JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.6944
Added to the Dr.Web virus database:
2024-04-11
Virus description added:
2024-04-10
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/knlib
/var/spool/cron/crontabs/root
/etc/cron.d/.lib-knlib4
/etc/cron.hourly/.lib-knlib4
/etc/cron.daily/.lib-knlib4
/etc/cron.weekly/.lib-knlib4
/etc/cron.monthly/.lib-knlib4
Malicious functions:
Manages services:
['systemctl', 'daemon-reload']
['systemctl', 'enable', 'knlibe.service']
Launches processes:
chattr -ia /etc/cron.weekly/man-db
bash -c (crontab -l 2>/dev/null | grep -v \x27.klibsystem4-1712779286-261\x27 ; echo \x22* * * * * /var/tmp/.klibsystem4-1712779286-261 >/dev/null 2>&1\x22) | crontab -
rm -rf /etc/sysctl.conf
crontab -
hostname
chattr -ia /etc/cron.daily/.placeholder
/bin/bash /etc/init.d/knlib start
chattr -ia /var/spool/cron/crontabs
chattr +ia /etc/systemd/system/knlibe.service
chattr +ia /etc/cron.hourly/.lib-knlib4
cat /etc/ssh/sshd_config
chattr +ia /bin/knlib
chattr +ia /etc/cron.monthly/.lib-knlib4
chattr -ia /etc/cron.daily/logrotate
sed -e s/$//
chattr +ia /var/spool/cron/.lib-knlib4
chattr +ia /etc/init.d/knlib
cut -d: -f2
ps -A -ostat,ppid
nohup /tmp/bi.64 &
crontab -l
chattr +ia /var/spool/cron/crontabs/root
/tmp/bi.64 &
sysctl -p
chattr +ia /etc/cron.d/.lib-knlib4
/usr/bin/mawk awk {print \x22-\x22$2}
bash -c rm -rf /etc/sysctl.conf ; echo fs.file-max = 2097152 > /etc/sysctl.conf ; sysctl -p ; ulimit -Hn ; ulimit -n 99999 -u 999999
rm -rf -- klibsystem4
chattr -ia /etc/cron.d/e2scrub_all
chattr -ia /etc/cron.hourly/.placeholder
ss -ant
grep -m 1 model name /proc/cpuinfo
ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
grep -c ^processor /proc/cpuinfo
hostname -I
/usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
chattr +ia /etc/anacrontab
chattr +ia /etc/cron.weekly/.lib-knlib4
<0xe0>
chattr -ia /etc/cron.d/.placeholder
grep -v grep
id -u
ps x
chattr -ia /etc/cron.daily/apt-compat
cp -f -r -- /bin/knlib /bin/klibsystem4
chattr -ia /etc/cron.daily/man-db
bash -c crontab -
chattr -ia /etc/cron.daily/dpkg
chattr -ia /etc/cron.weekly/.placeholder
nohup /tmp/bin.64 -c -p 80 -p 443 -tls -dp 80 -dp 443 -tls -d -pwn &
chattr -ia /etc/cron.monthly/.placeholder
grep /etc/cron
grep Port
nohup ./klibsystem4
/tmp/bin.64 -c -p 80 -p 443 -tls -dp 80 -dp 443 -tls -d -pwn &
head -n 1
sed -e s/^ *//
whoami
/usr/bin/mawk awk {print $1}
chattr +ia /etc/cron.daily/.lib-knlib4
grep -v .klibsystem4-1712779286-261
Performs operations with the file system:
Modifies file access rights:
/etc/init.d/knlib
/usr/bin/knlib
/var/spool/cron/crontabs/tmp.oOBEMm
/var/spool/cron/crontabs/tmp.Pp7fK8
/var/spool/cron/crontabs/tmp.wfCj42
Deletes folders:
Creates or modifies files:
/etc/sysctl.conf
/proc/sys/fs/file-max
/tmp/.klibsystem4.lock
/etc/systemd/system/knlibe.service
/usr/bin/knlib
/var/spool/cron/crontabs/tmp.oOBEMm
/var/tmp/.klibsystem4-1712779286-261
/var/spool/cron/crontabs/tmp.Pp7fK8
/var/spool/cron/.lib-knlib4
/etc/anacrontab
/var/spool/cron/crontabs/tmp.wfCj42
/tmp/bi.64
/tmp/bin.64
/tmp/.bashirc
Deletes files:
/etc/sysctl.conf
/etc/cron.d/.placeholder
/etc/cron.d/e2scrub_all
/var/spool/cron/crontabs
/etc/cron.hourly/.placeholder
/etc/cron.daily/.placeholder
/etc/cron.daily/apt-compat
/etc/cron.daily/dpkg
/etc/cron.daily/logrotate
/etc/cron.daily/man-db
/etc/cron.weekly/.placeholder
/etc/cron.weekly/man-db
/etc/cron.monthly/.placeholder
/var/spool/cron/crontabs/tmp.wfCj42
Locks files:
/tmp/.klibsystem4.lock
/tmp/.bashirc
Changes time of creation/access/modification of files:
Network activity:
Establishes connection:
8.#.8.8:53
5.##.80.215:80
80.##.24.30:80
80.##.24.30:443
51.###.171.23:80
51.###.171.23:443
DNS ASK:
ru#.#ck-dns.ws
c4####cd.pwndns.pw
pw#.###cleservice.top
Sends data to the following servers:
5.##.80.215:80
80.##.24.30:80
51.###.171.23:80
Receives data from the following servers:
5.##.80.215:80
80.##.24.30:80
51.###.171.23:80
Other:
Collects OS information
Collects CPU information
Collects RAM information
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK