Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.672

Added to the Dr.Web virus database: 2018-06-20

Virus description added:

Technical Information

Malicious functions:
Removes itself
Launches itself as a daemon
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:3902
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 95.###.62.169:5600
  • 17#.##.113.203:80
HTTP GET requests:
  • http://##.##0.138.221/
Sends data to the following servers:
  • 20#.#7.16.2:80
  • 10#.##3.54.94:80
  • 20#.##1.114.241:80
  • 64.###.115.225:80
  • 29.#.209.79:80
  • 45.##.87.112:80
  • 23#.##1.23.129:80
  • 11#.##5.181.35:80
  • 44.###.120.212:80
  • 15#.##.90.238:80
  • 13#.##7.241.25:80
  • 92.###.66.179:80
  • 41.###.221.22:80
  • 24#.##6.142.145:80
  • 11#.##9.236.150:80
  • 14#.##.146.89:80
  • 13.##.129.7:80
  • 37.##.208.153:80
  • 81.##.53.177:80
  • 3.###.223.97:80
  • 22#.##.176.47:80
  • 20#.##7.89.138:80
  • 11#.##2.17.149:80
  • 68.###.138.28:80
  • 10#.##.125.163:80
  • 16#.##6.40.58:80
  • 3.##.75.173:80
  • 17#.##.90.207:80
  • 13#.##.229.72:80
  • 40.###.118.119:80
  • 16#.##.154.147:80
  • 7.###.222.31:80
  • 20#.##1.143.88:80
  • 68.###.138.17:80
  • 69.##1.58.15:80
  • 48.###.214.163:80
  • 67.##.72.97:80
  • 30.###.203.159:80
  • 17.##4.110.4:80
  • 21#.##9.204.224:80
  • 78.###.231.99:80
  • 39.##6.5.2:80
  • 19#.##.95.245:80
  • 68.###.222.245:80
  • 12.###.34.227:80
  • 19#.##.228.177:80
  • 10#.##8.16.172:80
  • 96.###.51.103:80
  • 91.##6.9.95:80
  • 14#.#6.41.96:80
  • 30.#.212.229:80
  • 54.###.167.230:80
  • 17#.##8.204.235:80
  • 23#.##3.219.196:80
  • 2.###.222.185:80
  • 39.##.41.181:80
  • 24#.##6.155.58:80
  • 70.###.78.140:80
  • 45.###.254.163:80
  • 24#.#7.38.94:80
  • 17#.#5.180.3:80
  • 86.###.175.239:80
  • 16#.#7.230.5:80
  • 83.###.192.56:80
  • 34.##9.129.6:80
  • 13#.##.126.238:80
  • 24#.##0.254.31:80
  • 38.###.130.206:80
  • 65.##.116.190:80
  • 77.#.114.35:80
  • 10.##.124.34:80
  • 12#.##.134.91:80
  • 59.###.111.249:80
  • 81.##3.129.3:80
  • 26.##.67.41:80
  • 11#.##3.177.17:80
  • 22.###.211.204:80
  • 73.##.246.20:80
  • 14#.##3.41.77:80
  • 22#.##7.16.125:80
  • 14#.##8.4.228:80
  • 15#.#3.3.18:80
  • 44.###.118.85:80
  • 32.###.149.44:80
  • 13.##5.27.18:80
  • 75.##8.40.22:80
  • 18.##4.52.37:80
  • 16.##7.18.44:80
  • 20#.##9.65.155:80
  • 24#.##9.220.247:80
  • 96.##1.24.2:80
  • 11#.##8.186.97:80
  • 13#.##.225.154:80
  • 30.##.60.206:80
  • 12#.##5.130.185:80
  • 18.##.14.56:80
  • 17#.##0.130.77:80
  • 70.###.126.134:80
  • 86.##6.22.46:80
  • 21#.##6.211.136:80
  • 10#.##.79.232:80
  • 15#.##.182.200:80
  • 17#.##.113.203:80
  • 20#.##7.24.15:80
  • 15#.##4.128.195:80
  • 58.##.99.53:80
  • 13#.##7.75.37:80
  • 18.###.101.218:80
  • 20#.##.100.104:80
  • 19#.#24.5.38:80
  • 68.##.201.59:80
  • 23#.##.227.234:80
  • 17#.##9.68.40:80
  • 17#.##4.22.147:80
  • 23#.#.159.108:80
  • 23#.##.46.193:80
  • 19#.##4.205.231:80
  • 17#.##6.131.67:80
  • 94.###.171.115:80
  • 78.###.119.58:80
  • 59.###.212.57:80
  • 15#.##6.56.147:80
  • 95.###.253.116:80
  • 47.###.243.211:80
  • 56.###.96.221:80
  • 82.###.132.70:80
  • 22#.##7.153.182:80
  • 61.##.164.200:80
  • 22.##.205.4:80
  • 39.##.222.183:80
  • 63.##8.24.83:80
  • 61.##1.93.90:80
  • 18.###.209.126:80
  • 70.###.245.208:80
  • 11#.##7.22.202:80
  • 3.###.113.158:80
  • 10#.##.140.217:80
  • 11#.##2.235.58:80
  • 74.###.85.179:80
  • 52.#.66.238:80
  • 13#.##1.50.107:80
  • 91.#.156.44:80
  • 21#.##.125.58:80
  • 23#.##.67.125:80
  • 21#.##.234.79:80
  • 22#.##4.36.45:80
  • 16#.##1.137.49:80
  • 19#.##4.20.189:80
  • 10.###.231.122:80
  • 15#.##2.65.170:80
  • 22#.##6.205.104:80
  • 20#.##8.171.124:80
  • 13#.##.242.22:80
  • 15#.##0.242.167:80
  • 18#.##1.138.34:80
  • 82.###.154.105:80
  • 43.##.7.118:80
  • 14#.##1.139.192:80
  • 99.##.61.174:80

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number