Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.7732

Added to the Dr.Web virus database: 2024-07-02

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/dpkg-deb-package
  • /etc/cron.d/dbus-manager
  • /etc/cron.hourly/dbus-manager
  • /etc/cron.daily/dbus-manager
  • /etc/cron.weekly/dbus-manager
  • /etc/cron.monthly/dbus-manager
  • /var/spool/cron/crontabs/root
  • /etc/cron.d/pwnrig
  • /etc/cron.daily/pwnrig
  • /etc/cron.hourly/pwnrig
  • /etc/cron.monthly/pwnrig
  • /etc/cron.weekly/pwnrig
  • /etc/cron.d/sedxPOeCk
  • /etc/cron.daily/sedOgCaql
  • /etc/cron.hourly/sedkMEnmi
  • /etc/cron.monthly/sedEliv5k
  • /etc/cron.weekly/sedqHk7Mh
  • /etc/init.d/pwnrig
  • /etc/init.d/sedHPXbqg
Creates or modifies the following symlinks:
  • /etc/rc2.d/S01pwnrig
  • /etc/rc3.d/S01pwnrig
  • /etc/rc4.d/S01pwnrig
  • /etc/rc5.d/S01pwnrig
Malicious functions:
Launches itself as a daemon
Manages services:
  • ['systemctl', 'daemon-reload']
  • ['systemctl', '--quiet', 'enable', 'pwnrig']
Launches processes:
  • grep Port
  • tee /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
  • /usr/bin/mawk awk {print \x22-\x22$2}
  • ps aux
  • /usr/bin/perl /sbin/update-rc.d -f pwnrig disable
  • sed -i 1 s/-e // /etc/init.d/pwnrig
  • chmod +x /etc/init.d/pwnrig /bin/initdr
  • head -n 1
  • chattr -ia /etc/cron.weekly/man-db
  • <0x14a>
  • mkdir -p /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly
  • chattr +i +a /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
  • hostname
  • chattr -ia /var/spool/cron/crontabs
  • crontab -
  • chattr -ia /etc/cron.daily/apt-compat
  • chmod +x /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig /bin/crondr
  • /usr/bin/mawk awk {print $1}
  • chattr -i -a /etc/init.d/pwnrig /bin/initdr
  • /usr/bin/perl /sbin/update-rc.d -f pwnrig remove
  • cp -f -r -- /tmp/-bash-bb2ae934-a6d7-4601-badd-351f6f48bb11 /bin/bprofr
  • chattr -ia /etc/cron.d/e2scrub_all
  • hostname -I
  • chattr -ia /etc/cron.daily/man-db
  • /tmp/a2111094-ed6c-4561-9b8f-61d4e2c9c07b kworker/R-debug
  • ps x
  • /bin/sh /bin/which chkconfig
  • /usr/bin/mawk awk {if($3>30.0) print $2}
  • chattr -ia /etc/cron.daily/logrotate
  • wc -l
  • cp -f -r -- /tmp/-bash-bb2ae934-a6d7-4601-badd-351f6f48bb11 /bin/crondr
  • cat /etc/ssh/sshd_config
  • <0x1b4>
  • chattr -ia /etc/cron.daily/.placeholder
  • /tmp/-bash-bb2ae934-a6d7-4601-badd-351f6f48bb11 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
  • /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
  • <0x21d>
  • /usr/bin/perl /sbin/update-rc.d pwnrig defaults
  • /usr/bin/perl /sbin/update-rc.d pwnrig enable
  • chattr -ia /etc/cron.d/.placeholder
  • grep -c ^processor /proc/cpuinfo
  • chattr -ia /etc/cron.weekly/.placeholder
  • ps -A -ostat,ppid
  • id -u
  • ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
  • grep /etc/cron
  • whoami
  • bash -c find /mnt -type f -regextype egrep -regex \x27.*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\x27 -exec rm -rf {} +
  • <0x2d3>
  • sed -e s/^ *//
  • /tmp/-bash-bb2ae934-a6d7-4601-badd-351f6f48bb11 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn
