Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.6096

Added to the Dr.Web virus database: 2023-12-07

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • rpcbind
Performs operations with the file system:
Creates or modifies files:
  • /self
  • /proc/508/cmdline
Network activity:
Awaits incoming connections on ports:
  • 0.0.0.0:51925
Establishes connection:
  • 8.#.8.8:53
  • 17#.##.210.240:51925
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 14#.##9.180.101:23
  • 17.###.42.147:23
  • 12#.##7.216.72:23
  • 19#.#6.85.99:23
  • 12#.##6.241.188:23
  • 74.###.128.215:23
  • 95.###.149.153:23
  • 17#.##.224.227:23
  • 12#.#.93.139:23
  • 98.##8.1.186:23
  • 20#.##.95.179:23
  • 18#.##2.205.130:23
  • 50.###.162.110:23
  • 21#.##5.197.72:23
  • 67.###.210.131:23
  • 17.###.199.91:23
  • 15#.##.179.86:23
  • 89.###.69.230:23
  • 17#.#4.99.44:23
  • 80.##.247.168:23
  • 87.###.174.124:23
  • 18#.##5.55.61:23
  • 14#.##.181.85:23
  • 13#.##.95.137:23
  • 27.##9.3.87:23
  • 45.##.213.192:23
  • 85.###.243.241:23
  • 17#.##0.91.221:23
  • 39.#.200.74:23
  • 11#.##.115.53:23
  • 4.###.7.95:23
  • 88.###.45.248:23
  • 15#.##.173.113:23
  • 10#.##7.139.40:23
  • 48.###.242.12:23
  • 16#.##.34.167:23
  • 15#.#3.16.63:23
  • 16#.##4.219.23:23
  • 15#.##3.218.52:23
  • 59.###.44.112:23
  • 59.###.242.224:23
  • 16#.#.222.72:23
  • 82.###.218.227:23
  • 2.##.74.99:23
  • 12#.##5.132.54:23
  • 13#.#5.10.44:23
  • 35.##.0.213:23
  • 54.##.194.45:23
  • 48.###.164.178:23
  • 13#.##.74.143:23
  • 78.##.145.115:23
  • 13#.##2.254.217:23
  • 66.###.210.27:23
  • 73.#.42.36:23
  • 9.##.249.105:23
  • 20#.#.238.241:23
  • 11#.##6.222.22:23
  • 95.##.85.98:23
  • 21#.#8.73.0:23
  • 31.###.86.247:23
  • 20#.##4.187.146:23
  • 11#.##.73.217:23
  • 19#.#7.44.36:23
  • 97.###.195.64:23
  • 17#.##.91.144:23
  • 89.###.54.177:23
  • 21#.#.183.147:23
  • 32.#.235.222:23
  • 80.###.184.85:23
  • 91.##.53.155:23
  • 61.###.232.96:23
  • 54.###.218.144:23
  • 44.###.221.171:23
  • 15#.##0.187.116:23
  • 19#.##7.205.225:23
  • 16#.##7.162.119:23
  • 11#.##4.39.175:23
  • 15#.##.175.209:23
  • 13#.##6.250.90:23
  • 88.##.199.26:23
  • 11#.##.143.233:23
  • 16#.##0.140.125:23
  • 20#.##0.70.189:23
  • 96.##.167.97:23
  • 76.##.76.114:23
  • 77.###.145.165:23
  • 51.###.102.207:23
  • 11#.##.72.100:23
  • 20#.##.207.46:23
  • 92.###.206.197:23
  • 17#.##.86.210:23
  • 97.###.96.168:23
  • 16#.#3.2.195:23
  • 10#.##1.206.221:23
  • 27.##.222.3:23
  • 14#.##4.214.79:23
  • 92.###.239.170:23
  • 18#.#.81.202:23
  • 94.###.97.250:23
  • 48.##4.70.54:23
  • 90.###.155.25:23
  • 15#.##.171.245:23
  • 20#.##.235.196:23
  • 11#.##.228.28:23
  • 99.##.206.132:23
  • 16#.#7.49.32:23
  • 9.##.181.59:23
  • 16#.##8.212.96:23
  • 31.###.208.68:23
  • 13#.##5.10.112:23
  • 12#.##.88.148:23
  • 11#.##4.24.123:23
  • 5.###.31.87:23
  • 10#.##5.190.42:23
  • 12#.##.114.56:23
  • 49.###.152.109:23
  • 18#.#1.22.85:23
  • 19#.##3.205.13:23
  • 40.###.118.25:23
  • 80.##8.2.49:23
  • 72.###.179.71:23
  • 37.##.163.145:23
  • 12#.##.116.142:23
  • 20#.##.228.251:23
  • 15#.#74.11.9:23
  • 62.###.15.122:23
  • 20#.##4.165.140:23
  • 13#.##.218.152:23
  • 18#.##.197.121:23
  • 1.###.234.18:23
  • 15#.#6.63.58:23
  • 87.##.227.26:23
  • 99.##.175.20:23
  • 17#.##8.177.25:23
  • 92.##.72.169:23
  • 52.##4.233.1:23
  • 10#.##6.11.234:23
  • 14#.##.50.199:23
  • 14#.##6.240.101:23
  • 10#.##6.117.181:23
  • 13.#.200.196:23
  • 12#.##8.232.177:23
  • 14#.##.142.183:23
  • 86.###.25.111:23
  • 19#.##.118.130:23
  • 11#.##.134.232:23
  • 14#.##.166.139:23
  • 19#.#.20.1:23
  • 21#.##5.175.21:23
  • 19#.##.31.192:23
  • 14#.##5.84.30:23
  • 90.##.38.219:23
  • 10#.##.228.29:23
  • 10#.##2.212.181:23
  • 25.##.22.147:23
  • 87.##0.44.40:23
  • 90.###.13.203:23
  • 61.###.51.203:23
  • 63.###.233.224:23
  • 10#.##1.167.61:23
  • 1.##.94.146:23
  • 79.###.65.175:23
  • 16#.##4.242.7:23
  • 13#.##9.236.219:23
  • 18#.##3.39.74:23
  • 17#.##.100.61:23
  • 20#.##4.91.175:23
  • 11#.##4.92.254:23
  • 19#.##9.81.97:23
  • 19#.##8.138.68:23
  • 13#.##.117.200:23
  • 19#.##9.121.101:23
  • 17#.##8.146.140:23
  • 11#.##0.48.98:23
  • 18.###.131.31:23
  • 17#.##7.56.125:23
  • 5.###.52.207:23
  • 41.##.249.189:23
  • 21#.#5.18.34:23
  • 17#.##4.117.33:23
  • 77.###.205.220:23
  • 25.##9.1.176:23
  • 90.###.230.184:23
  • 10#.##.25.231:23
  • 19#.##1.23.52:23
  • 21#.#6.125.0:23
  • 16#.#6.98.83:23
  • 19#.##.139.146:23
  • 72.##.248.105:23
  • 90.###.227.237:23
  • 19#.#13.80.6:23
  • 10#.##4.136.57:23
  • 93.##.161.204:23
  • 12#.##6.44.97:23
  • 20#.##3.238.134:23
  • 15#.#.69.70:23
  • 14#.##3.121.171:23
  • 18#.##8.109.11:23
  • 14#.##9.124.204:23
  • 14.##4.57.42:23
  • 98.#.87.66:23
  • 17#.##4.117.137:23
  • 60.###.209.194:23
  • 97.##.65.180:23
  • 19#.#9.64.22:23
  • 11#.##3.17.54:23
  • 13#.##9.142.236:23
  • 25.##.13.229:23
  • 21#.##.72.211:23
  • 5.###.36.67:23
  • 65.##.55.111:23
  • 18.##.29.88:23
  • 13#.##1.183.238:23
  • 31.###.202.231:23
  • 12.###.136.109:23
  • 58.##3.5.129:23
  • 13#.##0.57.25:23
  • 19#.##.114.48:23
  • 14#.##3.136.230:23
  • 44.###.241.190:23
  • 14#.##.103.224:23
  • 13#.##0.232.36:23
  • 11#.##4.164.102:23
  • 20#.##.35.144:23
  • 47.##6.13.92:23
  • 17#.##0.218.1:23
  • 14#.##9.216.71:23
  • 10#.##.153.116:23
  • 15#.##4.226.78:23
  • 15#.#.196.153:23
  • 21#.##.244.38:23
  • 14#.##4.69.137:23
  • 97.###.189.153:23
  • 10#.##4.157.45:23
  • 19.###.212.101:23
  • 20#.##2.121.23:23
  • 20#.#.190.75:23
  • 84.###.120.100:23
  • 18#.##8.248.220:23
  • 13#.##1.138.33:23
  • 46.##3.98.14:23
  • 11#.##8.60.13:23
  • 10#.##8.184.222:23
  • 95.##.206.5:23
  • 12#.##2.96.47:23
  • 86.###.98.107:23
  • 59.##.168.124:23
  • 16#.##3.105.143:23
  • 58.##.229.92:23
  • 5.###.16.136:23
  • 4.##.44.83:23
  • 53.##.168.98:23
  • 20#.##7.84.247:23
  • 22#.##.51.107:23
  • 86.###.101.101:23
  • 13#.##0.44.61:23
  • 15#.##.218.232:23
  • 20#.##.117.45:23
  • 19.#.73.196:23
Other:
Reads information from /proc/kallsyms

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number