JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.6084
Added to the Dr.Web virus database:
2023-12-05
Virus description added:
2023-12-05
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
/usr/bin/crontab -
/usr/bin/crontab
bash -c echo \x22* * * * * <SAMPLE_FULL_PATH>\x22 | /usr/bin/crontab -
<SAMPLE_FULL_PATH> {70d0be7374677265733a207265706c69636174696f6e206c61756e63686572}
mount
./cpu_hu
bash -c /usr/bin/crontab -r
bash -c ./cpu_hu
Performs operations with the file system:
Modifies file access rights:
/var/spool/cron/crontabs/tmp.d4GSrt
/var/spool/cron/crontabs/tmp.SZSh8O
Creates or modifies files:
/tmp/.private-fAUZbhy7B45fgmk1Gqci-login.service-S90agO
/tmp/.private-YO1lKF399NbEEUQUNDMl-login.service-CgeHDZ
/tmp/.sh_history
/var/spool/cron/crontabs/tmp.d4GSrt
/var/spool/cron/crontabs/tmp.SZSh8O
/usr/lib/tasksel/packages/cpu_hu
Locks files:
/tmp/.private-fAUZbhy7B45fgmk1Gqci-login.service-S90agO
Changes time of creation/access/modification of files:
Network activity:
Establishes connection:
Sends data to the following servers:
Receives data from the following servers:
Other:
Collects CPU information
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK