Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.378

Added to the Dr.Web virus database: 2019-04-29

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/DbSecuritySpt
  • /etc/init.d/selinux
  • /etc/rc1.d/S97DbSecuritySpt
  • /etc/rc2.d/S97DbSecuritySpt
  • /etc/rc3.d/S97DbSecuritySpt
  • /etc/rc4.d/S97DbSecuritySpt
  • /etc/rc5.d/S97DbSecuritySpt
  • /etc/rc1.d/S99selinux
  • /etc/rc2.d/S99selinux
  • /etc/rc3.d/S99selinux
  • /etc/rc4.d/S99selinux
  • /etc/rc5.d/S99selinux
  • /etc/cron.d/tomcat
  • /etc/rc.d/init.d/watchdogs
  • /etc/rc.d/init.d/kthrotlds
  • /etc/init.d/netdns
  • /etc/rc.d/init.d/nfstruncate
Malicious functions:
Launches processes:
  • /usr/bin/getconf CLK_TCK
  • chattr -i /var/tmp/.xm.log
  • chattr +i /var/tmp/.xm.log
  • chattr -i /tmp/systemd
  • chattr +i /tmp/systemd
  • chattr -i /tmp/.systemd-login
  • chattr +i /tmp/.systemd-login
  • chattr -i /tmp/.systemd-analyze
  • chattr +i /tmp/.systemd-analyze
  • chattr -i /lib/systemd/systemd-login
  • chattr +i /lib/systemd/systemd-login
  • chattr -i /root/.systemd-login
  • chattr +i /root/.systemd-login
  • chattr -i /usr/lib/libiacpkmn.so.3
  • chattr +i /usr/lib/libiacpkmn.so.3
  • chattr -i /etc/cfly
  • chattr +i /etc/cfly
  • chattr -i /etc/migrations
  • chattr +i /etc/migrations
  • chattr -i /etc/httpdz
  • chattr +i /etc/httpdz
  • chattr -i /opt/nu/renice
  • chattr +i /opt/nu/renice
  • chattr -i /opt/yilu/mservice
  • chattr +i /opt/yilu/mservice
  • chattr -i /opt/yilu/work/xig/xig
  • chattr +i /opt/yilu/work/xig/xig
  • chattr -i /opt/yilu/work/xige/xige
  • chattr +i /opt/yilu/work/xige/xige
  • chattr -i /tmp/thisxxs
  • chattr +i /tmp/thisxxs
  • chattr -i /usr/bin/.sshd
  • chattr +i /usr/bin/.sshd
  • chattr -i /usr/bin/bsd-port/getty
  • chattr +i /usr/bin/bsd-port/getty
  • chattr -i /usr/bin/bsd-port/.dbus
  • chattr +i /usr/bin/bsd-port/.dbus
  • chattr -i /usr/bin/bsd-port/nmi
  • chattr +i /usr/bin/bsd-port/nmi
  • chattr -i /tmp/php
  • chattr +i /tmp/php
  • chattr -i /tmp/name
  • chattr +i /tmp/name
  • chattr -i /tmp/xc.x86_64
  • chattr +i /tmp/xc.x86_64
  • chattr -i /etc/init.d/DbSecuritySpt
  • chattr +i /etc/init.d/DbSecuritySpt
  • chattr -i /etc/init.d/selinux
  • chattr +i /etc/init.d/selinux
  • chattr -i /etc/rc1.d/S97DbSecuritySpt
  • chattr +i /etc/rc1.d/S97DbSecuritySpt
  • chattr -i /etc/rc2.d/S97DbSecuritySpt
  • chattr +i /etc/rc2.d/S97DbSecuritySpt
  • chattr -i /etc/rc3.d/S97DbSecuritySpt
  • chattr +i /etc/rc3.d/S97DbSecuritySpt
  • chattr -i /etc/rc4.d/S97DbSecuritySpt
  • chattr +i /etc/rc4.d/S97DbSecuritySpt
  • chattr -i /etc/rc5.d/S97DbSecuritySpt
  • chattr +i /etc/rc5.d/S97DbSecuritySpt
  • chattr -i /etc/rc1.d/S99selinux
  • chattr +i /etc/rc1.d/S99selinux
  • chattr -i /etc/rc2.d/S99selinux
  • chattr +i /etc/rc2.d/S99selinux
  • chattr -i /etc/rc3.d/S99selinux
  • chattr +i /etc/rc3.d/S99selinux
  • chattr -i /etc/rc4.d/S99selinux
  • chattr +i /etc/rc4.d/S99selinux
  • chattr -i /etc/rc5.d/S99selinux
  • chattr +i /etc/rc5.d/S99selinux
