Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.415

Added to the Dr.Web virus database: 2018-02-12

Virus description added:

Technical Information

Malicious functions:
Substitutes application name for:
  • orb-wallet
  • orb-start
  • orb-rpclist
  • orb-shutdown
  • orb-ext-ip
  • orb-ircseed
  • orb-net
  • orb-dnsseed
  • orb-opencon
  • orb-adrdump
  • orb-msghand
Performs operations with the file system:
Creates folders:
  • /root/.orbitcoin
  • /root/.orbitcoin/database
  • /root/.orbitcoin/blktree
  • /root/.orbitcoin/coins
  • /root/.orbitcoin/blocks
Creates or modifies files:
  • /root/.orbitcoin/debug.log
  • /root/.orbitcoin/.lock
  • /root/.orbitcoin/db.log
  • /root/.orbitcoin/blktree/LOG
  • /root/.orbitcoin/blktree/LOCK
  • /root/.orbitcoin/blktree/MANIFEST-000001
  • /root/.orbitcoin/blktree/000001.dbtmp
  • /root/.orbitcoin/blktree/000003.log
  • /root/.orbitcoin/blktree/MANIFEST-000002
  • /root/.orbitcoin/blktree/000002.dbtmp
  • /root/.orbitcoin/coins/LOG
  • /root/.orbitcoin/coins/LOCK
  • /root/.orbitcoin/coins/MANIFEST-000001
  • /root/.orbitcoin/coins/000001.dbtmp
  • /root/.orbitcoin/coins/000003.log
  • /root/.orbitcoin/coins/MANIFEST-000002
  • /root/.orbitcoin/coins/000002.dbtmp
  • /root/.orbitcoin/blocks/blk00000.dat
  • /root/.orbitcoin/database/log.0000000001
  • /root/.orbitcoin/__db.80000001.de529f6f
  • /root/.orbitcoin/wallet.dat
  • /root/.orbitcoin/peers.dat.4f7b
Deletes files:
  • /root/.orbitcoin/blktree/MANIFEST-000001"
  • /root/.orbitcoin/coins/MANIFEST-000001"
Network activity:
Awaits incoming connections on ports:
  • 0.0.0.0:15298
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 16#.##7.250.114:0
  • 18#.##.128.119:0
  • 10#.##1.164.223:0
  • [2#######8:1004::3ace:c493]:0
HTTP GET requests:
  • ch####p.dyndns.org/
DNS ASK:
  • se###.#hoenixcoin.org
  • or##eed0
  • se###.#hoenixcoin.org
  • or##eed1
Other:
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number