Linux.Packed.590

Technical Information

Malicious functions:

Launches itself as a daemon

Launches processes:

sh -c clear
clear
sh -c echo Infected By Arh
sh -c rm -rf /tmp/* /var/* /var/run/* /var/tmp/*
rm -rf /tmp/* /var/backups /var/cache /var/lib /var/local /var/lock /var/log /var/mail /var/opt /var/run /var/spool /var/tmp /var/run/atd.pid /var/run/crond.pid /var/run/crond.reboot /var/run/dbus /var/run/dhclient.eth0.pid /var/run/exim4 /var/run/initctl /var/run/lock /var/run/log /var/run/mount /var/run/network /var/run/rpc.statd.pid /var/run/rpc_pipefs /var/run/rpcbind /var/run/rpcbind.lock /var/run/rpcbind.pid /var/run/rpcbind.sock /var/run/rsyslogd.pid /var/run/sendsigs.omit.d /var/run/shm /var/run/sm-notify.pid /var/run/sshd /var/run/sshd.pid /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/user /var/run/utmp /var/tmp/*

Kills system processes:

sshd

Kills the following processes:

exim4
bash
run.sh

Performs operations with the file system:

Creates or modifies files:

/etc/resolv.conf

Deletes files:

/tmp/*
/srcpkgcache.bin
/pkgcache.bin
/libssl1.0.0_1.0.1t-1+deb8u5_mips.deb
/libmpfr4_3.1.2-2_mips.deb
/python2.7-minimal_2.7.9-2+deb8u1_mips.deb
/libssl-dev_1.0.1t-1+deb8u5_mips.deb
/python-dev_2.7.9-1_mips.deb
/python2.7_2.7.9-2+deb8u1_mips.deb
/libpython2.7_2.7.9-2+deb8u1_mips.deb
/libc-dev-bin_2.19-18+deb8u3_mips.deb
/libc6-dev_2.19-18+deb8u3_mips.deb
/zlib1g-dev_1%3a1.2.8.dfsg-2+b1_mips.deb
/libexpat1_2.1.0-6+deb8u3_mips.deb
/libisl10_0.12.2-2_mips.deb
/g++_4%3a4.9.2-2_mips.deb
/gcc-4.8_4.8.4-1_mips.deb
/libpython-dev_2.7.9-1_mips.deb
/linux-headers-3.16.0-4-4kc-malta_3.16.7-ckt20-1+deb8u3_mips.deb
/python2.7-dev_2.7.9-2+deb8u1_mips.deb
/dpkg-dev_1.17.26_all.deb
/libpython2.7-dev_2.7.9-2+deb8u1_mips.deb
/libpython2.7-minimal_2.7.9-2+deb8u1_mips.deb
/cpp-4.8_4.8.4-1_mips.deb
/manpages-dev_3.74-1_all.deb
/gcc_4%3a4.9.2-2_mips.deb
/libstdc++-4.9-dev_4.9.2-10_mips.deb
/libalgorithm-diff-xs-perl_0.04-3+b1_mips.deb
/linux-libc-dev_3.16.7-ckt20-1+deb8u3_mips.deb
/lock
/libfile-fcntllock-perl_0.22-1+b1_mips.deb
/libfakeroot_1.20.2-1_mips.deb
/cpp-4.9_4.9.2-10_mips.deb
/build-essential_11.7_mips.deb
/cpp_4%3a4.9.2-2_mips.deb
/linux-headers-3.16.0-4-common_3.16.7-ckt20-1+deb8u3_mips.deb
/linux-kbuild-3.16_3.16.7-ckt20-1_mips.deb
/libssl-doc_1.0.1t-1+deb8u5_all.deb
/make_4.0-8.1_mips.deb
/libexpat1-dev_2.1.0-6+deb8u3_mips.deb
/gcc-4.9_4.9.2-10_mips.deb
/libcloog-isl4_0.18.2-1+b2_mips.deb
/libdpkg-perl_1.17.26_all.deb
/libgomp1_4.9.2-10_mips.deb
/libatomic1_4.9.2-10_mips.deb
/libpython2.7-stdlib_2.7.9-2+deb8u1_mips.deb
/libgcc-4.8-dev_4.8.4-1_mips.deb
/libalgorithm-merge-perl_0.08-2_all.deb
/binutils_2.25-5_mips.deb
/libgcc-4.9-dev_4.9.2-10_mips.deb
/fakeroot_1.20.2-1_mips.deb
/g++-4.9_4.9.2-10_mips.deb
/libalgorithm-diff-perl_1.19.02-3_all.deb
/libmpc3_1.0.2-1_mips.deb
/hunspell.db
/ispell-dicts-list.txt
/jed-ispell-dicts.sl
