Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Packed.483

Added to the Dr.Web virus database: 2019-06-28

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Launches processes:
  • sh -c pkill -9 Josho.*
  • pkill -9 Josho.*
  • sh -c pkill -9 \"Josho.*\"
  • sh -c /bin/busybox kill -9 Josho.*
  • /bin/busybox kill -9 Josho.*
  • sh -c /bin/busybox kill -9 \"Josho.*\"
  • sh -c pkill -9 Owari.*
  • pkill -9 Owari.*
  • sh -c pkill -9 \"Owari.*\"
  • sh -c /bin/busybox kill -9 Owari.*
  • /bin/busybox kill -9 Owari.*
  • sh -c /bin/busybox kill -9 \"Owari.*\"
  • sh -c pkill -9 yakuza.*
  • pkill -9 yakuza.*
  • sh -c pkill -9 \"yakuza.*\"
  • sh -c /bin/busybox kill -9 yakuza.*
  • /bin/busybox kill -9 yakuza.*
  • sh -c /bin/busybox kill -9 \"yakuza.*\"
  • sh -c pkill -9 *.yakuza
  • pkill -9 *.yakuza
  • sh -c pkill -9 \"*.yakuza\"
  • sh -c /bin/busybox kill -9 *.yakuza
  • /bin/busybox kill -9 *.yakuza
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • 13#.###.162.161:1337
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 13#.###.162.161:1337
Receives data from the following servers:
  • 13#.###.162.161:1337
Other:
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number