JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.1669
Added to the Dr.Web virus database:
2019-05-08
Virus description added:
2019-05-08
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
Malicious functions:
Launches processes:
sh -c readlink /proc/*/cmdline
/bin/sh -c pkill python
pkill python
readlink /proc/1/cmdline /proc/10/cmdline /proc/11/cmdline /proc/12/cmdline /proc/120/cmdline /proc/129/cmdline /proc/13/cmdline /proc/133/cmdline /proc/134/cmdline /proc/14/cmdline /proc/15/cmdline /proc/152/cmdline /proc/16/cmdline /proc/17/cmdline /proc/18/cmdline /proc/19/cmdline /proc/2/cmdline /proc/20/cmdline /proc/25/cmdline /proc/26/cmdline /proc/27/cmdline /proc/28/cmdline /proc/29/cmdline /proc/3/cmdline /proc/353/cmdline /proc/376/cmdline /proc/385/cmdline /proc/390/cmdline /proc/393/cmdline /proc/4/cmdline /proc/400/cmdline /proc/401/cmdline /proc/402/cmdline /proc/403/cmdline /proc/405/cmdline /proc/407/cmdline /proc/409/cmdline /proc/431/cmdline /proc/432/cmdline /proc/5/cmdline /proc/58/cmdline /proc/59/cmdline /proc/6/cmdline /proc/60/cmdline /proc/61/cmdline /proc/671/cmdline /pro[rkmodule] [sh][PPID:0x2b6] [pkill][PID:0x2b7] do_filp_open. Filename: \"/lib/arm-linux-gnueabi/libdl.so.2\
/bin/sh -c rm -rf /tmp/*
rm -rf /tmp/*
Kills the following processes:
Unknown process with PID: 3198926568
Performs operations with the file system:
Network activity:
Establishes connection:
Receives data from the following servers:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK