Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.6923

Added to the Dr.Web virus database: 2024-04-09

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/rc.d/init.d/tcp4
  • /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
  • systemd
Manages services:
  • ['systemctl', 'daemon-reload', 'redis.service']
  • ['systemctl', 'enable ', 'redis.service']
  • ['systemctl', 'daemon-reload', 'mysql.service']
  • ['systemctl', 'enable ', 'mysql.service']
Launches processes:
  • uname -r
  • uname -m
  • mount -o bind /var /proc/689/
  • <SAMPLE_FULL_PATH> d
  • <SAMPLE_FULL_PATH> e
  • crontab /var/.recovery
Kills the following processes:
  • ksoftirqd/0
  • irq/33-mmci-pl1
  • mmc_complete
  • rcu_sched
  • jbd2/mmcblk0p2-
  • ext4-rsv-conver
  • cpuhp/0
  • kdevtmpfs
  • netns
  • kauditd
  • kthreadd
  • khungtaskd
  • oom_reaper
  • writeback
  • cryptd
  • kcompactd0
  • ksmd
  • khugepaged
  • rcu_gp
  • kworker/u2:3
  • rcu_par_gp
  • kintegrityd
  • kblockd
  • blkcg_punt_bio
  • edac-poller
  • devfreq_wq
  • watchdogd
  • kworker/0:1H
  • kswapd0
  • kthrotld
  • ipv6_addrconf
  • kworker/0:0H
  • kstrp
  • zswap-shrink
  • kworker/0:0
  • 9bc2fd2a
  • kworker/u3:0
  • <SAMPLE>
  • kworker/u2:0
  • kworker/0:5
  • uname
  • kworker/0:6
  • crontab
  • gzip
  • mm_percpu_wq
  • rcu_tasks_rude_
  • rcu_tasks_trace
  • migration/0
  • logrotate
  • dash
  • cron
Performs operations with the file system:
Modifies file access rights:
  • /var/spool/cron/crontabs/tmp.hmoFcc
Creates folders:
  • /var/web
Creates or modifies files:
  • /usr/bin/.kill
  • /usr/bin/kill
  • /usr/bin/.ls
  • /usr/bin/ls
  • /var/temp_check_permissions
  • /etc/default_dns.conf
  • /opt/cgo
  • /dev/watchdog
  • /var/kernal
  • /usr/lib/readdir.so
  • /var/.recovery
  • /var/web/media.jpg
  • /usr/bin/.pwd
  • /usr/bin/pwd
  • /var/spool/cron/crontabs/tmp.hmoFcc
  • /etc/systemd/system/redis.service
  • /usr/bin/.mkdir
  • /usr/bin/mkdir
  • /etc/systemd/system/mysql.service
Deletes files:
  • /var/temp_check_permissions
Mounts file systems:
  • /var
Changes time of creation/access/modification of files:
  • /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
  • 0.0.0.0:7898
Establishes connection:
  • 8.#.8.8:53
  • 15#.#.235.76:55655
Sends data to the following servers:
  • 8.#.8.8:53
  • 15#.#.235.76:55655
Receives data from the following servers:
  • 8.#.8.8:53
  • 15#.#.235.76:55655
Other:
Collects CPU information
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number