:7946
  • [:#######11.230.222.151]:7947
  • [:######54.37.127.32]:7946
  • [:#######03.190.154.110]:7947
  • [:######47.104.158.13]:7946
  • [:######47.98.172.38]:7946
  • [:#######32.232.79.123]:7947
  • [:######193.112.43.49]:7946
  • [:######103.36.84.148]:7947
  • [:######118.25.5.143]:7946
  • [:#######11.231.62.201]:7947
  • [:#######18.24.118.135]:7947
  • [:######39.96.4.80]:7946
  • [:######222.73.142.7]:7947
  • [:#######50.109.103.47]:7946
  • [:#######23.207.153.211]:7946
  • [:#######18.244.206.95]:7946
  • [:#######18.178.191.164]:7946
  • [:######47.93.207.199]:7947
  • [:#######20.79.178.135]:7946
  • [:######118.178.85.50]:7947
  • [:######178.128.85.79]:7947
  • [:#######32.232.226.248]:7946
  • [:#######11.231.209.47]:7946
  • [:#######20.132.124.33]:7946
  • [:######117.73.2.123]:7947
  • [:######120.27.196.96]:7946
  • [:######182.61.19.163]:7947
  • [:#######39.59.209.147]:7946
  • [:######114.67.22.172]:7946
  • [:#######22.114.154.211]:7947
  • [:######106.14.16.21]:7946
  • [:######121.43.168.35]:7946
  • [:######47.104.17.82]:7946
  • [:######202.5.17.32]:7947
  • [:#######93.112.130.193]:7947
  • [:######65.49.209.65]:7946
  • [:######47.93.226.214]:7946
  • [:######59.33.119.53]:7947
  • [:######120.78.81.158]:7946
  • [:######119.28.52.46]:7947
  • [:######39.108.65.142]:7946
  • [:######120.76.41.109]:7947
  • [:#######11.231.115.187]:7946
  • [:#######18.126.115.245]:7947
  • [:######120.132.56.15]:7946
  • [:######118.25.22.176]:7947
  • [:#######23.207.171.142]:7947
  • [:#######5.163.204.146]:7947
  • [:#######11.231.81.129]:7946
  • [:######116.12.52.137]:7946
  • [:######118.24.4.35]:7946
  • [:#######20.25.102.203]:7946
  • [:#######03.106.203.133]:7947
  • [:######71.251.31.15]:7947
  • [:#######82.16.103.114]:7947
  • [:#######11.149.241.144]:7946
  • [:#######15.29.207.185]:7947
  • [:######58.49.232.213]:7946
  • [:######47.98.247.242]:7946
  • [:######106.13.2.133]:7947
  • [:#######7.230.182.214]:7946
  • [:#######23.206.18.228]:7946
  • [:######120.24.68.83]:7946
  • [:#######7.100.100.106]:7947
  • [:######118.24.23.82]:7946
  • [:#######15.159.189.241]:7947
  • [:#######23.207.160.50]:7947
  • [:######182.61.24.28]:7946
  • [:#######93.112.106.126]:7946
  • [:######106.13.66.69]:7946
  • [:######106.13.33.215]:7946
  • [:#######03.215.208.74]:7946
  • [:######115.29.77.254]:7946
  • [:#######80.188.192.112]:7946
  • [:######112.74.128.9]:7946
  • [:######47.97.63.87]:7947
  • [:#######23.93.183.126]:7947
  • [:#######39.162.48.148]:7947
  • [:######118.89.36.52]:7947
  • [:#######93.112.109.40]:7947
  • [:######114.112.93.59]:7946
  • [:######180.76.111.66]:7947
  • [:######221.1.210.254]:7946
  • [:######118.31.39.66]:7946
  • [:#######23.206.75.191]:7946
  • [:######58.87.114.119]:7947
  • [:#######39.162.91.231]:7947
  • [:#######01.37.173.220]:7947
  • [:#######21.42.247.166]:7946
  • [:######119.28.67.98]:7946
  • [:######116.62.212.93]:7947
  • [:######119.27.163.94]:7946
  • [:######116.62.69.8]:7946
  • [:#######1.141.223.107]:7947
  • [:######219.234.5.58]:7946
  • [:######119.9.106.27]:7946
  • [:#######01.201.145.97]:7946
  • [:#######17.34.118.117]:7947
  • [:#######8.218.207.185]:7946
  • [:######120.78.75.192]:7946
  • [:######47.110.80.94]:7946
  • [:######47.107.132.49]:7946
  • [:######117.50.74.84]:7947
  • [:#######88.131.136.193]:7947
  • [:######27.50.51.133]:7946
  • [:#######23.58.240.149]:7946
  • [:######47.99.83.11]:7946
  • [:######139.199.18.70]:7946
  • [:#######39.129.239.212]:7946
  • [:#######82.92.163.124]:7947
  • [:#######03.247.10.117]:7947
  • [:#######32.232.79.123]:7946
  • [:######117.73.3.93]:7947
  • [:######112.74.87.99]:7946
  • [:######47.98.122.188]:7947
  • [:#######9.105.191.182]:7946
  • [:#######21.40.166.232]:7947
  • [:#######40.143.19.204]:7947
  • [:#######32.232.103.207]:7946
  • [:#######03.250.126.27]:7946
  • [:######199.66.90.178]:7946
  • [:#######7.106.178.243]:7946
  • [:#######23.207.53.104]:7947
  • [:######111.76.67.131]:7947
  • [:#######23.206.73.105]:7946
  • [:#######20.76.244.167]:7946
  • [:#######18.228.152.210]:7947
  • [:#######20.25.243.182]:7946
  • [:######101.201.31.44]:7946
  • [:######47.93.254.166]:7946
  • [:######47.104.17.82]:7947
  • [:######118.26.174.16]:7947
  • [:#######18.24.204.222]:7946
  • [:######118.24.154.82]:7947
  • [:######120.79.89.237]:7948
  • [:#######82.140.132.131]:7946
  • [:#######39.162.233.127]:7947
  • [:######123.206.45.47]:7946
  • [:#######40.143.225.49]:7946
  • [:######101.37.69.181]:7947
  • [:######122.114.10.3]:7946
  • [:######47.107.236.34]:7946
  • [:######106.12.21.231]:7947
  • [:######120.24.53.87]:7946
  • [:#######11.231.107.199]:7947
  • [:#######39.129.229.210]:7947
  • [:#######40.143.231.29]:7947
  • [:######123.56.101.62]:7946
  • [:#######06.14.251.140]:7947
  • [:#######24.232.152.10]:7947
  • [:#######04.131.60.196]:7946
  • [:#######32.232.170.188]:7947
  • [:######123.58.18.119]:7947
  • [:######106.13.73.1]:7946
  • [:######118.27.26.72]:7946
  • [:######103.218.3.168]:7946
  • [:#######23.207.40.210]:7946
  • [:######111.230.61.84]:7947
  • [:######117.42.126.8]:7947
  • [:######125.132.18.69]:7946
  • [:######118.25.36.247]:7946
  • [:######120.79.197.46]:7946
  • [:######47.93.113.84]:7946
  • [:######119.9.77.136]:7947
  • [:######47.92.107.149]:7946
Receives data from the following servers:
  • 8.#.8.8:53
  • 12#.###.219.178:7946
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations

Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number