Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.1604

Added to the Dr.Web virus database: 2019-04-18

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/netdns
  • /etc/init.d/.depend.boot
  • /etc/init.d/.depend.start
  • /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
  • /etc/rc0.d/K01netdns
  • /etc/rc1.d/K01netdns
  • /etc/rc2.d/S01netdns
  • /etc/rc3.d/S01netdns
  • /etc/rc4.d/S01netdns
  • /etc/rc5.d/S01netdns
  • /etc/rc6.d/K01netdns
Malicious functions:
Launches itself as a daemon
Manages services:
  • systemctl enable netdns
  • /usr/sbin/update-rc.d netdns defaults
  • systemctl daemon-reload
Launches processes:
  • <SAMPLE_FULL_PATH> [kerberods]
  • /bin/bash -c chattr -i /usr/lib/systemd/system/netdns.service
  • chattr -i /usr/lib/systemd/system/netdns.service
  • /bin/bash -c chkconfig --add netdns
  • /bin/bash -c systemctl enable netdns
  • /sbin/insserv netdns
Performs operations with the file system:
Creates or modifies files:
  • /tmp/.X11unix
  • /usr/sbin/kerberods
  • /usr/lib/systemd/system/netdns.service
Locks files:
  • /tmp/.X11unix
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • [2########::f03c:91ff:fe70:2b9d]:9
  • 17#.#8.123.25:9
  • 19#.##8.205.99:6379
  • 19#.##8.205.0:6379
  • <LOCAL_GATE>:6379
  • 19#.##8.205.2:6379
  • 19#.##8.205.3:6379
  • 19#.##8.205.4:6379
  • 19#.##8.205.5:6379
  • 19#.##8.205.6:6379
  • 19#.##8.205.7:6379
  • 19#.##8.205.8:6379
  • 19#.##8.205.9:6379
  • <LOCAL_GATE>0:6379
  • <LOCAL_GATE>1:6379
  • <LOCAL_GATE>2:6379
  • <LOCAL_GATE>3:6379
  • <LOCAL_GATE>4:6379
  • <LOCAL_GATE>5:6379
  • <LOCAL_GATE>6:6379
  • <LOCAL_GATE>8:6379
  • <LOCAL_GATE>9:6379
  • 19#.##8.205.20:6379
  • 19#.##8.205.21:6379
  • 19#.##8.205.22:6379
  • 19#.##8.205.23:6379
  • 19#.##8.205.24:6379
  • 19#.##8.205.25:6379
  • 19#.##8.205.26:6379
  • 19#.##8.205.27:6379
  • 19#.##8.205.28:6379
  • 19#.##8.205.29:6379
  • 19#.##8.205.30:6379
  • 19#.##8.205.31:6379
  • 19#.##8.205.32:6379
  • 19#.##8.205.33:6379
  • 19#.##8.205.34:6379
  • 19#.##8.205.35:6379
  • 19#.##8.205.36:6379
  • 19#.##8.205.37:6379
  • 19#.##8.205.38:6379
  • 19#.##8.205.39:6379
  • 19#.##8.205.41:6379
  • 19#.##8.205.42:6379
  • 19#.##8.205.43:6379
  • 19#.##8.205.44:6379
  • 19#.##8.205.45:6379
  • 19#.##8.205.46:6379
  • 19#.##8.205.47:6379
  • 19#.##8.205.48:6379
  • 19#.##8.205.49:6379
  • 19#.##8.205.50:6379
  • 19#.##8.205.51:6379
  • 19#.##8.205.52:6379
  • 19#.##8.205.53:6379
  • 19#.##8.205.54:6379
  • 19#.##8.205.55:6379
  • 19#.##8.205.56:6379
  • 19#.##8.205.57:6379
  • 19#.##8.205.58:6379
  • 19#.##8.205.59:6379
  • 19#.##8.205.60:6379
  • 19#.##8.205.61:6379
  • 19#.##8.205.62:6379
  • 19#.##8.205.63:6379
  • 19#.##8.205.64:6379
  • 19#.##8.205.65:6379
  • 19#.##8.205.66:6379
