JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.1107
Added to the Dr.Web virus database:
2018-10-06
Virus description added:
2018-10-06
Technical Information
Malicious functions:
Performs process tracing:
<SAMPLE>
<SAMPLE_FULL_PATH>
Launches processes:
/bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
<SAMPLE_FULL_PATH>
/bin/bash <SAMPLE_FULL_PATH> -c
cat /dev/urandom
tr -cd a-f0-9
head -c 32
touch /dev/shm/14509c5a53d266b3c4c6967a1197df43
chmod +x /dev/shm/14509c5a53d266b3c4c6967a1197df43
rm -rf /dev/shm/14509c5a53d266b3c4c6967a1197df43
whoami
head -n1
wget --dns-timeout 10 --user-agent=wget --connect-timeout 20 --read-timeout 30 -qO- http://ipinfo.io/ip
Kills the following processes:
<SAMPLE>
<SAMPLE_FULL_PATH>
Performs operations with the file system:
Modifies file access rights:
/dev/shm/14509c5a53d266b3c4c6967a1197df43
Creates or modifies files:
/dev/shm/14509c5a53d266b3c4c6967a1197df43
Deletes files:
/dev/shm/14509c5a53d266b3c4c6967a1197df43
Network activity:
Establishes connection:
<LOCAL_DNS_SERVER>
21#.#39.36.21:0
21#.#39.34.21:0
21#.#39.32.21:0
21#.#39.38.21:0
HTTP GET requests:
DNS ASK:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK