Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.363

Added to the Dr.Web virus database: 2019-04-25

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/DbSecuritySpt
  • /etc/init.d/selinux
  • /etc/rc1.d/S97DbSecuritySpt
  • /etc/rc2.d/S97DbSecuritySpt
  • /etc/rc3.d/S97DbSecuritySpt
  • /etc/rc4.d/S97DbSecuritySpt
  • /etc/rc5.d/S97DbSecuritySpt
  • /etc/rc1.d/S99selinux
  • /etc/rc2.d/S99selinux
  • /etc/rc3.d/S99selinux
  • /etc/rc4.d/S99selinux
  • /etc/rc5.d/S99selinux
  • /etc/cron.d/tomcat
  • /etc/rc.d/init.d/watchdogs
  • /etc/rc.d/init.d/kthrotlds
  • /etc/init.d/netdns
Malicious functions:
Launches processes:
  • /usr/bin/getconf CLK_TCK
  • chattr -i /etc/cfly
  • chattr +i /etc/cfly
  • chattr -i /etc/migrations
  • chattr +i /etc/migrations
  • chattr -i /etc/httpdz
  • chattr +i /etc/httpdz
  • chattr -i /opt/nu/renice
  • chattr +i /opt/nu/renice
  • chattr -i /opt/yilu/mservice
  • chattr +i /opt/yilu/mservice
  • chattr -i /opt/yilu/work/xig/xig
  • chattr +i /opt/yilu/work/xig/xig
  • chattr -i /opt/yilu/work/xige/xige
  • chattr +i /opt/yilu/work/xige/xige
  • chattr -i /tmp/thisxxs
  • chattr +i /tmp/thisxxs
  • chattr -i /usr/bin/.sshd
  • chattr +i /usr/bin/.sshd
  • chattr -i /usr/bin/bsd-port/getty
  • chattr +i /usr/bin/bsd-port/getty
  • chattr -i /usr/bin/bsd-port/.dbus
  • chattr +i /usr/bin/bsd-port/.dbus
  • chattr -i /usr/bin/bsd-port/nmi
  • chattr +i /usr/bin/bsd-port/nmi
  • chattr -i /tmp/php
  • chattr +i /tmp/php
  • chattr -i /tmp/name
  • chattr +i /tmp/name
  • chattr -i /tmp/xc.x86_64
  • chattr +i /tmp/xc.x86_64
  • chattr -i /etc/init.d/DbSecuritySpt
  • chattr +i /etc/init.d/DbSecuritySpt
  • chattr -i /etc/init.d/selinux
  • chattr +i /etc/init.d/selinux
  • chattr -i /etc/rc1.d/S97DbSecuritySpt
  • chattr +i /etc/rc1.d/S97DbSecuritySpt
  • chattr -i /etc/rc2.d/S97DbSecuritySpt
  • chattr +i /etc/rc2.d/S97DbSecuritySpt
  • chattr -i /etc/rc3.d/S97DbSecuritySpt
  • chattr +i /etc/rc3.d/S97DbSecuritySpt
  • chattr -i /etc/rc4.d/S97DbSecuritySpt
  • chattr +i /etc/rc4.d/S97DbSecuritySpt
  • chattr -i /etc/rc5.d/S97DbSecuritySpt
  • chattr +i /etc/rc5.d/S97DbSecuritySpt
  • chattr -i /etc/rc1.d/S99selinux
  • chattr +i /etc/rc1.d/S99selinux
  • chattr -i /etc/rc2.d/S99selinux
  • chattr +i /etc/rc2.d/S99selinux
  • chattr -i /etc/rc3.d/S99selinux
  • chattr +i /etc/rc3.d/S99selinux
  • chattr -i /etc/rc4.d/S99selinux
  • chattr +i /etc/rc4.d/S99selinux
  • chattr -i /etc/rc5.d/S99selinux
  • chattr +i /etc/rc5.d/S99selinux
  • chattr -i /usr/local/lib/libioset.so
  • chattr +i /usr/local/lib/libioset.so
  • chattr -i /tmp/watchdogs
  • chattr +i /tmp/watchdogs
  • chattr -i /etc/cron.d/tomcat
  • chattr +i /etc/cron.d/tomcat
  • chattr -i /etc/rc.d/init.d/watchdogs
  • chattr +i /etc/rc.d/init.d/watchdogs
  • chattr -i /usr/sbin/watchdogs
  • chattr +i /usr/sbin/watchdogs
  • chattr -i /tmp/kthrotlds
  • chattr +i /tmp/kthrotlds
  • chattr -i /etc/rc.d/init.d/kthrotlds
  • chattr +i /etc/rc.d/init.d/kthrotlds
  • chattr -i /usr/sbin/kthrotlds
  • chattr +i /usr/sbin/kthrotlds
  • chattr -i /etc/init.d/netdns
  • chattr +i /etc/init.d/netdns
Performs operations with the file system:
Creates folders:
  • /opt/nu
  • /opt/yilu
  • /opt/yilu/work
  • /opt/yilu/work/xig
  • /opt/yilu/work/xige
  • /usr/bin/bsd-port
  • /etc/rc.d
  • /etc/rc.d/init.d
Creates or modifies files:
  • /etc/cfly
  • /etc/migrations
  • /etc/httpdz
  • /opt/nu/renice
  • /opt/yilu/mservice
  • /opt/yilu/work/xig/xig
  • /opt/yilu/work/xige/xige
  • /tmp/thisxxs
  • /usr/bin/.sshd
  • /usr/bin/bsd-port/getty
  • /usr/bin/bsd-port/.dbus
  • /usr/bin/bsd-port/nmi
  • /tmp/php
  • /tmp/name
  • /tmp/xc.x86_64
  • /usr/local/lib/libioset.so
  • /tmp/watchdogs
  • /usr/sbin/watchdogs
  • /tmp/kthrotlds
  • /usr/sbin/kthrotlds
Deletes files:
  • /etc/cfly
  • /etc/migrations
  • /etc/httpdz
  • /opt/nu/renice
  • /opt/yilu/mservice
  • /opt/yilu/work/xig/xig
  • /opt/yilu/work/xige/xige
  • /tmp/thisxxs
  • /usr/bin/.sshd
  • /usr/bin/bsd-port/getty
  • /usr/bin/bsd-port/.dbus
  • /usr/bin/bsd-port/nmi
  • /tmp/php
  • /tmp/name
  • /tmp/xc.x86_64
  • /etc/init.d/DbSecuritySpt
  • /etc/init.d/selinux
  • /etc/rc1.d/S97DbSecuritySpt
  • /etc/rc2.d/S97DbSecuritySpt
  • /etc/rc3.d/S97DbSecuritySpt
  • /etc/rc4.d/S97DbSecuritySpt
  • /etc/rc5.d/S97DbSecuritySpt
  • /etc/rc1.d/S99selinux
  • /etc/rc2.d/S99selinux
  • /etc/rc3.d/S99selinux
  • /etc/rc4.d/S99selinux
  • /etc/rc5.d/S99selinux
  • /usr/local/lib/libioset.so
  • /tmp/watchdogs
  • /etc/cron.d/tomcat
  • /etc/rc.d/init.d/watchdogs
  • /usr/sbin/watchdogs
  • /tmp/kthrotlds
  • /etc/rc.d/init.d/kthrotlds
  • /usr/sbin/kthrotlds
  • /etc/init.d/netdns
Other:
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number