Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.620

Added to the Dr.Web virus database: 2019-09-28

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Launches processes:
  • sh -c pkill -9 mips
  • pkill -9 mips
  • sh -c pkill -9 \"mips\"
  • sh -c killall -9 mips
  • sh -c killall -9 \"mips\"
  • sh -c pkill -9 mipsel
  • pkill -9 mipsel
  • sh -c pkill -9 \"mipsel\"
  • sh -c killall -9 mipsel
  • sh -c killall -9 \"mipsel\"
  • sh -c pkill -9 sh4
  • pkill -9 sh4
  • sh -c pkill -9 \"sh4\"
  • sh -c killall -9 sh4
  • sh -c killall -9 \"sh4\"
  • sh -c pkill -9 x86
  • pkill -9 x86
  • sh -c pkill -9 \"x86\"
  • sh -c killall -9 x86
  • sh -c killall -9 \"x86\"
  • sh -c pkill -9 i686
  • pkill -9 i686
  • sh -c pkill -9 \"i686\"
  • sh -c killall -9 i686
  • sh -c killall -9 \"i686\"
  • sh -c pkill -9 ppc
  • pkill -9 ppc
  • sh -c pkill -9 \"ppc\"
  • sh -c killall -9 ppc
  • sh -c killall -9 \"ppc\"
  • sh -c pkill -9 i586
  • pkill -9 i586
  • sh -c pkill -9 \"i586\"
  • sh -c killall -9 i586
  • sh -c killall -9 \"i586\"
  • sh -c pkill -9 arm
  • pkill -9 arm
  • sh -c pkill -9 \"arm\"
  • sh -c killall -9 arm
  • sh -c killall -9 \"arm\"
  • sh -c pkill -9 arm4
  • pkill -9 arm4
  • sh -c pkill -9 \"arm4\"
  • sh -c killall -9 arm4
  • sh -c killall -9 \"arm4\"
  • sh -c pkill -9 arm5
  • pkill -9 arm5
  • sh -c pkill -9 \"arm5\"
  • sh -c killall -9 arm5
  • sh -c killall -9 \"arm5\"
  • sh -c pkill -9 arm6
  • pkill -9 arm6
  • sh -c pkill -9 \"arm6\"
  • sh -c killall -9 arm6
  • sh -c killall -9 \"arm6\"
  • sh -c pkill -9 arm7
  • pkill -9 arm7
  • sh -c pkill -9 \"arm7\"
  • sh -c killall -9 arm7
  • sh -c killall -9 \"arm7\"
  • sh -c pkill -9 arc
  • pkill -9 arc
  • sh -c pkill -9 \"arc\"
  • sh -c killall -9 arc
  • sh -c killall -9 \"arc\"
  • sh -c pkill -9 spc
  • pkill -9 spc
  • sh -c pkill -9 \"spc\"
  • sh -c killall -9 spc
  • sh -c killall -9 \"spc\"
  • sh -c pkill -9 x86_64
  • pkill -9 x86_64
  • sh -c pkill -9 \"x86_64\"
  • sh -c killall -9 x86_64
  • sh -c killall -9 \"x86_64\"
  • sh -c pkill -9 x86_32
  • pkill -9 x86_32
  • sh -c pkill -9 \"x86_32\"
  • sh -c killall -9 x86_32
  • sh -c killall -9 \"x86_32\"
  • sh -c pkill -9 powerpc-440fp
  • pkill -9 powerpc-440fp
  • sh -c pkill -9 \"powerpc-440fp\"
  • sh -c killall -9 powerpc-440fp
  • sh -c killall -9 \"powerpc-440fp\"
  • sh -c pkill -9 powerpc
  • pkill -9 powerpc
  • sh -c pkill -9 \"powerpc\"
  • sh -c killall -9 powerpc
  • sh -c killall -9 \"powerpc\"
  • sh -c pkill -9 ntpd
  • pkill -9 ntpd
  • sh -c pkill -9 \"ntpd\"
  • sh -c killall -9 ntpd
  • sh -c killall -9 \"ntpd\"
  • sh -c pkill -9 sshd
  • pkill -9 sshd
  • sh -c pkill -9 \"sshd\"
  • sh -c killall -9 sshd
  • sh -c killall -9 \"sshd\"
  • sh -c pkill -9 openssh
  • pkill -9 openssh
  • sh -c pkill -9 \"openssh\"
  • sh -c killall -9 openssh
  • sh -c killall -9 \"openssh\"
  • sh -c pkill -9 bash
  • pkill -9 bash
  • sh -c pkill -9 \"bash\"
  • sh -c killall -9 bash
  • sh -c killall -9 \"bash\"
  • sh -c pkill -9 tftp
  • pkill -9 tftp
  • sh -c pkill -9 \"tftp\"
  • sh -c killall -9 tftp
  • sh -c killall -9 \"tftp\"
  • sh -c pkill -9 wget
  • pkill -9 wget
Attempts to kill system processes:
  • killall -9 sshd
Kills system processes:
  • sshd
Attempts to kill the following processes:
  • killall -9 mips
  • killall -9 mipsel
  • killall -9 sh4
  • killall -9 x86
  • killall -9 i686
  • killall -9 ppc
  • killall -9 i586
  • killall -9 arm
  • killall -9 arm4
  • killall -9 arm5
  • killall -9 arm6
  • killall -9 arm7
  • killall -9 arc
  • killall -9 spc
  • killall -9 x86_64
  • killall -9 x86_32
  • killall -9 powerpc-440fp
  • killall -9 powerpc
  • killall -9 ntpd
  • killall -9 openssh
  • killall -9 bash
  • killall -9 tftp
Kills the following processes:
  • systemd
  • bash
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • 10#.###.110.183:42065
Sends data to the following servers:
  • 10#.###.110.183:42065
Receives data from the following servers:
  • 10#.###.110.183:42065
Other:
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number