Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.1501

Added to the Dr.Web virus database: 2019-03-08

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/samba
  • /etc/rc.local
Malicious functions:
Launches itself as a daemon
Launches processes:
  • <SAMPLE_FULL_PATH> postgresql-auto-update
  • /root/linux-gnu system-update
  • /bin/sh -c cd /tmp/seconfig/ && /bin/sh z.sh
  • /bin/sh z.sh
  • /bin/sh -c /tmp/seconfig/xorgg
  • /tmp/seconfig/xorgg
Performs operations with the file system:
Creates folders:
  • /tmp/seconfig
  • /etc/seconfig
Creates or modifies files:
  • /root/linux-gnu
  • <SAMPLE_FULL_PATH>
  • /tmp/seconfig//xorgg
  • /tmp/seconfig/xorgg
  • /tmp/seconfig/config.json
Deletes files:
  • /var/log/utmp
  • /var/log/wtmp
  • /var/log/lastlog
  • /var/log/secure
  • /root/linux-gnu
  • /tmp/seconfig/z.sh
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:47292
  • 127.0.0.1:37373
Establishes connection:
  • 10#.##3.83.23:27
  • <LOCAL_DNS_SERVER>
  • 37.##.45.174:0
  • 78.##.91.134:0
  • 37.##.44.93:0
  • 37.##.54.205:0
  • 37.##7.154.79:0
  • 17#.#.53.68:0
  • 37.##.55.60:0
  • 17#.#.53.68:7777
HTTP GET requests:
  • 21#.###.114.75/iizxcv.sh
  • 21#.###.##4.75/xorgg_linux_amd64
  • 21#.##5.114.75/con
DNS ASK:
  • po##.#inexmr.com
Sends data to the following servers:
  • 17#.#.53.68:7777
Receives data from the following servers:
  • 10#.##3.83.23:27
  • 17#.#.53.68:7777
Other:
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number