JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.6983
Added to the Dr.Web virus database:
2024-04-14
Virus description added:
2024-04-14
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/var/spool/cron/crontabs/root
Malicious functions:
Gets access to SSH keys
/root/.ssh/authorized_keys
Substitutes application name for:
Manages services:
['systemctl', 'enable', 'myservice']
['systemctl', 'start', 'myservice']
Launches processes:
rm -rf /var/tmp/x.sh /var/tmp/xxx
rm -rf /var/tmp/Documents/.5p4rk3l5
pgrep -x Opera
chmod 777 /root/.pidsclip
chattr -iae /root/.ssh/authorized_keys
mkdir /var/tmp/.ladyg0g0/
chattr +iae /var/tmp/Documents/.diicot
<0x60>
<SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
mv /var/tmp/Documents/kuak /var/tmp/Documents/Opera
mkdir /root/.ssh
chattr +iae /root/.ssh/authorized_keys
cp -avr /root /usr/bin/.locatione
rm -rf /root/.ssh
rm -rf /var/tmp/Documents/config.json
chmod 777 /var/tmp/Documents/.b4nd1d0
bash -c yum install -y rsync >/dev/null 2>&1 & disown
mkdir /var/tmp/Documents
/usr/bin/mawk awk {print \x22kill -9 \x22$1}
/usr/sbin/killall5 pidof Opera
grep -q .diicot
id -u
cat /usr/bin/.locatione
crontab -r
chmod -R go= /root/.ssh
sleep 0.5
chmod 777 /usr/bin/sshd
crontab -l
cat /var/tmp/.ladyg0g0/.pr1nc35
chmod 644 /lib/systemd/system/myservice.service
sh /var/tmp/x.sh
crontab /var/tmp/Documents/.5p4rk3l5
/usr/bin/mawk awk {gsub(\x22 \x22 \x22\x5cn\x22 $0); print}
chmod 777 Opera
sync
/bin/bash /var/tmp/Documents/./.b4nd1d0
chmod 777 /usr/bin/.pidsclip
sleep 1
Kills the following processes:
Performs operations with the file system:
Modifies file access rights:
/root/.ssh
/root/.ssh/authorized_keys
/var/spool/cron/crontabs/tmp.z7HAP4
/var/tmp/Documents/.b4nd1d0
/usr/bin/sshd
/usr/lib/systemd/system/myservice.service
/root/.pidsclip
/usr/bin/.pidsclip
Creates folders:
/var/tmp/.ladyg0g0
/var/tmp/Documents
/root/.ssh
Creates or modifies files:
/var/tmp/.ladyg0g0/.pr1nc35
/usr/bin/.locatione
/var/tmp/x.sh
/var/tmp/Documents/config.json
/proc/sys/vm/drop_caches
/var/tmp/Documents/.5p4rk3l5
/var/spool/cron/crontabs/tmp.z7HAP4
/var/tmp/Documents/.b4nd1d0
/usr/bin/sshd
/usr/lib/systemd/system/myservice.service
/dev/tty
/root/.pidsclip
/usr/bin/.pidsclip
Deletes files:
/var/tmp/x.sh
/var/tmp/Documents/.5p4rk3l5
Changes time of creation/access/modification of files:
Other:
Collects OS information
Collects CPU information
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK