Linux.Siggen.7041

Malicious functions:

Substitutes application name for:

Performs operations with the file system:

Modifies file access rights:

socket:[12495]
/tmp/.coreclr.ry8TN2
/tmp/.coreclr.iPlQ92
/tmp/.dotnet/shm/global
/tmp/.dotnet/shm/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/tmp/.dotnet/lockfiles
/tmp/.dotnet/lockfiles/global
/tmp/.dotnet/lockfiles/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB

Creates folders:

Deletes folders:

Creates or modifies files:

/proc/699/task/710/comm
/proc/699/task/712/comm
/tmp/.coreclr.ry8TN2
/tmp/.coreclr.iPlQ92
/tmp/.dotnet/shm/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/tmp/.dotnet/lockfiles/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/root/log.txt
/proc/699/task/714/comm
/proc/699/task/716/comm
/proc/699/task/717/comm

Deletes files:

/tmp/dotnet-diagnostic-699-40569-socket
/tmp/clr-debug-pipe-699-40569-in
/tmp/clr-debug-pipe-699-40569-out
/tmp/.dotnet/lockfiles/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/tmp/.dotnet/shm/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB

Locks files:

/proc/699/maps
/proc/699/stat
/proc/699/status
/proc/699/cmdline
/proc/699/task/699/stat
/proc/699/task/705/stat
/proc/699/task/706/stat
/proc/699/task/707/stat
/proc/699/task/708/stat
/proc/699/task/710/stat
/proc/699/task/712/stat
/proc/699/task/713/stat
/usr/share/zoneinfo/America/New_York
/tmp/.dotnet/shm
/tmp/.dotnet/shm/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/tmp/.dotnet/lockfiles/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/usr/lib/os-release
/root/log.txt

Other:

Collects CPU information

Collects RAM information