  • 19#.##8.205.67:6379
  • 19#.##8.205.68:6379
  • 19#.##8.205.69:6379
  • 19#.##8.205.70:6379
  • 19#.##8.205.71:6379
  • 19#.##8.205.72:6379
  • 19#.##8.205.73:6379
  • 19#.##8.205.74:6379
  • 19#.##8.205.75:6379
  • 19#.##8.205.76:6379
  • 19#.##8.205.77:6379
  • 19#.##8.205.78:6379
  • 19#.##8.205.79:6379
  • 19#.##8.205.80:6379
  • 19#.##8.205.81:6379
  • 19#.##8.205.82:6379
  • 19#.##8.205.83:6379
  • 19#.##8.205.84:6379
  • 19#.##8.205.85:6379
  • 19#.##8.205.86:6379
  • 19#.##8.205.87:6379
  • 19#.##8.205.88:6379
  • 19#.##8.205.89:6379
  • 19#.##8.205.90:6379
  • 19#.##8.205.91:6379
  • 19#.##8.205.92:6379
  • 19#.##8.205.93:6379
  • 19#.##8.205.94:6379
  • 19#.##8.205.95:6379
  • 19#.##8.205.96:6379
  • 19#.##8.205.97:6379
  • 19#.##8.205.98:6379
  • <LOCAL_GATE>7:6379
  • 19#.##8.205.40:6379
  • <LOCAL_GATE>00:6379
  • <LOCAL_GATE>01:6379
  • <LOCAL_GATE>02:6379
  • <LOCAL_GATE>03:6379
  • <LOCAL_GATE>04:6379
  • <LOCAL_GATE>05:6379
  • <LOCAL_GATE>06:6379
  • <LOCAL_GATE>07:6379
  • <LOCAL_GATE>08:6379
  • <LOCAL_GATE>09:6379
  • <LOCAL_GATE>10:6379
  • <LOCAL_GATE>11:6379
  • <LOCAL_GATE>12:6379
  • <LOCAL_GATE>13:6379
  • <LOCAL_GATE>14:6379
  • <LOCAL_GATE>15:6379
  • <LOCAL_GATE>16:6379
  • <LOCAL_GATE>17:6379
  • <LOCAL_GATE>18:6379
  • <LOCAL_GATE>19:6379
  • <LOCAL_GATE>20:6379
  • <LOCAL_GATE>21:6379
  • <LOCAL_GATE>22:6379
  • <LOCAL_GATE>23:6379
  • <LOCAL_GATE>24:6379
  • <LOCAL_GATE>26:6379
  • <LOCAL_GATE>27:6379
  • <LOCAL_GATE>28:6379
  • <LOCAL_GATE>25:6379
  • <LOCAL_GATE>29:6379
  • <LOCAL_GATE>30:6379
  • <LOCAL_GATE>31:6379
  • <LOCAL_GATE>32:6379
  • <LOCAL_GATE>33:6379
  • <LOCAL_GATE>34:6379
  • <LOCAL_GATE>35:6379
  • <LOCAL_GATE>36:6379
  • <LOCAL_GATE>37:6379
  • <LOCAL_GATE>38:6379
  • <LOCAL_GATE>39:6379
  • <LOCAL_GATE>40:6379
  • <LOCAL_GATE>41:6379
  • <LOCAL_GATE>42:6379
  • <LOCAL_GATE>43:6379
  • <LOCAL_GATE>44:6379
  • <LOCAL_GATE>45:6379
  • <LOCAL_GATE>46:6379
  • <LOCAL_GATE>47:6379
  • <LOCAL_GATE>48:6379
  • <LOCAL_GATE>49:6379
  • <LOCAL_GATE>50:6379
  • <LOCAL_GATE>51:6379
  • <LOCAL_GATE>52:6379
  • <LOCAL_GATE>53:6379
  • <LOCAL_GATE>54:6379
  • <LOCAL_GATE>55:6379
  • <LOCAL_GATE>56:6379
  • <LOCAL_GATE>57:6379
  • <LOCAL_GATE>58:6379
  • <LOCAL_GATE>59:6379
  • <LOCAL_GATE>60:6379
  • <LOCAL_GATE>61:6379
  • <LOCAL_GATE>62:6379
  • <LOCAL_GATE>64:6379
  • <LOCAL_GATE>63:6379
  • <LOCAL_GATE>65:6379
  • <LOCAL_GATE>67:6379
  • <LOCAL_GATE>68:6379
  • <LOCAL_GATE>69:6379
  • <LOCAL_GATE>70:6379
  • <LOCAL_GATE>66:6379
  • <LOCAL_GATE>71:6379
  • <LOCAL_GATE>72:6379
  • <LOCAL_GATE>73:6379
  • <LOCAL_GATE>74:6379
  • <LOCAL_GATE>75:6379
  • <LOCAL_GATE>76:6379
  • <LOCAL_GATE>77:6379
  • <LOCAL_GATE>78:6379
  • <LOCAL_GATE>79:6379
  • <LOCAL_GATE>80:6379
  • <LOCAL_GATE>81:6379
  • <LOCAL_GATE>82:6379
  • <LOCAL_GATE>83:6379
  • <LOCAL_GATE>85:6379
  • <LOCAL_GATE>86:6379
  • <LOCAL_GATE>87:6379
  • <LOCAL_GATE>88:6379
  • <LOCAL_GATE>89:6379
  • <LOCAL_GATE>90:6379
  • <LOCAL_GATE>84:6379
  • <LOCAL_GATE>91:6379
  • <LOCAL_GATE>92:6379
  • <LOCAL_GATE>93:6379
  • <LOCAL_GATE>94:6379
  • <LOCAL_GATE>95:6379
  • <LOCAL_GATE>96:6379
  • <LOCAL_GATE>98:6379
  • <LOCAL_GATE>99:6379
  • <LOCAL_GATE>97:6379
  • 19#.###.205.200:6379
  • 19#.###.205.201:6379
  • 19#.###.205.202:6379
  • 19#.###.205.203:6379
  • 19#.###.205.204:6379
  • 19#.###.205.205:6379
  • 19#.###.205.206:6379
  • 19#.###.205.207:6379
  • 19#.###.205.208:6379
  • 19#.###.205.209:6379
  • 19#.###.205.210:6379
  • 19#.###.205.211:6379
  • 19#.###.205.212:6379
  • 19#.###.205.214:6379
  • 19#.###.205.213:6379
  • 19#.###.205.215:6379
  • 19#.###.205.216:6379
  • 19#.###.205.217:6379
  • 19#.###.205.218:6379
  • 19#.###.205.219:6379
  • 19#.###.205.220:6379
  • 19#.###.205.221:6379
  • 19#.###.205.222:6379
  • 19#.###.205.223:6379
  • 19#.###.205.224:6379
  • 19#.###.205.225:6379
  • 19#.###.205.226:6379
  • 19#.###.205.227:6379
  • 19#.###.205.229:6379
  • 19#.###.205.230:6379
  • 19#.###.205.232:6379
  • 19#.###.205.233:6379
  • 19#.###.205.228:6379
  • 19#.###.205.231:6379
  • 19#.###.205.234:6379
  • 19#.###.205.235:6379
  • 19#.###.205.246:6379
  • 19#.###.205.236:6379
  • 19#.###.205.237:6379
  • 19#.###.205.238:6379
  • 19#.###.205.239:6379
  • 19#.###.205.240:6379
  • 19#.###.205.242:6379
  • 19#.###.205.243:6379
  • 19#.###.205.244:6379
  • 19#.###.205.245:6379
  • 19#.###.205.241:6379
  • 19#.###.205.247:6379
  • 19#.###.205.248:6379
  • 19#.###.205.249:6379
  • 19#.###.205.250:6379
  • 19#.###.205.251:6379
  • 19#.###.205.252:6379
  • 19#.###.205.254:6379
  • 19#.###.205.255:6379
  • 95.##1.0.1:6379
  • 95.##1.0.2:6379
  • 95.##1.0.3:6379
  • 95.##1.0.4:6379
  • 95.##1.0.5:6379
  • 95.##1.0.6:6379
  • 95.##1.0.7:6379
  • 95.##1.0.8:6379
  • 95.##1.0.9:6379
  • 19#.###.205.253:6379
  • 95.##1.0.0:6379
  • 95.###.0.10:6379
  • 95.###.0.11:6379
  • 95.###.0.12:6379
  • 95.###.0.14:6379
  • 95.###.0.15:6379
  • 95.###.0.16:6379
  • 95.###.0.17:6379
  • 95.###.0.18:6379
  • 95.###.0.19:6379
  • 95.###.0.20:6379
  • 95.###.0.21:6379
  • 95.###.0.23:6379
  • 95.###.0.25:6379
  • 95.###.0.26:6379
  • 95.###.0.27:6379
  • 95.###.0.28:6379
  • 95.###.0.29:6379
  • 95.###.0.30:6379
  • 95.###.0.13:6379
  • 95.###.0.22:6379
  • 95.###.0.24:6379
  • 95.###.0.31:6379
  • 95.###.0.32:6379
  • 95.###.0.34:6379
  • 95.###.0.35:6379
  • 95.###.0.37:6379
  • 95.###.0.38:6379
HTTP GET requests:
  • id##t.me/
DNS ASK:
  • id##t.me
Other:
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2020

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124