JavaScript support is required for our site to be fully operational in your browser.
Linux.Mirai.3582
Added to the Dr.Web virus database:
2019-11-05
Virus description added:
2019-11-05
Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Replaces the following system files:
Launches processes:
/bin/sh -c cd /bin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
cat tftp
cat <SAMPLE_FULL_PATH>
/bin/sh -c chmod 777 tftp
chmod 777 tftp
/bin/sh -c cd /bin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
cat rm
/bin/sh -c chmod 777 rm
chmod 777 rm
/bin/sh -c cd /bin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
cat kill
/bin/sh -c chmod 777 kill
chmod 777 kill
/bin/sh -c cd /bin/; cat cd > cd-cpy; cat <SAMPLE_FULL_PATH> > cd
cat cd
/bin/sh -c chmod 777 cd
chmod 777 cd
/bin/sh -c cd /bin/; cat wget > wget-cpy; cat <SAMPLE_FULL_PATH> > wget
cat wget
/bin/sh -c chmod 777 wget
chmod 777 wget
/bin/sh -c cd /sbin/; cat tftp > tftp-cpy; cat <SAMPLE_FULL_PATH> > tftp
/bin/sh -c cd /sbin/; cat rm > rm-cpy; cat <SAMPLE_FULL_PATH> > rm
/bin/sh -c cd /sbin/; cat kill > kill-cpy; cat <SAMPLE_FULL_PATH> > kill
/bin/sh -c cd /sbin/; cat cd > cd-cpy; cat <SAMPLE_FULL_PATH> > cd
/bin/sh -c cd /sbin/; cat wget > wget-cpy; cat <SAMPLE_FULL_PATH> > wget
Kills the following processes:
Performs operations with the file system:
Creates or modifies files:
/bin/tftp-cpy
/bin/tftp
/bin/rm-cpy
/bin/rm
/bin/kill-cpy
/bin/kill
/bin/cd-cpy
/bin/cd
/bin/wget-cpy
/sbin/tftp-cpy
/sbin/tftp
/sbin/rm-cpy
/sbin/rm
/sbin/kill-cpy
/sbin/kill
/sbin/cd-cpy
/sbin/cd
/sbin/wget-cpy
Network activity:
Establishes connection:
8.#.8.8:53
5.###.149.141:9090
25#.###.255.255:9090
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
Receives data from the following servers:
Other:
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK