Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.6808

Added to the Dr.Web virus database: 2024-03-20

Virus description added:

Technical Information

Malicious functions:
Removes itself
Launches itself as a daemon
Manages services:
  • ['systemctl', '--version']
  • ['systemctl', 'enable', '/lib/systemd/system/display-managerd.service']
Launches processes:
  • echo /usr/lib/libselinux.so >> /etc/ld.so.preload 2>/dev/null
  • chmod u+x /usr/bin/.Xl1/udevd
  • chmod u+x /usr/bin/.Xl1/udevd 2>/dev/null
  • chmod u+x /usr/bin/.Xl1/kde 2>/dev/null
  • /usr/bin/.Xl1/kde 2>/dev/null
  • /usr/bin/.Xl1/udevd /usr/bin/.Xl1/kde
  • /usr/bin/.Xl1/kde
  • systemctl --version 2>/dev/null
  • chmod u+x /usr/bin/.Xl1/kde
  • systemctl enable /lib/systemd/system/display-managerd.service 2>/dev/null
Performs operations with the file system:
Modifies file access rights:
  • /usr/bin/.Xl1/kde
  • /usr/bin/.Xl1/udevd
Creates folders:
  • /usr/bin/.Xl1
  • /usr/bin/.Xl1/data
Creates symlinks:
  • /sem.cheese-540596516
Creates or modifies files:
  • /usr/bin/.Xl1/kde
  • /usr/bin/.Xl1/udevd
  • /usr/lib/libselinux.so
  • /etc/ld.so.preload
  • /usr/lib/systemd/system/display-managerd.service
  • /usr/bin/.Xl1/run
  • /usr/bin/.Xl1/f2
  • /usr/bin/.Xl1/f1
  • /memfd:lttng-ust-waits-1710866203.124732642 (deleted)
  • /usr/bin/.Xl1/data/gphoto2
  • /dev/shm/pQnJmz
  • /usr/bin/.Xl1/conf
  • /memfd:lttng-ust-waits-1710866204.239171631 (deleted)
Deletes files:
  • /pQnJmz
  • /usr/bin/.Xl1/conf
Changes time of creation/access/modification of files:
  • /usr/(null)
  • /usr
  • /usr/bin
  • /usr/bin/.Xl1
  • /usr/bin/.Xl1/kde
  • /usr/bin/.Xl1/udevd
  • /usr/lib
  • /usr/lib/libselinux.so
  • /(null)
  • /usr/bin/.Xl1/f2
  • /usr/bin/.Xl1/f1
  • /usr/bin/.Xl1/data
  • /usr/bin/.Xl1/data/gphoto2
  • /usr/bin/.Xl1/conf
Network activity:
Establishes connection:
  • 8.#.8.8:53
DNS ASK:
  • ds##ei.com

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number