Pour le fonctionnement correct du site, vous devez activer JavaScript dans votre navigateur.
Linux.BtcMine.35
Added to the Dr.Web virus database:
2017-11-15
Virus description added:
2017-11-15
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/acpidtd
/etc/init.d/wipefs
/etc/rc.d/rc*.d/S01wipefs
/etc/crontab
/etc/rc.d/rc*.d/S01acpidtd
Creates or modifies the following symlinks:
/etc/init.d/wipefs
/etc/rc0.d/S01wipefs
/etc/rc1.d/S01wipefs
/etc/rc2.d/S01wipefs
/etc/rc3.d/S01wipefs
/etc/rc4.d/S01wipefs
/etc/rc5.d/S01wipefs
/etc/rc6.d/S01wipefs
/etc/rc0.d/S01acpidtd
/etc/rc1.d/S01acpidtd
/etc/rc2.d/S01acpidtd
/etc/rc3.d/S01acpidtd
/etc/rc4.d/S01acpidtd
/etc/rc5.d/S01acpidtd
/etc/rc6.d/S01acpidtd
Malicious functions:
Launches itself as a daemon
Replaces the following system files:
Launches processes:
sh -c
sh -c /tmp/tmpnam_JMLPLa upgrade >/dev/null 2>&1; rm /tmp/tmpnam_JMLPLa >/dev/null 2>&1
cp -f <SAMPLE_FULL_PATH> /bin/wipefs
/tmp/tmpnam_JMLPLa upgrade
/bin/sh ##which ss 1>/dev/null 2>&1
which ss
/bin/sh ##which ss
ln -fs /bin/wipefs /etc/init.d/wipefs
ln -fs /etc/init.d/wipefs /etc/rc0.d/S01wipefs
/bin/sh ##which netstat 1>/dev/null 2>&1
ln -fs /etc/init.d/wipefs /etc/rc1.d/S01wipefs
which netstat
ln -fs /etc/init.d/wipefs /etc/rc2.d/S01wipefs
ln -fs /etc/init.d/wipefs /etc/rc3.d/S01wipefs
ln -fs /etc/init.d/wipefs /etc/rc4.d/S01wipefs
ln -fs /etc/init.d/wipefs /etc/rc5.d/S01wipefs
/bin/sh ##chattr -i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /bin/ss /bin/scss /bin/netstat /bin/scnetstat 1>/dev/null 2>&1
ln -fs /etc/init.d/wipefs /etc/rc6.d/S01wipefs
chattr -i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /bin/ss /bin/scss /bin/netstat /bin/scnetstat
ln -fs /etc/init.d/wipefs /etc/rc.d/rc0.d/S01wipefs
ln -fs /etc/init.d/wipefs /etc/rc.d/rc1.d/S01wipefs
/bin/sh ##cp -f /tmp/tmpnam_JMLPLa /bin/ddus-uidge
ln -fs /etc/init.d/wipefs /etc/rc.d/rc2.d/S01wipefs
cp -f /tmp/tmpnam_JMLPLa /bin/ddus-uidgen
ln -fs /etc/init.d/wipefs /etc/rc.d/rc3.d/S01wipefs
ln -fs /etc/init.d/wipefs /etc/rc.d/rc4.d/S01wipefs
cp -f /bin/ddus-uidgen /etc/init.d/acpidtd
ln -fs /etc/init.d/wipefs /etc/rc.d/rc5.d/S01wipefs
/bin/sh ##chmod +x /bin/scss 1>/dev/null 2>&1;
chmod +x /bin/scss
ln -fs /etc/init.d/acpidtd /etc/rc0.d/S01acpidtd
ln -fs /etc/init.d/wipefs /etc/rc.d/rc6.d/S01wipefs
##cp -f /tmp/tmpnam_JMLPLa /bin/ss 1>/dev/null 2>&1;touch -r /bin/sh /bin/ss /bin/scss 1>/dev/null 2>&1;
ln -fs /etc/init.d/acpidtd /etc/rc1.d/S01acpidtd
touch -r /bin/sh /bin/wipefs /etc/init.d/wipefs /etc/rc.d/rc*.d/S01wipefs
ln -fs /etc/init.d/acpidtd /etc/rc2.d/S01acpidtd
cp -f /tmp/tmpnam_JMLPLa /bin/ss
ln -fs /etc/init.d/acpidtd /etc/rc3.d/S01acpidtd
sh -c cat /etc/crontab
ln -fs /etc/init.d/acpidtd /etc/rc4.d/S01acpidtd
cat /etc/crontab
ln -fs /etc/init.d/acpidtd /etc/rc5.d/S01acpidtd
sh -c echo '0 */6 * * * root /bin/wipefs' >> /etc/crontab
touch -r /bin/sh /bin/ss /bin/scss
ln -fs /etc/init.d/acpidtd /etc/rc6.d/S01acpidtd
sh -c sysctl -w vm.nr_hugepages=128 >/dev/null 2>&1
ln -fs /etc/init.d/acpidtd /etc/rc.d/rc0.d/S01acpidtd
sysctl -w vm.nr_hugepages=128
ln -fs /etc/init.d/acpidtd /etc/rc.d/rc1.d/S01acpidtd
sh -c sysctl -p >/dev/null 2>&1
ln -fs /etc/init.d/acpidtd /etc/rc.d/rc2.d/S01acpidtd
sysctl -p
ln -fs /etc/init.d/acpidtd /etc/rc.d/rc3.d/S01acpidtd
ln -fs /etc/init.d/acpidtd /etc/rc.d/rc4.d/S01acpidtd
ln -fs /etc/init.d/acpidtd /etc/rc.d/rc5.d/S01acpidtd
ln -fs /etc/init.d/acpidtd /etc/rc.d/rc6.d/S01acpidtd
/bin/sh ##chattr +i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /bin/ss /bin/scss /bin/netstat /bin/scnetstat 1>/dev/null 2>&1
touch -r /bin/sh /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd
chattr +i /bin/ddus-uidgen /etc/init.d/acpidtd /etc/rc.d/rc*.d/S01acpidtd /bin/ss /bin/scss /bin/netstat /bin/scnetstat
/bin/sh ##chmod +x /bin/scnetstat 1>/dev/null 2>&1;
sh -c (touch /tmp/tmplog; chmod 666 /tmp/tmplog) >/dev/null 2>&1
chmod +x /bin/scnetstat
touch /tmp/tmplog
##cp -f /tmp/tmpnam_JMLPLa /bin/netstat 1>/dev/null 2>&1;touch -r /bin/sh /bin/netstat /bin/scnetstat 1>/dev/null 2>&1;
chmod 666 /tmp/tmplog
cp -f /tmp/tmpnam_JMLPLa /bin/netstat
touch -r /bin/sh /bin/netstat /bin/scnetstat
rm /tmp/tmpnam_JMLPLa
Performs operations with the file system:
Modifies file access rights:
/tmp/tmpnam_JMLPLa
/bin/scss
/bin/scnetstat
/tmp/tmplog
Creates or modifies files:
/etc/resolv.conf
/tmp/tmpnam_JMLPLa
/bin/wipefs
/bin/ddus-uidgen
/bin/scss
/proc/sys/vm/nr_hugepages
/bin/scnetstat
/tmp/tmplog
Deletes files:
Network activity:
Establishes connection:
16#.##.30.212:8525
21#.##9.13.124:443
11#.##.33.59:1488
58.##.32.135:4545
DNS ASK:
Sends data to the following servers:
Receives data from the following servers:
Recommandations pour le traitement
Linux
Version démo gratuite
Pour 1 mois (sans enregistrement) ou 3 mois (avec enregistrement et remise pour le renouvellement)
Téléchargez Dr.Web pour Android
Gratuit pour 3 mois
Tous les composants de protection
Renouvellement de la démo via AppGallery/Google Pay
Nous utilisons des cookies sur notre site web à des fins uniques d’analyse de la fréquentation et de récolte de données statistiques. En naviguant sur notre site, vous pouvez accepter ou refuser l’utilisation de ces fichiers cookies.
En savoir plus : Politique de confidentialité
Accepter
Refuser