JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.7788
Added to the Dr.Web virus database:
2024-07-12
Virus description added:
2024-07-12
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/dpkg-deb-package
/etc/cron.d/dbus-manager
/etc/cron.hourly/dbus-manager
/etc/cron.daily/dbus-manager
/etc/cron.weekly/dbus-manager
/etc/cron.monthly/dbus-manager
/var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
bash -c echo \x22*/2 * * * * nohup /run/user/0/6a954ee5-5528-4193-9e69-8978fd2693a2 >/dev/null 2>&1 &\x22 | crontab -
ps -A -ostat,ppid
/usr/bin/mawk awk {print $1}
ps aux
chattr -ia /etc/cron.weekly/.placeholder
/tmp/592f1dcd-d7e9-4242-be46-1a4b1befa18f kworker/R-debug
head -n 1
bash -c find /run/user/0 -type f -regextype egrep -regex \x27.*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\x27 -exec rm -rf {} +
whoami
grep /etc/cron
grep -v /usr/sbin/httpd
find /run/user/0 -type f -regextype egrep -regex .*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12} -exec rm -rf {} +
chattr -ia /etc/cron.daily/logrotate
hostname -I
ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
grep -v grep
chattr -ia /etc/cron.daily/dpkg
cat /etc/ssh/sshd_config
crontab -
sed -e s/$//
/tmp/-python37-88bf08d7-81c8-4ada-a240-b8e6f9cf8add /tmp/-python37-88bf08d7-81c8-4ada-a240-b8e6f9cf8add
chattr -ia /etc/cron.weekly/man-db
chattr -ia /etc/cron.d/e2scrub_all
chattr -ia /etc/cron.daily/apt-compat
/usr/bin/mawk awk {print \x22-\x22$2}
<0x1b2>
grep -v -- -bash[[:space:]]*$
grep -- -bash[[:space:]]*$
cut -d: -f2
<0x1a>
<0xf5>
id -u
grep -c ^processor /proc/cpuinfo
hostname
chattr -ia /etc/cron.monthly/.placeholder
chattr -ia /etc/cron.hourly/.placeholder
/tmp/-bash-88bf08d7-81c8-4ada-a240-b8e6f9cf8add /tmp/-bash-88bf08d7-81c8-4ada-a240-b8e6f9cf8add -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
grep -m 1 model name /proc/cpuinfo
chattr -ia /etc/cron.daily/.placeholder
grep Port
chattr -ia /var/spool/cron/crontabs
wc -l
/usr/bin/mawk awk {if($3>30.0) print $2}
ps x
chattr -ia /etc/cron.daily/man-db
/usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
chattr -ia /etc/cron.d/.placeholder
sed -e s/^ *//
Kills the following processes:
Performs operations with the file system:
Modifies file access rights:
/tmp/592f1dcd-d7e9-4242-be46-1a4b1befa18f
/etc/init.d/dpkg-deb-package
/usr/bin/dpkg-debian
/var/spool/cron/crontabs/tmp.nyoEZB
Modifies file owner:
Creates folders:
Deletes folders:
Creates or modifies files:
/tmp/592f1dcd-d7e9-4242-be46-1a4b1befa18f
/tmp/fd7a9cc2-4fdd-4b3f-8855-5df83ddef75e
/etc/systemd/system/dpkg-deb-package.service
/usr/bin/dpkg-debian
/tmp/-bash-88bf08d7-81c8-4ada-a240-b8e6f9cf8add
/var/spool/cron/dbus-manager
/run/user/0/6a954ee5-5528-4193-9e69-8978fd2693a2
/var/spool/cron/crontabs/tmp.nyoEZB
/tmp/.lock
/tmp/-python37-88bf08d7-81c8-4ada-a240-b8e6f9cf8add
/tmp/.bashirc
Deletes files:
/etc/cron.d/.placeholder
/etc/cron.d/e2scrub_all
/var/spool/cron/crontabs
/etc/cron.hourly/.placeholder
/etc/cron.daily/.placeholder
/etc/cron.daily/apt-compat
/etc/cron.daily/dpkg
/etc/cron.daily/logrotate
/etc/cron.daily/man-db
/etc/cron.weekly/.placeholder
/etc/cron.weekly/man-db
/etc/cron.monthly/.placeholder
/tmp/-bash-88bf08d7-81c8-4ada-a240-b8e6f9cf8add
/tmp/-python37-88bf08d7-81c8-4ada-a240-b8e6f9cf8add
Locks files:
Changes time of creation/access/modification of files:
Network activity:
Awaits incoming connections on ports:
Establishes connection:
16#.##.162.175:80
80.##.24.30:80
DNS ASK:
ru#.##-demand.pw
c4####cd.pwndns.pw
Sends data to the following servers:
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK