Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Packed.1013

Added to the Dr.Web virus database: 2020-11-15

Virus description added:

Technical Information

Malicious functions:
Substitutes application name for:
  • /bin/busybox
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:61341
Establishes connection:
  • 23.###.165.119:1024
  • 8.#.8.8:53
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 23.###.165.119:1024
  • 39.##5.163.4:23
  • 20#.##2.129.28:23
  • 79.###.143.150:23
  • 22#.##.26.134:23
  • 18#.##7.187.248:23
  • 11#.##8.100.227:23
  • 15#.##.128.49:23
  • 11#.##7.215.89:23
  • 21#.##.133.59:23
  • 14#.##6.171.48:23
  • 12#.##9.4.221:23
  • 18#.##.136.25:23
  • 14#.##0.154.85:23
  • 72.##.37.13:23
  • 96.###.11.215:23
  • 30.###.72.143:23
  • 13.###.188.64:23
  • 35.###.224.52:23
  • 11#.##9.189.29:23
  • 85.##.231.13:23
  • 20#.##2.60.157:23
  • 11#.##3.194.27:23
  • 14#.##.107.36:23
  • 11#.##8.42.237:23
  • 20#.##0.76.105:23
  • 10#.##3.141.158:23
  • 15#.##9.56.40:23
  • 11#.##7.150.187:23
  • 20#.#12.3.24:23
  • 53.###.112.175:23
  • 20#.##2.200.195:23
  • 11#.##8.2.111:23
  • 21#.##.85.208:23
  • 51.###.73.131:23
  • 19#.#9.30.48:23
  • 11#.##0.129.156:23
  • 27.#.26.142:23
  • 16.###.199.19:23
  • 23#.##3.157.90:23
  • 27.#.7.138:23
  • 22#.##.223.231:23
  • 11#.##.116.139:23
  • 22.##.243.203:23
  • 71.##.42.251:23
  • 11#.##3.35.34:23
  • 10#.##8.175.137:23
  • 13.##9.173.6:23
  • 76.###.163.70:23
  • 45.###.169.43:23
  • 52.##.36.160:23
  • 83.##.206.79:23
  • 62.##.125.59:23
  • 17#.#39.4.85:23
  • 18#.##0.242.126:23
  • 27.#.129.54:23
  • 27.#.179.169:23
  • 56.##.226.198:23
  • 19#.##2.144.33:23
  • 22.##.108.90:23
  • 27.#.196.135:23
  • 60.###.179.219:23
  • 16#.##.233.140:23
  • 60.##3.14.93:23
  • 60.###.177.188:23
  • 12#.##.174.108:23
  • 11#.##8.65.248:23
  • 60.###.159.126:23
  • 24.##.135.237:23
  • 23#.##0.140.231:23
  • 52.##0.1.45:23
  • 11#.##9.82.198:23
  • 20#.##.111.178:23
  • 19#.#.129.172:23
  • 60.##3.51.8:23
  • 18#.##2.174.155:23
  • 18#.##1.118.253:23
  • 76.###.196.218:23
  • 27.#.228.148:23
  • 27.#.38.166:23
  • 17.##0.34.79:23
  • 11#.##8.238.37:23
  • 19#.##4.186.192:23
  • 43.###.168.158:23
  • 11#.#1.37.43:23
  • 15.###.16.134:23
  • 17#.##6.181.219:23
  • 22#.##2.168.93:23
  • 19#.##0.225.136:23
  • 70.##.52.0:23
  • 20#.##2.108.100:23
  • 18#.##5.208.143:23
  • 14#.#.7.163:23
  • 12#.##4.102.226:23
  • 20#.##2.26.217:23
  • 27.#.138.78:23
  • 27.#.77.107:23
  • 27.#.198.254:23
  • 16#.##1.130.228:23
  • 27.#.170.92:23
  • 60.###.199.107:23
  • 24#.##1.17.182:23
  • 60.###.117.205:23
  • 22.###.117.22:23
  • 46.###.205.43:23
  • 27.#.85.73:23
  • 27.#.145.5:23
  • 93.##.223.212:23
  • 88.###.230.59:23
  • 3.##.104.231:23
  • 11#.##8.101.194:23
  • 98.##.196.170:23
  • 18#.##2.245.186:23
  • 60.###.95.247:23
  • 20#.##2.252.112:23
  • 21#.##2.62.240:23
  • 15#.##.252.99:23
Receives data from the following servers:
  • 23.###.165.119:1024

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number