/wordlist-default
/ispell.db
/ispell-default
/emacsen-ispell-dicts.el
/aspell.db
/sqspell.php
/wordlist.db
/emacsen-ispell-default.el
/index.db
/CACHEDIR.TAG
/templates.dat
/config.dat
/config.dat-old
/templates.dat-old
/passwords.dat
/aux-cache
/f06766f883c12b9298ca893082d31aea-be32d8.cache-4
/910726c8ef460ef39ce8f05e32ab3996-be32d8.cache-4
/e48ff2ab1dbaaa018303ba3fdc970657-be32d8.cache-4
/a05d7f1ef0bc433f2a2d30111abdc3d0-be32d8.cache-4
/state
/ftp.ru.debian.org_debian_dists_jessie-updates_main_i18n_Translation-en.IndexDiff
/ftp.ru.debian.org_debian_dists_jessie_main_binary-mips_Packages
/security.debian.org_dists_jessie_updates_InRelease
/ftp.ru.debian.org_debian_dists_jessie_main_source_Sources
/ftp.ru.debian.org_debian_dists_jessie-updates_InRelease
/ftp.ru.debian.org_debian_dists_jessie_Release.gpg
/ftp.ru.debian.org_debian_dists_jessie_main_i18n_Translation-en
/ftp.ru.debian.org_debian_dists_jessie-updates_main_binary-mips_Packages
/ftp.ru.debian.org_debian_dists_jessie-updates_main_source_Sources
/security.debian.org_dists_jessie_updates_main_i18n_Translation-en
/ftp.ru.debian.org_debian_dists_jessie-updates_main_i18n_Translation-en
/ftp.ru.debian.org_debian_dists_jessie-updates_main_binary-mips_Packages.IndexDiff
/security.debian.org_dists_jessie_updates_main_source_Sources
/security.debian.org_dists_jessie_updates_main_binary-mips_Packages
/ftp.ru.debian.org_debian_dists_jessie_Release
/extended_states
/listchanges.db
/wamerican
/ibritish
/iamerican
/random-seed
/session-noninteractive
/password
/seen
/auth
/account
/session
/usb.ids
/update-initramfs
/Unincorp
/update-default-wordlist
/File
/pysupport
/update-ca-certificates
/aspell-autobuildhash
/Lock
/update-default-ispell
/ldconfig
/ispell-autobuildhash
/update-ca-certificates-fresh
/statoverride
/available
/status-old
/status
/diversions
/diversions-old
/python-apt.list
/man-db.list
/ucf.templates
/liblzma5:mips.shlibs
/libtinfo5:mips.list
/libtokyocabinet9:mips.shlibs
/libgdbm3:mips.shlibs
/libgtk2.0-0:mips.triggers
/libattr1:mips.shlibs
/libalgorithm-diff-perl.md5sums
/docutils-common.conffiles
/libusb-0.1-4:mips.symbols
/libxfixes3:mips.symbols
/libglib2.0-0:mips.list
/libdebconfclient0:mips.postinst
/exim4-daemon-light.templates
/libassuan0:mips.list
/rsyslog.md5sums
/libxcb1:mips.shlibs
/mlocate.postinst
/netcat-traditional.postinst
/libxau6:mips.md5sums
/libpixman-1-0:mips.postrm
/libcurl3-gnutls:mips.symbols
/pinentry-gtk2.md5sums
/gnupg.preinst
/libjasper1:mips.postrm
/ca-certificates.md5sums
/ncurses-base.conffiles
/libsub-install-perl.md5sums
/libapt-inst1.5:mips.postrm
/acl.md5sums
/libedit2:mips.postinst
/libpaper1:mips.postrm
/cpp-4.8.list
/libdatrie1:mips.md5sums
/libc-dev-bin.list
/libgc1c2:mips.shlibs
/libssl1.0.0:mips.list
/fontconfig-config.templates
/isc-dhcp-client.preinst
/python-chardet.md5sums
/apt.list
/systemd.conffiles
/isc-dhcp-client.postrm
/systemd.prerm
/python-wstools.md5sums
/libssl1.0.0:mips.symbols
/libcomerr2:mips.postrm
/libwww-perl.md5sums
/geoip-database.md5sums
/libpam-runtime.templates
/libhogweed2:mips.symbols
/libpython2.7:mips.shlibs
/libdata-section-perl.md5sums
/libpsl0:mips.postinst
/libhogweed2:mips.list
/libgpg-error0:mips.postinst
/libxrandr2:mips.md5sums
/liblcms2-2:mips.shlibs
/openssh-sftp-server.list
/libxmuu1:mips.shlibs
/libcairo2:mips.postrm
/gcc-4.8.list
/initscripts.postrm
/libnetfilter-acct1:mips.postinst
/gcc.md5sums
/libtiff5:mips.shlibs
/zlib1g:mips.postrm
/libisc95.shlibs
/udev.md5sums
/libnettle4:mips.postinst
/zlib1g:mips.list
/hicolor-icon-theme.triggers
/libsmartcols1:mips.shlibs
/libidn11:mips.postrm
/dash.list
/ibritish.list
/libxfixes3:mips.postinst
/sensible-utils.postrm
/util-linux.conffiles
/libmagic1:mips.shlibs
/libtokyocabinet9:mips.symbols
/libhttp-daemon-perl.md5sums
/libswitch-perl.md5sums
/libdebconfclient0:mips.symbols
/rpcbind.conffiles
/libmount1:mips.postinst
/linux-base.postinst
/openssl.list
/libdbus-1-3:mips.shlibs
/libtext-soundex-perl.md5sums
/liblwres90.md5sums
/ienglish-common.md5sums
/man-db.triggers
/libaudit-common.conffiles
/libc-bin.postinst
/libisccfg-export90.list
/systemd.postinst
/vim-common.md5sums
/procps.list
/udev.templates
/dpkg.conffiles
/bc.list
/logrotate.postrm
/libncurses5:mips.list
/nfs-common.list
/libp11-kit0:mips.postrm
/mutt.postrm
/hicolor-icon-theme.md5sums
/libwrap0:mips.symbols
/libxapian22.md5sums
/xml-core.list
/gnupg2.md5sums
/debian-faq.list
/apt.md5sums
/gettext-base.list
/libgpg-error0:mips.md5sums
/vim-tiny.conffiles
/libjson-c2:mips.postinst
/libhttp-message-perl.list
/libgc1c2:mips.md5sums
/libisccc90.md5sums
/libgpg-error0:mips.shlibs
/libgssapi-krb5-2:mips.postrm
/libusb-0.1-4:mips.postinst
/libxml-parser-perl.list
/libgnutls-deb0-28:mips.md5sums
/libmodule-pluggable-perl.list
/libgssapi-krb5-2:mips.conffiles
/manpages.md5sums
/manpages.list
/debian-archive-keyring.list
/libsystemd0:mips.postinst
/w3m.preinst
/libgomp1:mips.postinst
/libpod-readme-perl.md5sums
/readline-common.list
/python-soappy.md5sums
/libpam-modules:mips.postinst
/libpython-stdlib:mips.md5sums
/libmodule-signature-perl.md5sums
/dnsutils.postinst
/tasksel.templates
/lsb-base.list
/libnet-ssleay-perl.md5sums
/libcgi-pm-perl.list
/libxext6:mips.postrm
/liblwp-mediatypes-perl.md5sums
/libatomic1:mips.symbols
/ca-certificates.list
/docutils-common.prerm
/libencode-locale-perl.list
/isc-dhcp-client.md5sums
/libnet-http-perl.md5sums
/libio-socket-ip-perl.md5sums
/libgpm2:mips.list
/libnettle4:mips.symbols
/groff-base.postinst
/libgtk2.0-0:mips.list
/emacsen-common.prerm
/diffutils.md5sums
/libc-bin.conffiles
/python-wstools.list
/libtasn1-6:mips.postinst
/libfontconfig1:mips.list
/iamerican.list
/docutils-common.md5sums
/hicolor-icon-theme.postinst
/libpython2.7-minimal:mips.postinst
