用户服务中心

My library

+ Add to library

Search

24/7 Tech support | Rules regarding submitting

Send a message

Call us

+7 (495) 789-45-86

Forum

Your tickets

Total: -
Active: -
Latest: -

Call us

+7 (495) 789-45-86

CN

RU CN DE EN ES FR IT JP KZ UZ PL BY

Dr.Web vxCube

打开分析仪

计算机病毒事件调查

病毒知识库

技术

术语

教育培训

误区

有关反病毒软件的误区

Linux.MulDrop.27

Added to the Dr.Web virus database: 2018-01-30

Virus description added: 2018-01-30

Technical Information

Malicious functions:

Launches processes:

/bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
<SAMPLE_FULL_PATH>
/bin/bash <SAMPLE_FULL_PATH> -c
clear
rm -r matris
rm -r 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30
useradd -m -p 123 tardis
nscd -i passwd
nscd -i group

Performs operations with the file system:

Modifies file access rights:

/home/tardis
/home/tardis/.bashrc
/home/tardis/.bash_logout
/home/tardis/.profile
/etc/passwd+
/etc/shadow+
/etc/group+
/etc/gshadow+
/etc/subuid+
/etc/subgid+

Creates folders:

/home/tardis

Creates symlinks:

/etc/passwd.lock"
/etc/group.lock"
/etc/gshadow.lock"
/etc/subuid.lock"
/etc/subgid.lock"
/etc/shadow.lock"

Creates or modifies files:

/etc/.pwd.lock
/etc/passwd.713
/etc/group.713
/etc/gshadow.713
/etc/subuid.713
/etc/subgid.713
/etc/shadow.713
/var/log/faillog
/var/log/lastlog
/home/tardis/.bashrc
/home/tardis/.bash_logout
/home/tardis/.profile
/etc/passwd-
/etc/passwd+
/etc/shadow-
/etc/shadow+
/etc/group-
/etc/group+
/etc/gshadow-
/etc/gshadow+
/etc/subuid-
/etc/subuid+
/etc/subgid-
/etc/subgid+
/etc/hosts

Deletes files:

Other:

Collects RAM information

Curing recommendations

Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number