  • chattr -i -a /bin/bprofr ~/.bash_profile
  • sed -i /bprofr/d ~/.bash_profile
  • tee /etc/init.d/pwnrig
  • rm -rf /bin/crondr
  • chattr -ia /etc/cron.monthly/.placeholder
  • grep -v grep
  • rm -rf /bin/initdr
  • /bin/sh /bin/which update-rc.d
  • rm -rf /bin/bprofr
  • find /mnt -type f -regextype egrep -regex .*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12} -exec rm -rf {} +
  • cut -d: -f2
  • grep -v -- -bash[[:space:]]*$
  • bash -c echo \x22*/2 * * * * nohup /mnt/ddc712b2-b36f-435f-a436-7c2c013836d8 >/dev/null 2>&1 &\x22 | crontab -
  • grep -- -bash[[:space:]]*$
  • <0x93>
  • chattr -i -a /etc/cron.*/pwnrig /bin/crondr
  • sed -i 1 s/-e // /etc/cron.d/pwnrig /etc/cron.daily/pwnrig /etc/cron.hourly/pwnrig /etc/cron.monthly/pwnrig /etc/cron.weekly/pwnrig
  • chattr -ia /etc/cron.hourly/.placeholder
  • grep -m 1 model name /proc/cpuinfo
  • sed -e s/$//
  • grep -v /usr/sbin/httpd
  • chattr -ia /etc/cron.daily/dpkg
  • chattr +i +a /bin/bprofr ~/.bash_profile
  • cp -f -r -- /tmp/-bash-bb2ae934-a6d7-4601-badd-351f6f48bb11 /bin/initdr
Performs operations with the file system:
Modifies file access rights:
  • /tmp/a2111094-ed6c-4561-9b8f-61d4e2c9c07b
  • /etc/init.d/dpkg-deb-package
  • /usr/bin/dpkg-debian
  • /var/spool/cron/crontabs/tmp.2pFFyA
  • /etc/cron.d/pwnrig
  • /etc/cron.daily/pwnrig
  • /etc/cron.hourly/pwnrig
  • /etc/cron.monthly/pwnrig
  • /etc/cron.weekly/pwnrig
  • /usr/bin/crondr
  • /etc/init.d/pwnrig
  • /usr/bin/initdr
Modifies file owner:
  • /var/spool/cron/crontabs
  • /etc/cron.d/sedxPOeCk
  • /etc/cron.daily/sedOgCaql
  • /etc/cron.hourly/sedkMEnmi
  • /etc/cron.monthly/sedEliv5k
  • /etc/cron.weekly/sedqHk7Mh
  • /etc/init.d/sedHPXbqg
Creates folders:
  • /var/spool/cron/crontabs
Deletes folders:
  • /var/spool/cron/crontabs
Creates or modifies files:
  • /tmp/a2111094-ed6c-4561-9b8f-61d4e2c9c07b
  • /tmp/06998ce3-4e5c-4666-928c-e25b4f5d98c5
  • /etc/systemd/system/dpkg-deb-package.service
  • /usr/bin/dpkg-debian
  • /tmp/-bash-bb2ae934-a6d7-4601-badd-351f6f48bb11
  • /var/spool/cron/dbus-manager
  • /mnt/ddc712b2-b36f-435f-a436-7c2c013836d8
  • /var/spool/cron/crontabs/tmp.2pFFyA
  • /tmp/.lock
  • /sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages
  • /usr/bin/bprofr
  • /root/.bash_profile
  • /usr/bin/crondr
  • /usr/bin/initdr
Deletes files:
  • /etc/cron.d/.placeholder
  • /etc/cron.d/e2scrub_all
  • /var/spool/cron/crontabs
  • /etc/cron.hourly/.placeholder
  • /etc/cron.daily/.placeholder
  • /etc/cron.daily/apt-compat
  • /etc/cron.daily/dpkg
  • /etc/cron.daily/logrotate
  • /etc/cron.daily/man-db
  • /etc/cron.weekly/.placeholder
  • /etc/cron.weekly/man-db
  • /etc/cron.monthly/.placeholder
Locks files:
  • /tmp/.lock
Changes time of creation/access/modification of files:
  • /var/spool/cron/crontabs
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:10444
Establishes connection:
  • 68.##3.84.27:80
DNS ASK:
  • ru#.##-demand.pw
Sends data to the following servers:
  • 68.##3.84.27:80
Receives data from the following servers:
  • 68.##3.84.27:80
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number