/mime-support.triggers
/fonts-dejavu-core.list
/dictionaries-common.preinst
/libpipeline1:mips.list
/discover.list
/libacl1:mips.shlibs
/libacl1:mips.list
/libdatrie1:mips.symbols
/dash.postrm
/libdatrie1:mips.postinst
/libdns-export100.md5sums
/mime-support.prerm
/libgpgme11:mips.list
/libsqlite3-0:mips.shlibs
/fakeroot.postinst
/libapt-inst1.5:mips.symbols
/procps.postinst
/libgmp10:mips.shlibs
/libhtml-parser-perl.list
/apt.postinst
/libnettle4:mips.md5sums
/libusb-1.0-0:mips.shlibs
/liblogging-stdlog0:mips.shlibs
/man-db.postrm
/python-dev.md5sums
/nfs-common.conffiles
/libuuid-perl.list
/libpam0g:mips.symbols
/libgeoip1:mips.shlibs
/libassuan0:mips.symbols
/adduser.postrm
/libnewt0.52:mips.conffiles
/locales.postrm
/python-reportbug.postinst
/isc-dhcp-common.list
/python-pygments.md5sums
/libtext-unidecode-perl.list
/liblockfile1:mips.postrm
/libpango-1.0-0:mips.postrm
/python-chardet.prerm
/binutils.md5sums
/libx11-6:mips.postrm
/less.postinst
/libfontconfig1:mips.postrm
/libpsl0:mips.shlibs
/libstdc++-4.9-dev:mips.list
/sensible-utils.md5sums
/python-pkg-resources.postinst
/debconf-i18n.md5sums
/libthai0:mips.postinst
/grep.list
/libgtk2.0-0:mips.symbols
/libpam-modules-bin.list
/libapt-pkg4.12:mips.md5sums
/bsd-mailx.postinst
/libgnutls-deb0-28:mips.list
/exim4-config.templates
/libgtk2.0-0:mips.shlibs
/libicu52:mips.shlibs
/pinentry-gtk2.list
/libapt-pkg4.12:mips.symbols
/fontconfig-config.md5sums
/libharfbuzz0b:mips.shlibs
/libacl1:mips.postinst
/adduser.conffiles
/libhttp-negotiate-perl.list
/libnet-http-perl.list
/tasksel-data.postinst
/lsb-base.md5sums
/liblzma5:mips.symbols
/libpixman-1-0:mips.symbols
/wget.md5sums
/rename.prerm
/libpth20:mips.list
/exim4-config.postrm
/libpth20:mips.symbols
/libxml2:mips.shlibs
/e2fsprogs.list
/libcups2:mips.list
/liblwp-protocol-https-perl.md5sums
/libxfixes3:mips.list
/libassuan0:mips.shlibs
/libcwidget3:mips.postinst
/libpopt0:mips.shlibs
/libxml-sax-expat-perl.prerm
/libgssapi-krb5-2:mips.list
/libgc1c2:mips.symbols
/libgdbm3:mips.list
/gcc-4.9.md5sums
/bash.conffiles
/libtirpc1:mips.postrm
/libbind9-90.list
/libtiff5:mips.md5sums
/libxml-sax-perl.postrm
/mime-support.md5sums
/libicu52:mips.postinst
/libhttp-date-perl.list
/host.md5sums
/libhttp-date-perl.md5sums
/libgpgme11:mips.md5sums
/libsepol1:mips.shlibs
/libattr1:mips.list
/shared-mime-info.postinst
/file.md5sums
/util-linux-locales.postinst
/patch.list
/libregexp-common-perl.md5sums
/libapt-inst1.5:mips.postinst
/exim4-base.conffiles
/xz-utils.list
/initscripts.postinst
/at.list
/at.postinst
/readline-common.postinst
/libio-string-perl.list
/locales.list
/libpangocairo-1.0-0:mips.shlibs
/ncurses-term.md5sums
/libgmp10:mips.list
/libasprintf0c2:mips.list
/initscripts.conffiles
/init.list
/at.conffiles
/libbsd0:mips.shlibs
/fontconfig.list
/emacsen-common.postrm
/libc6:mips.shlibs
/pciutils.preinst
/libthai-data.list
