Defend what you create

Other Resources

Close

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.1610

Added to the Dr.Web virus database: 2019-04-20

Virus description added:

Technical Information

Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
  • ZIGRuxpxnp4mpmGZVxeEIEpupnY2eZmepGn4E2VnzD4EEM
Kills the following processes:
  • exim4
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • 95.###.228.205:63042
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
  • sw##vin.xyz
Sends data to the following servers:
  • 95.###.228.205:63042
  • 17#.##0.150.122:23
  • 12#.##2.117.176:23
  • 11#.##.132.18:23
  • 91.###.147.191:23
  • 11#.##2.120.138:23
  • 82.###.76.248:23
  • 13#.##.112.116:23
  • 32.###.179.76:23
  • 22#.##6.197.32:23
  • 49.###.10.176:23
  • 10#.##2.37.84:23
  • 90.##5.103.3:23
  • 69.##.158.112:23
  • 96.###.31.225:23
  • 11#.##3.3.104:23
  • 11#.##3.203.160:23
  • 20#.##2.176.144:23
  • 13#.##8.68.33:23
  • 91.##.151.83:23
  • 11#.##4.38.84:23
  • 10#.##.205.236:23
  • 20#.##1.178.33:23
  • 81.###.249.71:23
  • 21#.##.169.98:23
  • 18#.##0.135.19:23
  • 99.###.58.230:23
  • 59.##.76.216:23
  • 77.##.136.66:23
  • 10#.##.214.138:23
  • 18#.##8.98.27:23
  • 16#.##.58.208:23
  • 79.###.229.233:23
  • 78.##.143.173:23
  • 18#.##4.22.133:23
  • 53.###.110.253:23
  • 51.###.224.252:23
  • 16#.##6.149.179:23
  • 11#.##.15.233:23
  • 14#.##.242.171:23
  • 14#.##4.248.186:23
  • 84.##.6.118:23
  • 17.#.170.212:23
  • 12#.##8.64.113:23
  • 19#.##.147.34:23
  • 13#.##.216.52:23
  • 22#.##1.82.77:23
  • 69.##.244.8:23
  • 13.#.69.117:23
  • 15#.##8.16.146:23
  • 41.###.193.183:23
  • 76.###.60.104:23
  • 5.###.3.71:23
  • 17#.##.131.241:23
  • 16#.#4.41.26:23
  • 24.##4.15.70:23
  • 20#.##.219.215:23
  • 32.###.169.214:23
  • 12#.##8.198.103:23
  • 17.###.205.200:23
  • 12.##.135.174:23
  • 12#.##2.114.33:23
  • 95.###.50.237:23
  • 17#.##.105.159:23
  • 18.###.37.130:23
  • 39.###.112.177:23
  • 15#.##3.187.58:23
  • 89.##.30.225:23
  • 13#.##2.122.121:23
  • 16#.##.184.166:23
  • 40.##.165.66:23
  • 11#.##.188.212:23
  • 17#.##7.150.220:23
  • 14#.##8.36.161:23
  • 10#.##3.180.96:23
  • 13#.##.36.244:23
  • 21#.##4.17.89:23
  • 45.##.233.38:23
  • 35.###.184.93:23
  • 41.###.172.254:23
  • 20#.##6.71.84:23
  • 17.#.12.75:23
Receives data from the following servers:
  • 95.###.228.205:63042

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

The Russian developer of Dr.Web anti-viruses
Doctor Web has been developing anti-virus software since 1992
Dr.Web is trusted by users around the world in 200+ countries
The company has delivered an anti-virus as a service since 2007
24/7 tech support

Dr.Web © Doctor Web
2003 — 2020

Doctor Web is the Russian developer of Dr.Web anti-virus software. Dr.Web anti-virus software has been developed since 1992.

2-12А, 3rd street Yamskogo polya, Moscow, Russia, 125124