Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.7802

Added to the Dr.Web virus database: 2024-07-16

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/rc.d/init.d/tcp4
  • /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Manages services:
  • ['systemctl', 'daemon-reload', 'redis.service']
  • ['systemctl', 'enable ', 'redis.service']
  • ['systemctl', 'daemon-reload', 'mysql.service']
  • ['systemctl', 'enable ', 'mysql.service']
Launches processes:
  • mv /usr/bin/ls /usr/bin/.ls
  • uname -r
  • uname -m
  • mv /usr/bin/kill /usr/bin/.kill
  • mount -o bind /var /proc/502/
  • <SAMPLE_FULL_PATH> d
  • crontab /var/.recovery
  • <SAMPLE_FULL_PATH> e
Kills the following processes:
  • rcu_sched
  • rcu_bh
  • kworker/u3:0
  • jbd2/sda1-8
  • ext4-rsv-conver
  • migration/0
  • cpuhp/0
  • kdevtmpfs
  • netns
  • kauditd
  • khungtaskd
  • oom_reaper
  • kthreadd
  • writeback
  • kcompactd0
  • ksmd
  • crypto
  • kintegrityd
  • kblockd
  • ata_sff
  • devfreq_wq
  • watchdogd
  • kworker/0:1H
  • rcu_gp
  • kswapd0
  • kworker/0:1
  • rcu_par_gp
  • kthrotld
  • ipv6_addrconf
  • 9bc2fd2a
  • kworker/u2:2
  • kworker/0:0
  • <SAMPLE>
  • systemctl
  • kstrp
  • kworker/0:0H
  • kworker/u2:0
  • mm_percpu_wq
  • ksoftirqd/0
  • scsi_eh_0
  • scsi_tmf_0
  • scsi_eh_1
  • scsi_tmf_1
  • kworker/0:2
  • kernal
  • dash
  • apt-config
Performs operations with the file system:
Modifies file access rights:
  • /var/spool/cron/crontabs/tmp.NHy9Sm
Creates folders:
  • /var/web
Creates or modifies files:
  • /opt/cgo
  • /etc/default_dns.conf
  • /tmp/.system
  • /dev/watchdog
  • /var/kernal
  • /var/web/media.jpg
  • /var/.recovery
  • /usr/lib/readdir.so
  • /etc/systemd/system/redis.service
  • /var/spool/cron/crontabs/tmp.NHy9Sm
  • /etc/systemd/system/mysql.service
  • /usr/bin/kill
  • /usr/bin/ls
Deletes files:
  • /var/temp_check_permissions
Mounts file systems:
  • /var
Changes time of creation/access/modification of files:
  • /var/spool/cron/crontabs
Network activity:
Establishes connection:
  • 20#.##1.36.137:9090
Sends data to the following servers:
  • 20#.##1.36.137:9090
Receives data from the following servers:
  • 20#.##1.36.137:9090
Other:
Collects CPU information
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number