/libclass-accessor-perl.md5sums
/libglib2.0-data.preinst
/linux-kbuild-3.16.list
/libsigsegv2:mips.shlibs
/libuuid-perl.md5sums
/liblockfile1:mips.postinst
/installation-report.postinst
/libsasl2-2:mips.list
/libxml-libxml-perl.prerm
/libhtml-format-perl.list
/libaudit1:mips.postrm
/libgnutls-openssl27:mips.md5sums
/libsoftware-license-perl.md5sums
/libbz2-1.0:mips.list
/libisc95.postinst
/ibritish.preinst
/locales.conffiles
/libsemanage1:mips.md5sums
/libdiscover2.md5sums
/krb5-locales.md5sums
/time.list
/libaudit1:mips.md5sums
/libkrb5support0:mips.list
/pinentry-gtk2.prerm
/libusb-0.1-4:mips.postrm
/libprocps3:mips.postinst
/libpipeline1:mips.postrm
/libgdbm3:mips.md5sums
/rename.md5sums
/locales.templates
/bash-completion.preinst
/libgcrypt20:mips.shlibs
/libisl10:mips.shlibs
/bsdutils.list
/man-db.templates
/libxcb-shm0:mips.postrm
/libpsl0:mips.postrm
/linux-image-4kc-malta.md5sums
/libdatrie1:mips.shlibs
/libjbig0:mips.symbols
/python-pil:mips.prerm
/libxinerama1:mips.postinst
/gcc-4.8-base:mips.list
/linux-headers-3.16.0-4-common.md5sums
/libaudit1:mips.postinst
/libudev1:mips.list
/libpixman-1-0:mips.md5sums
/sysv-rc.prerm
/dbus.triggers
/libsub-exporter-perl.md5sums
/libkeyutils1:mips.shlibs
/libgtk2.0-bin.prerm
/libtirpc1:mips.postinst
/libkrb5support0:mips.md5sums
/binutils.shlibs
/libwebpmux1:mips.postinst
/python-support.md5sums
/libxrandr2:mips.symbols
/libpng12-0:mips.postrm
/libgomp1:mips.list
/cron.postinst
/systemd.list
/libapt-inst1.5:mips.list
/libksba8:mips.postrm
/libio-html-perl.list
/libglib2.0-0:mips.triggers
/libpangocairo-1.0-0:mips.list
/libsystemd0:mips.symbols
/libpaper1:mips.postinst
/util-linux-locales.prerm
/login.md5sums
/openssh-server.md5sums
/libp11-kit0:mips.postinst
/libnet-smtp-ssl-perl.list
/libpam-runtime.conffiles
/libldap-2.4-2:mips.shlibs
/shared-mime-info.triggers
/reportbug.list
/dpkg.postrm
/base-passwd.postrm
/discover.postinst
/libxi6:mips.list
/libgnutls-deb0-28:mips.postrm
/libc6:mips.prerm
/vim-tiny.md5sums
/debianutils.postrm
/apt-listchanges.prerm
/dbus.list
/libc6:mips.conffiles
/netbase.list
/libxapian22.postrm
/libselinux1:mips.postrm
/telnet.prerm
/libavahi-client3:mips.postrm
/python2.7-minimal.postinst
/libgcc1:mips.list
/libatk1.0-0:mips.md5sums
/isc-dhcp-common.md5sums
/libisc95.list
/debconf.list
/libpam-modules:mips.conffiles
/fontconfig.md5sums
/systemd-sysv.md5sums
/gnupg-agent.md5sums
/libtiff5:mips.list
/binutils.list
/xauth.list
/bsd-mailx.prerm
/libxdamage1:mips.postrm
/libwebpdemux1:mips.shlibs
/dash.preinst
/libdb5.3:mips.list
/pciutils.postinst
/gnupg-agent.list
/libxml2:mips.list
/shared-mime-info.list
/groff-base.list
/kmod.postinst
/libustr-1.0-1:mips.md5sums
/libpci3:mips.postinst
/apt-listchanges.conffiles
/fontconfig-config.list
/libpod-latex-perl.list
/dmsetup.list
/aptitude.postrm
/adduser.templates
/libfreetype6:mips.postrm
/xml-core.postrm
/cpio.postinst
