JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.514
Added to the Dr.Web virus database:
2018-04-05
Virus description added:
2018-04-05
Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Modifies firewall settings:
iptables -A INPUT -p tcp --destination-port 23 -j DROP
iptables -A INPUT -p tcp --destination-port 7547 -j DROP
iptables -A INPUT -p tcp --destination-port 5555 -j DROP
iptables -A INPUT -p tcp --destination-port 5358 -j DROP
iptables -D INPUT -j CWMP_CR
iptables -X CWMP_CR
iptables -I INPUT -p udp --dport 25522 -j ACCEPT
Launches processes:
sh -c iptables -A INPUT -p tcp --destination-port 23 -j DROP
sh -c iptables -A INPUT -p tcp --destination-port 7547 -j DROP
sh -c iptables -A INPUT -p tcp --destination-port 5555 -j DROP
sh -c iptables -A INPUT -p tcp --destination-port 5358 -j DROP
sh -c iptables -D INPUT -j CWMP_CR
sh -c iptables -X CWMP_CR
sh -c iptables -I INPUT -p udp --dport 25522 -j ACCEPT
Performs operations with the file system:
Creates folders:
Deletes folders:
<SAMPLE_FULL_PATH>"
/root/.p/.d"
Deletes files:
<SAMPLE_FULL_PATH>"
/tmp/ftpupdate.sh"
/tmp/ftpupload.sh"
Network activity:
Awaits incoming connections on ports:
Establishes connection:
8.#.8.8:53
<LOCAL_DNS_SERVER>
[:##]:25522
127.0.0.1:25522
DNS ASK:
po##.ntp.org
ro####.utorrent.com
ro####.bittorrent.com
Sends data to the following servers:
46.###.216.12:123
82.###.103.244:6881
67.###.246.10:6881
11#.###.77.190:16001
10#.##2.90.255:4128
92.###.122.61:6881
18.###.151.4:3282
18#.##.28.162:29316
49.##.231.104:22124
2.##.#1.124:43254
17#.###.188.198:6881
89.##.142.147:20180
10#.###.143.241:2187
18#.##.10.195:51110
5.###.152.182:15782
90.###.138.110:6884
92.##.183.220:6882
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK