JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.1501
Added to the Dr.Web virus database:
2019-03-08
Virus description added:
2019-03-08
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/samba
/etc/rc.local
Malicious functions:
Launches itself as a daemon
Launches processes:
<SAMPLE_FULL_PATH> postgresql-auto-update
/root/linux-gnu system-update
/bin/sh -c cd /tmp/seconfig/ && /bin/sh z.sh
/bin/sh z.sh
/bin/sh -c /tmp/seconfig/xorgg
/tmp/seconfig/xorgg
Performs operations with the file system:
Creates folders:
/tmp/seconfig
/etc/seconfig
Creates or modifies files:
/root/linux-gnu
<SAMPLE_FULL_PATH>
/tmp/seconfig//xorgg
/tmp/seconfig/xorgg
/tmp/seconfig/config.json
Deletes files:
/var/log/utmp
/var/log/wtmp
/var/log/lastlog
/var/log/secure
/root/linux-gnu
/tmp/seconfig/z.sh
Network activity:
Awaits incoming connections on ports:
127.0.0.1:47292
127.0.0.1:37373
Establishes connection:
10#.##3.83.23:27
<LOCAL_DNS_SERVER>
37.##.45.174:0
78.##.91.134:0
37.##.44.93:0
37.##.54.205:0
37.##7.154.79:0
17#.#.53.68:0
37.##.55.60:0
17#.#.53.68:7777
HTTP GET requests:
21#.###.114.75/iizxcv.sh
21#.###.##4.75/xorgg_linux_amd64
21#.##5.114.75/con
DNS ASK:
Sends data to the following servers:
Receives data from the following servers:
10#.##3.83.23:27
17#.#.53.68:7777
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK