Linux.Siggen.7299

Malicious functions:

Substitutes application name for:

Performs operations with the file system:

Modifies file access rights:

socket:[13233]
/tmp/.coreclr.liNjpz
/tmp/.coreclr.2Ez8iC
/tmp/.dotnet/shm/global
/tmp/.dotnet/shm/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/tmp/.dotnet/lockfiles
/tmp/.dotnet/lockfiles/global
/tmp/.dotnet/lockfiles/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB

Creates folders:

Deletes folders:

Creates or modifies files:

/proc/706/task/715/comm
/proc/706/task/724/comm
/tmp/.coreclr.liNjpz
/tmp/.coreclr.2Ez8iC
/tmp/.dotnet/shm/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/tmp/.dotnet/lockfiles/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/root/log.txt
/proc/706/task/728/comm
/proc/706/task/730/comm
/proc/706/task/731/comm

Deletes files:

/tmp/dotnet-diagnostic-706-43522-socket
/tmp/clr-debug-pipe-706-43522-in
/tmp/clr-debug-pipe-706-43522-out
/tmp/.dotnet/lockfiles/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/tmp/.dotnet/shm/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB

Locks files:

/proc/706/maps
/proc/706/stat
/proc/706/status
/proc/706/cmdline
/proc/706/task/706/stat
/proc/706/task/711/stat
/proc/706/task/712/stat
/proc/706/task/713/stat
/proc/706/task/714/stat
/proc/706/task/715/stat
/proc/706/task/724/stat
/proc/706/task/727/stat
/usr/share/zoneinfo/America/New_York
/tmp/.dotnet/shm
/tmp/.dotnet/shm/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/tmp/.dotnet/lockfiles/global/ArchiSteamFarm-SingleInstance-94A6B447580330F9F2B609422537B04239FF3A39DF9137E32EFD559F1A2935CB
/usr/lib/os-release
/root/log.txt

Other:

Collects CPU information

Collects RAM information