JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.3785
Added to the Dr.Web virus database:
2021-03-17
Virus description added:
2021-03-17
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/var/spool/cron/crontabs/root
/etc/init.d/S11log
/etc/init.d/udev-finish
/etc/init.d/ssh
/etc/init.d/procps
/etc/init.d/kmod
/etc/init.d/rmnologin
/etc/init.d/dbus
/etc/init.d/urandom
/etc/init.d/networking
/etc/init.d/keyboard-setup
/etc/init.d/kbd
/etc/init.d/console-setup
/etc/init.d/bootmisc.sh
/etc/init.d/bootlogs
/etc/init.d/README
/etc/init.d/rsyslog
/etc/init.d/halt
/etc/init.d/checkfs.sh
/etc/init.d/reboot
/etc/init.d/rc.local
/etc/init.d/mountnfs-bootclean.sh
/etc/init.d/saned
/etc/init.d/umountfs
/etc/init.d/mountnfs.sh
/etc/init.d/sendsigs
/etc/init.d/rcS
/etc/init.d/hostname.sh
/etc/init.d/x11-common
/etc/init.d/motd
/etc/init.d/rc
/etc/init.d/skeleton
/etc/init.d/cron
/etc/init.d/nfs-common
/etc/init.d/udev
/etc/init.d/umountroot
/etc/init.d/mountkernfs.sh
/etc/init.d/killprocs
/etc/init.d/single
/etc/init.d/atd
/etc/init.d/checkroot-bootclean.sh
/etc/init.d/mountdevsubfs.sh
/etc/init.d/exim4
/etc/init.d/hwclock.sh
/etc/init.d/umountnfs.sh
/etc/init.d/mountall-bootclean.sh
/etc/init.d/rpcbind
/etc/init.d/checkroot.sh
/etc/init.d/acpid
/etc/init.d/mountall.sh
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Launches processes:
sh -c echo '10 * * * * /root crontab' | crontab -
crontab -
Performs operations with the file system:
Modifies file access rights:
/var/spool/cron/crontabs/tmp.k4RviQ
Creates or modifies files:
/var/spool/cron/crontabs/tmp.k4RviQ
Network activity:
Awaits incoming connections on ports:
Establishes connection:
8.#.8.8:53
8.#.4.4:53
1.#.1.1:53
1.#.0.1:53
9.#.9.9:53
DNS ASK:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK