Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.DDoS.375

Added to the Dr.Web virus database: 2020-02-23

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Kills system processes:
  • sshd
Kills the following processes:
  • systemd
Network activity:
Awaits incoming connections on ports:
  • 0.0.0.0:8235
Establishes connection:
  • 8.#.8.8:53
  • 45.##.196.75:4860
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 45.##.196.75:4860
  • 18#.##3.116.61:23
  • 83.##.84.163:23
  • 8.##.98.55:23
  • 64.###.33.195:23
  • 6.###.237.184:23
  • 15#.##8.171.247:23
  • 18#.##0.174.149:23
  • 38.###.227.254:23
  • 21#.#0.89.90:23
  • 11#.##9.197.159:23
  • 99.###.223.146:23
  • 15#.#.64.64:23
  • 25.##.99.90:23
  • 22#.##4.170.152:23
  • 94.##.141.171:23
  • 19#.##5.129.34:23
  • 48.##.197.49:23
  • 67.###.147.172:23
  • 13#.##5.24.31:23
  • 94.##.193.76:23
  • 26.##0.76.59:23
  • 59.##.97.69:23
  • 67.###.197.165:23
  • 46.##8.61.23:23
  • 20#.##6.160.77:23
  • 21#.##.246.101:23
  • 13#.##.95.231:23
  • 10#.##0.25.105:23
  • 10#.##5.66.176:23
  • 23.##.9.175:23
  • 52.###.185.246:23
  • 16#.##1.226.49:23
  • 55.###.247.168:23
  • 42.##.9.231:23
  • 11#.##.137.127:23
  • 13#.##6.35.58:23
  • 14#.##2.155.129:23
  • 21#.##6.244.241:23
  • 16#.##1.147.212:23
  • 50.###.191.64:23
  • 86.###.161.229:23
  • 38.###.68.104:23
  • 20#.##.175.102:23
  • 14#.#3.60.41:23
  • 17#.#2.2.33:23
  • 54.###.49.202:23
  • 66.##3.46.67:23
  • 32.##.61.253:23
  • 90.###.102.204:23
  • 13#.#9.93.6:23
  • 12#.##2.190.182:23
  • 10#.##.41.109:23
  • 17#.##8.9.109:23
  • 14#.##1.37.223:23
  • 85.##.104.220:23
  • 33.###.250.38:23
  • 20#.##5.44.93:23
  • 11#.##2.40.17:23
Receives data from the following servers:
  • 45.##.196.75:4860

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number