Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.617

Added to the Dr.Web virus database: 2019-09-27

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Launches processes:
  • sh -c killall Netis >/dev/null 2>&1 & rm -rf *.x86* >/dev/null 2>&1 & killall *.x86* >/dev/null 2>&1 & rm -rf *.arc* >/dev/null 2>&1 & killall *.arc* >/dev/null 2>&1 & rm -rf *.arm* >/dev/null 2>&1 & killall *.arm* >/dev/null 2>&1 & rm -rf *.arm5* >/dev/null 2>&1 & killall *.arm5* >/dev/null 2>&1 & rm -rf *.arm6* >/dev/null 2>&1 & killall *.arm6* >/dev/null 2>&1 & rm -rf *.arm7* >/dev/null 2>&1 & killall *.arm7* >/dev/null 2>&1 & rm -rf *.m68k* >/dev/null 2>&1 & killall *.m68k* >/dev/null 2>&1 & rm -rf *.mips* >/dev/null 2>&1 & killall *.mips* >/dev/null 2>&1 & rm -rf *.mpsl* >/dev/null 2>&1 & killall *.mpsl* >/dev/null 2>&1 & rm -rf *.ppc* >/dev/null 2>&1 & killall *.ppc* >/dev/null 2>&1 & rm -rf *.sh4* >/dev/null 2>&1 & killall *.sh4* >/dev/null 2>&1 & rm -rf *.spc* >/dev/null 2>&1 & killall *.spc* >/dev/null 2>&1 & killall \" \" & killall \" \" >/dev/null 2>&1##[rkmodule] [<SAMPLE>][PPID:0x211] [<SAMPLE>][PID:0x213] do_filp_open. Filename: \"/bin/sh\
  • rm -rf *.x86*
  • rm -rf *.arm5*
  • rm -rf *.arc*
  • rm -rf *.arm6*
  • rm -rf *.arm7*
  • rm -rf *.m68k*
  • rm -rf *.arm*
  • rm -rf *.mips*
  • rm -rf *.mpsl*
  • rm -rf *.ppc*
  • rm -rf *.sh4*
  • rm -rf *.spc*
Attempts to kill the following processes:
  • killall *.arm5*
  • killall *.arm*
  • killall *.arc*
  • killall *.x86*
  • killall Netis
  • killall *.m68k*
  • killall *.arm6*
  • killall *.arm7*
  • killall *.mips*
  • killall *.mpsl*
  • killall *.sh4*
  • killall
  • killall *.spc*
  • killall *.ppc*
  • killall
Performs operations with the file system:
Deletes files:
  • /root/*.x86*
  • /root/*.arc*
  • /root/*.arm5*
  • /root/*.mpsl*
  • /root/*.spc*
  • /root/*.mips*
  • /root/*.sh4*
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:17386
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 18#.##9.221.118:80
DNS ASK:
  • dy##dns.cf
Sends data to the following servers:
  • 18#.##9.221.118:80
Receives data from the following servers:
  • 18#.##9.221.118:80

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number