Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.DDoS.22

Added to the Dr.Web virus database: 2014-04-25

Virus description added:

A Trojan designed to carry out DDoS attacks. It is compatible with Linux distribution packages for ARM processors.

The command and control server can send the following replies:

00000000:  05 00 04 4E-75 6C 6C 25-00 04 48 74-74 70 12 19   Null% Http
00000010:  68 74 74 70-3A 2F 2F 68-75 69 78 2E-62 6F 6F 6B  http://huix.book
00000020:  33 33 34 34-2E 63 6F 6D-2F 28 14 30-F4 03 21 00  3344.com/(0Ї!
00000030:  04 53 65 6E-64 0A 03 74-63 70 12 10-31 38 33 2E  Send
tcp183.
00000040:  36 30 2E 31-30 36 2E 34-34 3A 38 30-18 14 20 F4  60.106.44:80 Ї
00000050:  03 05 00 04-4E 75 6C 6C-05 00 04 4E-75 6C 6C 05   Null Null
00000060:  00 04 4E 75-6C 6C 05 00-04 4E 75 6C-6C 05 00 04   Null Null 
00000070:  4E 75 6C 6C-05 00 04 4E-75 6C 6C 05-00 04 4E 75  Null Null Nu
00000080:  6C 6C 05 00-04 4E 75 6C-6C 05 00 04-4E 75 6C 6C  ll Null Null
00000090:  05 00 04 4E-75 6C 6C 05-00 04 4E 75-6C 6C 05 00   Null Null
000000A0:  04 4E 75 6C-6C 05 00 04-4E 75 6C 6C-05 00 04 4E  Null Null N
000005FA:  05 00 04 4E-75 6C 6C 24-00 04 48 74-74 70 12 18   Null$ Http
0000060A:  68 74 74 70-3A 2F 2F 67-61 6F 67 65-72 2E 69 61  http://gaoger.ia
0000061A:  72 72 79 2E-63 6F 6D 2F-28 14 30 F4-03 05 00 04  rry.com/(0Ї 
0000062A:  4E 75 6C 6C-24 00 04 48-74 74 70 12-18 68 74 74  Null$ Httphtt
0000063A:  70 3A 2F 2F-67 61 6F 67-65 72 2E 69-61 72 72 79  p://gaoger.iarry
0000064A:  2E 63 6F 6D-2F 28 14 30-F4 03 05 00-04 4E 75 6C  .com/(0Ї Nul
0000065A:  6C 05 00 04-4E 75 6C 6C-24 00 04 48-74 74 70 12  l Null$ Http
0000066A:  18 68 74 74-70 3A 2F 2F-67 61 6F 67-65 72 2E 69  http://gaoger.i
0000067A:  61 72 72 79-2E 63 6F 6D-2F 28 14 30-F4 03 05 00  arry.com/(0Ї
0000068A:  04 4E 75 6C-6C 05 00 04-4E 75 6C 6C-24 00 04 48  Null Null$ H
0000069A:  74 74 70 12-18 68 74 74-70 3A 2F 2F-67 61 6F 67  ttphttp://gaog
000006AA:  65 72 2E 69-61 72 72 79-2E 63 6F 6D-2F 28 14 30  er.iarry.com/(0
000006BA:  F4 03 05 00-04 4E 75 6C-6C 24 00 04-48 74 74 70  Ї Null$ Http
000006CA:  12 18 68 74-74 70 3A 2F-2F 67 61 6F-67 65 72 2E  http://gaoger.
000006DA:  69 61 72 72-79 2E 63 6F-6D 2F 28 14-30 F4 03 24  iarry.com/(0Ї$
000006EA:  00 04 48 74-74 70 12 18-68 74 74 70-3A 2F 2F 67   Httphttp://g
000006FA:  61 6F 67 65-72 2E 69 61-72 72 79 2E-63 6F 6D 2F  aoger.iarry.com/
0000070A:  28 14 30 F4-03 05 00 04-4E 75 6C 6C-05 00 04 4E  (0Ї Null N
0000071A:  75 6C 6C 05-00 04 4E 75-6C 6C 05 00-04 4E 75 6C  ull Null Nul
0000072A:  6C 05 00 04-4E 75 6C 6C-24 00 04 48-74 74 70 12  l Null$ Http
0000073A:  18 68 74 74-70 3A 2F 2F-67 61 6F 67-65 72 2E 69  http://gaoger.i
0000074A:  61 72 72 79-2E 63 6F 6D-2F 28 14 30-F4 03 05 00  arry.com/(0Ї
0000075A:  04 4E 75 6C-6C 24 00 04-48 74 74 70-12 18 68 74  Null$ Httpht
0000076A:  74 70 3A 2F-2F 67 61 6F-67 65 72 2E-69 61 72 72  tp://gaoger.iarr
0000077A:  79 2E 63 6F-6D 2F 28 14-30 F4 03 05-00 04 4E 75  y.com/(0Ї Nu
0000078A:  6C 6C 05 00-04 4E 75 6C-6C 05 00 04-4E 75 6C 6C  ll Null Null
0000079A:  05 00 04 4E-75 6C 6C 05-00 04 4E 75-6C 6C 25 00   Null Null%
000007AA:  04 48 74 74-70 12 19 68-74 74 70 3A-2F 2F 77 77  Httphttp://ww
000007BA:  77 2E 78 69-6E 72 65 6E-31 33 31 34-2E 63 6F 6D  w.xinren1314.com
000007CA:  28 14 30 F4-03 05 00 04-4E 75 6C 6C-25 00 04 48  (0Ї Null% H
000007DA:  74 74 70 12-19 68 74 74-70 3A 2F 2F-77 77 77 2E  ttphttp://www.
000007EA:  78 69 6E 72-65 6E 31 33-31 34 2E 63-6F 6D 28 1E  xinren1314.com(
000007FA:  30 F4 03 05-00 04 4E 75-6C 6C 24 00-04 48 74 74  0Ї Null$ Htt
0000080A:  70 12 18 68-74 74 70 3A-2F 2F 67 61-6F 67 65 72  phttp://gaoger
0000081A:  2E 69 61 72-72 79 2E 63-6F 6D 2F 28-14 30 F4 03  .iarry.com/(0Ї
0000082A:  05 00 04 4E-75 6C 6C 05-00 04 4E 75-6C 6C 05 00   Null Null
0000083A:  04 4E 75 6C-6C 20 00 04-53 65 6E 64-0A 03 74 63  Null  Send
tc
0000084A:  70 12 10 31-37 33 2E 31-39 33 2E 38-39 2E 38 39  p173.193.89.89

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2021

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124