/libnewt0.52:mips.postinst
/libgpgme11:mips.symbols
/fonts-dejavu-core.md5sums
/isc-dhcp-client.conffiles
/libcloog-isl4:mips.list
/libsepol1:mips.md5sums
/libgnutls-openssl27:mips.shlibs
/libgnutls-openssl27:mips.postinst
/libcryptsetup4:mips.md5sums
/libmailtools-perl.md5sums
/cpp.list
/libstdc++6:mips.postrm
/libpython2.7-dev:mips.list
/fontconfig-config.prerm
/cron.prerm
/libxtables10.list
/tzdata.list
/dpkg.list
/gcc.list
/libpsl0:mips.list
/libgtk2.0-0:mips.preinst
/python-pkg-resources.list
/install-info.list
/libcairo2:mips.postinst
/python-soappy.prerm
/libavahi-client3:mips.shlibs
/rsyslog.list
/libmount1:mips.md5sums
/whiptail.conffiles
/libxcb-render0:mips.postrm
/libgtk2.0-0:mips.postinst
/libswitch-perl.list
/libjasper1:mips.md5sums
/libbz2-1.0:mips.md5sums
/gpgv.list
/sysvinit-utils.md5sums
/klibc-utils.list
/libevent-2.0-5:mips.list
/aptitude-common.list
/login.preinst
/busybox.md5sums
/mount.postinst
/g++.list
/libnfsidmap2:mips.list
/libaudit-common.list
/python-debianbts.list
/debian-faq.md5sums
/systemd.triggers
/libpipeline1:mips.symbols
/tasksel.md5sums
/python-apt.prerm
/libblkid1:mips.md5sums
/dpkg.md5sums
/libklibc.md5sums
/libdiscover2.conffiles
/openssh-client.list
/linux-base.md5sums
/libbsd0:mips.postrm
/libpod-latex-perl.preinst
/netbase.postinst
/udev.conffiles
/python-pkg-resources.md5sums
/python-pygments.conffiles
/telnet.postinst
/w3m.postinst
/liburi-perl.list
/libk5crypto3:mips.postinst
/libhogweed2:mips.postinst
/python2.7.list
/libpam0g:mips.shlibs
/libxrandr2:mips.list
/doc-debian.md5sums
/libldap-2.4-2:mips.postinst
/libsigc++-2.0-0c2a:mips.shlibs
/libpipeline1:mips.md5sums
/libselinux1:mips.symbols
/libgcc-4.9-dev:mips.md5sums
/libxdamage1:mips.postinst
/isc-dhcp-client.list
/nano.list
/nano.prerm
/libcwidget3:mips.postrm
/libhtml-tree-perl.list
/liblogging-stdlog0:mips.postrm
/libk5crypto3:mips.shlibs
/dc.postrm
/libwrap0:mips.list
/xdg-user-dirs.conffiles
/libbind9-90.postrm
/libtinfo5:mips.shlibs
/libslang2:mips.postrm
/libattr1:mips.postrm
/libxcb-shm0:mips.md5sums
/libxdmcp6:mips.list
/sysv-rc.list
/libssh2-1:mips.symbols
/libpcre3:mips.md5sums
/libsemanage1:mips.postinst
/libxrandr2:mips.shlibs
/libstdc++6:mips.postinst
/hostname.list
/libsasl2-modules:mips.list
/libgdbm3:mips.postinst
/libpth20:mips.md5sums
/libreadline6:mips.md5sums
/libcgi-pm-perl.md5sums
/liblwres90.postrm
/ifupdown.postinst
/libdiscover2.postrm
/libpangocairo-1.0-0:mips.symbols
/libpci3:mips.postrm
/libxdmcp6:mips.postinst
/python-defusedxml.postinst
/file.list
/python-debianbts.md5sums
/dmsetup.md5sums
/libxrender1:mips.md5sums
/mutt.md5sums
/groff-base.md5sums
/libcups2:mips.symbols
/apt.prerm
/groff-base.conffiles

Network activity:

Establishes connection:

8.#.8.8:53
18#.###.25.169:12984

Sends data to the following servers:

18#.###.25.169:12984

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations