JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.504
Added to the Dr.Web virus database:
2018-03-30
Virus description added:
2018-03-30
Technical Information
Malicious functions:
Launches processes:
<SAMPLE_FULL_PATH>
sh -c LC_ALL=C LANG=C /sbin/ldconfig -p 2>/dev/null
/sbin/ldconfig -p
/sbin/ldconfig.real -p
Performs operations with the file system:
Modifies file access rights:
/tmp/_MEISUZnIQ/Crypto.Cipher._AES.so
/tmp/_MEISUZnIQ/_codecs_cn.so
/tmp/_MEISUZnIQ/_codecs_hk.so
/tmp/_MEISUZnIQ/_codecs_iso2022.so
/tmp/_MEISUZnIQ/_codecs_jp.so
/tmp/_MEISUZnIQ/_codecs_kr.so
/tmp/_MEISUZnIQ/_codecs_tw.so
/tmp/_MEISUZnIQ/_ctypes.so
/tmp/_MEISUZnIQ/_hashlib.so
/tmp/_MEISUZnIQ/_json.so
/tmp/_MEISUZnIQ/_multibytecodec.so
/tmp/_MEISUZnIQ/_ssl.so
/tmp/_MEISUZnIQ/bz2.so
/tmp/_MEISUZnIQ/libbz2.so.1.0
/tmp/_MEISUZnIQ/libcrypto.so.1.0.0
/tmp/_MEISUZnIQ/libffi.so.6
/tmp/_MEISUZnIQ/libpython2.7.so.1.0
/tmp/_MEISUZnIQ/libreadline.so.6
/tmp/_MEISUZnIQ/libssl.so.1.0.0
/tmp/_MEISUZnIQ/libtinfo.so.5
/tmp/_MEISUZnIQ/libz.so.1
/tmp/_MEISUZnIQ/readline.so
/tmp/_MEISUZnIQ/resource.so
/tmp/_MEISUZnIQ/termios.so
/tmp/_MEISUZnIQ/requests/cacert.pem
Creates folders:
/tmp/_MEISUZnIQ
/tmp/_MEISUZnIQ/requests
Deletes folders:
/tmp/_MEISUZnIQ/requests"
/tmp/_MEISUZnIQ"
Creates or modifies files:
/tmp/_MEISUZnIQ/Crypto.Cipher._AES.so
/tmp/_MEISUZnIQ/_codecs_cn.so
/tmp/_MEISUZnIQ/_codecs_hk.so
/tmp/_MEISUZnIQ/_codecs_iso2022.so
/tmp/_MEISUZnIQ/_codecs_jp.so
/tmp/_MEISUZnIQ/_codecs_kr.so
/tmp/_MEISUZnIQ/_codecs_tw.so
/tmp/_MEISUZnIQ/_ctypes.so
/tmp/_MEISUZnIQ/_hashlib.so
/tmp/_MEISUZnIQ/_json.so
/tmp/_MEISUZnIQ/_multibytecodec.so
/tmp/_MEISUZnIQ/_ssl.so
/tmp/_MEISUZnIQ/bz2.so
/tmp/_MEISUZnIQ/libbz2.so.1.0
/tmp/_MEISUZnIQ/libcrypto.so.1.0.0
/tmp/_MEISUZnIQ/libffi.so.6
/tmp/_MEISUZnIQ/libpython2.7.so.1.0
/tmp/_MEISUZnIQ/libreadline.so.6
/tmp/_MEISUZnIQ/libssl.so.1.0.0
/tmp/_MEISUZnIQ/libtinfo.so.5
/tmp/_MEISUZnIQ/libz.so.1
/tmp/_MEISUZnIQ/readline.so
/tmp/_MEISUZnIQ/resource.so
/tmp/_MEISUZnIQ/termios.so
/tmp/_MEISUZnIQ/requests/cacert.pem
Deletes files:
/tmp/_MEISUZnIQ/_codecs_cn.so"
/tmp/_MEISUZnIQ/libpython2.7.so.1.0"
/tmp/_MEISUZnIQ/_codecs_tw.so"
/tmp/_MEISUZnIQ/libssl.so.1.0.0"
/tmp/_MEISUZnIQ/libffi.so.6"
/tmp/_MEISUZnIQ/_json.so"
/tmp/_MEISUZnIQ/_codecs_kr.so"
/tmp/_MEISUZnIQ/bz2.so"
/tmp/_MEISUZnIQ/Crypto.Cipher._AES.so"
/tmp/_MEISUZnIQ/_ssl.so"
/tmp/_MEISUZnIQ/libtinfo.so.5"
/tmp/_MEISUZnIQ/resource.so"
/tmp/_MEISUZnIQ/libcrypto.so.1.0.0"
/tmp/_MEISUZnIQ/requests/cacert.pem"
/tmp/_MEISUZnIQ/_codecs_jp.so"
/tmp/_MEISUZnIQ/_codecs_hk.so"
/tmp/_MEISUZnIQ/_multibytecodec.so"
/tmp/_MEISUZnIQ/readline.so"
/tmp/_MEISUZnIQ/_ctypes.so"
/tmp/_MEISUZnIQ/termios.so"
/tmp/_MEISUZnIQ/libbz2.so.1.0"
/tmp/_MEISUZnIQ/_codecs_iso2022.so"
/tmp/_MEISUZnIQ/_hashlib.so"
/tmp/_MEISUZnIQ/libz.so.1"
/tmp/_MEISUZnIQ/libreadline.so.6"
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK