Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.5579

Added to the Dr.Web virus database: 2023-09-04

Virus description added:

Technical Information

Malicious functions:
Removes itself
Substitutes application name for:
  • systemd
Launches processes:
  • /bin/sh -c cat /etc/redhat-releases
  • uname -a
  • /bin/sh -c free -h
  • cat /proc/cpuinfo
  • ps -aux
  • cat /etc/lsb-release
  • /bin/sh -c cat /proc/cpuinfo
  • /bin/sh -c cat /etc/lsb-release
  • /bin/sh -c uname -sm
  • /bin/sh -c uname -a
  • free -h
  • /bin/sh -c ps -aux
  • /bin/sh -c ps -x -o pid,comm --sort pid
  • uname -sm
  • cat /etc/redhat-releases
  • ps -x -o pid,comm --sort pid
Network activity:
Establishes connection:
  • 19#.##.114.54:5050
  • 15#.##5.160.73:5050
Sends data to the following servers:
  • 19#.##.114.192:5050
  • 19#.##.114.54:5050
  • 15#.##5.160.73:5050
Receives data from the following servers:
  • 19#.##.114.192:5050
  • 19#.###.180.162:5050
  • 19#.##.114.54:5050
  • 15#.##5.160.73:5050
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number