JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.6954
Added to the Dr.Web virus database:
2024-04-11
Virus description added:
2024-04-11
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/dnsconfig
/etc/rc.d/init.d/dnsconfigs
/var/spool/cron/crontabs/root
Creates or modifies the following symlinks:
/etc/rc0.d/S99dnsconfig
/etc/rc1.d/S99dnsconfig
/etc/rc2.d/S99dnsconfig
/etc/rc3.d/S99dnsconfig
/etc/rc4.d/S99dnsconfig
/etc/rc5.d/S99dnsconfig
/etc/rc6.d/S99dnsconfig
/etc/rc0.d/S99dnsconfigs
/etc/rc1.d/S99dnsconfigs
/etc/rc2.d/S99dnsconfigs
/etc/rc3.d/S99dnsconfigs
/etc/rc4.d/S99dnsconfigs
/etc/rc5.d/S99dnsconfigs
/etc/rc6.d/S99dnsconfigs
Malicious functions:
Launches itself as a daemon
Manages services:
['systemctl', 'daemon-reload']
['systemctl', 'enable', 'dnsconfigs.service']
['systemctl', 'start', 'dnsconfigs.service']
Launches processes:
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1
crontab /var/tmp/.recoverys
ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig
ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs
mount -o bind /tmp/nginx_server /proc/828/
mount -o bind /tmp/nginx_server /proc/836/
ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig
ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig
/bin/sh -c ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1
/bin/sh -c ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1
ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs
/bin/sh -c ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1
/bin/sh -c ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1
ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig
ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs
/bin/sh -c mount -o bind /tmp/nginx_server /proc/828/ > /dev/null 2>&1
ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig
ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig
/bin/sh -c systemctl enable dnsconfigs.service > /dev/null 2>&1
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1
/bin/sh -c mount -o bind /tmp/nginx_server /proc/836/ > /dev/null 2>&1
ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs
ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs
/bin/systemd-tty-ask-password-agent --watch
/bin/sh -c ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1
/bin/sh -c ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1
/bin/sh -c systemctl start dnsconfigs.service > /dev/null 2>&1
ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1
cp -f <SAMPLE_FULL_PATH> /var/tmp/nginx_kel
/bin/sh -c crontab /var/tmp/.recoverys
/bin/sh -c ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1
ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig
/bin/sh -c ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1
ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs
/bin/sh -c systemctl daemon-reload > /dev/null 2>&1
ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig
ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1
ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs
/bin/sh -c ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1
Kills the following processes:
Performs operations with the file system:
Modifies file access rights:
/var/tmp/nginx_kel
/etc/init.d/dnsconfig
/var/spool/cron/crontabs/tmp.h3A6UX
Creates folders:
Creates symlinks:
Creates or modifies files:
/var/tmp/nginx_kel
/run/mount/utab
/var/tmp/.recoverys
/tmp/server_session.lock
/var/spool/cron/crontabs/tmp.h3A6UX
/etc/systemd/system/dnsconfigs.service
/dev/tty
Mounts file systems:
Changes time of creation/access/modification of files:
Network activity:
Awaits incoming connections on ports:
Establishes connection:
8.#.8.8:53
127.0.0.1:27120
12#.#.15.28:123
1.#.1.1:53
14#.##.12.176:24150
54.##.111.116:53
1.#.0.1:53
16#.##8.12.137:53
94.###.43.254:53
DNS ASK:
ad######8f.dontargetme.nl
ad#######f.websersaiosnginxo.ru
ad######8f.adminpanel.oss
ad#######f.admincs.duckdns.org
ad#####08f.session.geek
ad#####08f.duckdns.org
ad###4408f.geek
Sends data to the following servers:
127.0.0.1:27120
127.0.0.1:43846
127.0.0.1:43853
12#.#.15.28:123
127.0.0.1:43896
Receives data from the following servers:
127.0.0.1:27120
127.0.0.1:43846
127.0.0.1:43853
12#.#.15.28:123
14#.##.12.176:24150
127.0.0.1:43896
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK