JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.3905
Added to the Dr.Web virus database:
2021-05-18
Virus description added:
2021-05-18
Technical Information
Malicious functions:
Gets access to SSH keys
/root/.ssh/authorized_keys
Modifies firewall settings:
iptables -F
iptables --flush
Launches processes:
/bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
<SAMPLE_FULL_PATH>
/bin/bash <SAMPLE_FULL_PATH> -c
openssl rand -hex 5
chattr -i -a -j -t -d -u /usr
chattr -i -a -j -t -d -u /usr/bin
chattr -i -a -j -t -d -u /usr/local
chattr -i -a -j -t -d -u /usr/local/share
chattr -i -a -j -t -d -u /usr/local/share/.logfile
chmod +x /usr/local/share/.logfile
id -u
chattr -i -a -j -t -d -u /root
mkdir /root/.ssh
chmod 600 /root/.ssh/authorized_keys
chattr +i /root/.ssh/authorized_keys
cp /usr/sbin/rmt_remount-open /usr/bin/d8cd5632dc
/usr/bin/d8cd5632dc
rm -rf /usr/bin/d8cd5632dc
Performs operations with the file system:
Modifies file access rights:
/root/.rnd
/root/.ssh/authorized_keys
Creates folders:
Creates or modifies files:
/root/.rnd
/etc/resolv.conf
/usr/local/share/.logfile
Deletes files:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK