JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.7630
Added to the Dr.Web virus database:
2024-06-14
Virus description added:
2024-06-14
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/dpkg-deb-package
/etc/cron.d/.lib-knlib4
/etc/cron.hourly/.lib-knlib4
/etc/cron.daily/.lib-knlib4
/etc/cron.weekly/.lib-knlib4
/etc/cron.monthly/.lib-knlib4
/var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
grep Port
<0x232>
ps aux
hostname -I
sed -e s/^ *//
/tmp/e5662672-7899-4be6-9120-6381dc2ee433 kworker/R-debug
<0x1c9>
/tmp/-bash-c7f2584f-7a0e-40c8-81fb-a199f31ef476 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
cat /etc/ssh/sshd_config
grep /etc/cron
<0xad>
/usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
cut -d: -f2
grep -c ^processor /proc/cpuinfo
grep -v grep
ps x
grep -v /usr/sbin/httpd
ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
head -n 1
wc -l
ps -A -ostat,ppid
whoami
<0x162>
/usr/bin/mawk awk {if($3>30.0) print $2}
/usr/bin/mawk awk {print $1}
grep -v -- -bash[[:space:]]*$
/tmp/-bash-c7f2584f-7a0e-40c8-81fb-a199f31ef476 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
grep -- -bash[[:space:]]*$
grep -m 1 model name /proc/cpuinfo
/usr/bin/mawk awk {print \x22-\x22$2}
hostname
id -u
sed -e s/$//
Kills the following processes:
Performs operations with the file system:
Modifies file access rights:
/tmp/e5662672-7899-4be6-9120-6381dc2ee433
/etc/init.d/dpkg-deb-package
/usr/bin/dpkg-debian
Creates or modifies files:
/tmp/e5662672-7899-4be6-9120-6381dc2ee433
/tmp/4eaf1dc7-fa21-41a1-8ce7-35f8ddbfa055
/etc/systemd/system/dpkg-deb-package.service
/usr/bin/dpkg-debian
/tmp/-bash-c7f2584f-7a0e-40c8-81fb-a199f31ef476
/dev/shm/.klibsystem5
/var/spool/cron/.lib-knlib4
/etc/anacrontab
/tmp/.lock
/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages
Locks files:
Network activity:
Awaits incoming connections on ports:
Establishes connection:
0.0.0.0:10444
0.0.0.0:59475
0.0.0.0:444
85.###.56.107:80
DNS ASK:
Sends data to the following servers:
Receives data from the following servers:
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK