|
|
Linux.Nuxbee.140 Viruses Information
| Name: |
Linux.Nuxbee.140 |
| Category: |
Viruses |
| Description:
|
Details
Linux.Nuxbee.1403
This is a relatively harmless, non-memory resident parasitic Linux virus. It searches for ELF files in the directory bin, then writes itself to the middle of the file. The virus infects files if the current user has administrator rights. It writes itself to the Entry point offset, encrypts and saves original bytes at the end of a file.
Before infecting: After infecting:
旼컴컴컴컴컴컴컴� 旼컴컴컴컴컴컴컴�
� ELF Headers 냐커 � ELF Headers 냐커
� � � � � �
쳐컴컴컴컴컴컴컴� � 쳐컴컴컴컴컴컴컴� �
� Section 1 �<켸 Entry � Virus �<켸 Entry
� � point � � point
쳐컴컴컴컴컴컴컴� 쳐컴컴컴컴컴컴컴�
� Section 2 � � Section 2 �
쳐컴컴컴컴컴컴컴� 쳐컴컴컴컴컴컴컴�
. . . . . .
쳐컴컴컴컴컴컴컴� 쳐컴컴컴컴컴컴컴�
� Section n � � Section n �
읕컴컴컴컴컴컴컴� 쳐컴컴컴컴컴컴컴�
� EP data � Encrypted data
� �
읕컴컴컴컴컴컴컴�
To restore an original file, the virus reads and encrypts the original bytes from the host file. It uses file mapping functions to infect files. All system functions are summoned by INT 80h (Sys call). The virus contains the following text string:
NuxBee by Bumblebee - The NeXt Frontier |
Top Viruses Visited Pages:
Invader. - 234 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 65 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 59 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 47 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Mirror viruse
Win32.Positon.466
Exe-vb.52
Elite.19
Murphy.Digge
Error.62
I-Worm.Lovgate.a
Curse.40
I-Worm.Nyxe
Samara.153
|
|
