Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.378

Added to the Dr.Web virus database: 2018-01-13

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • mail
Launches processes:
  • /usr/bin/perl <SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates or modifies files:
  • /tmp/1515810938
  • /tmp/15158109381
  • /tmp/1515810949
  • /tmp/15158109491
Deletes files:
  • /tmp/1515810938"
  • /tmp/15158109381"
  • /tmp/1515810949"
  • /tmp/15158109491"
Network activity:
Establishes connection:
  • 18#.##6.208.157:80
  • 19#.##.81.163:80
  • <LOCAL_DNS_SERVER>
  • 67.###.183.105:80
HTTP GET requests:
  • 50.##.24.79/
  • ad###tise.com/
  • 19#.#42.70.4/
  • be###ce.net/
DNS ASK:
  • ad####dpromoan.com
  • se####ingonlyup.net
  • ad###tise.com
  • pr####upstudios.org
  • be##nce.net

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number