Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.3444

Added to the Dr.Web virus database: 2020-11-27

Virus description added:

Technical Information

Malicious functions:
Substitutes application name for:
Kills the following processes:
  • <SAMPLE>
Network activity:
Awaits incoming connections on ports:
  • 19#.##8.217.50:3467
Establishes connection:
  • 8.#.8.8:53
  • 19#.##9.147.16:4321
  • 37.##.150.53:7685
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 19#.##9.147.16:4321
  • 37.##.150.53:7685
  • 23#.##6.170.119:23
  • 16#.##8.152.239:23
  • 68.##.132.160:23
  • 29.###.88.107:23
  • 24#.##4.120.95:23
  • 20#.##5.255.168:23
  • 10.###.76.243:23
  • 19#.##2.4.149:23
  • 14#.##4.222.172:23
  • 12#.#.111.54:23
  • 20#.##.233.115:23
  • 16#.##8.21.246:23
  • 58.###.46.178:23
  • 14#.##7.203.113:23
  • 14#.##9.96.43:23
  • 12#.#.249.100:23
  • 13.##.106.237:23
  • 14.###.37.191:23
  • 31.##.212.246:23
  • 16#.##.234.217:23
  • 24#.##5.90.47:23
  • 24#.#7.2.104:23
  • 16#.##.59.193:23
  • 46.###.144.67:23
  • 58.###.167.49:23
  • 22#.##.68.152:23
  • 67.##.233.40:23
  • 56.##8.7.167:23
  • 19#.##.81.209:23
  • 12#.##.41.186:23
  • 14#.#.39.240:23
  • 20#.##.255.143:23
Receives data from the following servers:
  • 37.##.150.53:7685
  • 19#.##9.147.16:4321

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number