  • chattr -i /usr/local/lib/libioset.so
  • chattr +i /usr/local/lib/libioset.so
  • chattr -i /tmp/watchdogs
  • chattr +i /tmp/watchdogs
  • chattr -i /etc/cron.d/tomcat
  • chattr +i /etc/cron.d/tomcat
  • chattr -i /etc/rc.d/init.d/watchdogs
  • chattr +i /etc/rc.d/init.d/watchdogs
  • chattr -i /usr/sbin/watchdogs
  • chattr +i /usr/sbin/watchdogs
  • chattr -i /tmp/kthrotlds
  • chattr +i /tmp/kthrotlds
  • chattr -i /etc/rc.d/init.d/kthrotlds
  • chattr +i /etc/rc.d/init.d/kthrotlds
  • chattr -i /usr/sbin/kthrotlds
  • chattr +i /usr/sbin/kthrotlds
  • chattr -i /etc/init.d/netdns
  • chattr +i /etc/init.d/netdns
  • chattr -i /etc/rc.d/init.d/nfstruncate
  • chattr +i /etc/rc.d/init.d/nfstruncate
Performs operations with the file system:
Creates folders:
  • /opt/nu
  • /opt/yilu
  • /opt/yilu/work
  • /opt/yilu/work/xig
  • /opt/yilu/work/xige
  • /usr/bin/bsd-port
  • /etc/rc.d
  • /etc/rc.d/init.d
Creates or modifies files:
  • /var/tmp/.xm.log
  • /tmp/systemd
  • /tmp/.systemd-login
  • /tmp/.systemd-analyze
  • /lib/systemd/systemd-login
  • /root/.systemd-login
  • /usr/lib/libiacpkmn.so.3
  • /etc/cfly
  • /etc/migrations
  • /etc/httpdz
  • /opt/nu/renice
  • /opt/yilu/mservice
  • /opt/yilu/work/xig/xig
  • /opt/yilu/work/xige/xige
  • /tmp/thisxxs
  • /usr/bin/.sshd
  • /usr/bin/bsd-port/getty
  • /usr/bin/bsd-port/.dbus
  • /usr/bin/bsd-port/nmi
  • /tmp/php
  • /tmp/name
  • /tmp/xc.x86_64
  • /usr/local/lib/libioset.so
  • /tmp/watchdogs
  • /usr/sbin/watchdogs
  • /tmp/kthrotlds
  • /usr/sbin/kthrotlds
Deletes files:
  • /var/tmp/.xm.log
  • /tmp/systemd
  • /tmp/.systemd-login
  • /tmp/.systemd-analyze
  • /lib/systemd/systemd-login
  • /root/.systemd-login
  • /usr/lib/libiacpkmn.so.3
  • /etc/cfly
  • /etc/migrations
  • /etc/httpdz
  • /opt/nu/renice
  • /opt/yilu/mservice
  • /opt/yilu/work/xig/xig
  • /opt/yilu/work/xige/xige
  • /tmp/thisxxs
  • /usr/bin/.sshd
  • /usr/bin/bsd-port/getty
  • /usr/bin/bsd-port/.dbus
  • /usr/bin/bsd-port/nmi
  • /tmp/php
  • /tmp/name
  • /tmp/xc.x86_64
  • /etc/init.d/DbSecuritySpt
  • /etc/init.d/selinux
  • /etc/rc1.d/S97DbSecuritySpt
  • /etc/rc2.d/S97DbSecuritySpt
  • /etc/rc3.d/S97DbSecuritySpt
  • /etc/rc4.d/S97DbSecuritySpt
  • /etc/rc5.d/S97DbSecuritySpt
  • /etc/rc1.d/S99selinux
  • /etc/rc2.d/S99selinux
  • /etc/rc3.d/S99selinux
  • /etc/rc4.d/S99selinux
  • /etc/rc5.d/S99selinux
  • /usr/local/lib/libioset.so
  • /tmp/watchdogs
  • /etc/cron.d/tomcat
  • /etc/rc.d/init.d/watchdogs
  • /usr/sbin/watchdogs
  • /tmp/kthrotlds
  • /etc/rc.d/init.d/kthrotlds
  • /usr/sbin/kthrotlds
  • /etc/init.d/netdns
  • /etc/rc.d/init.d/nfstruncate
Other:
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

The Russian developer of Dr.Web anti-viruses

Doctor Web has been developing anti-virus software since 1992

Dr.Web is trusted by users around the world in 200+ countries

The company has delivered an anti-virus as a service since 2007

24/7 tech support

© Doctor Web
2003 — 2019

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125040