JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.7832
Added to the Dr.Web virus database:
2024-07-24
Virus description added:
2024-07-24
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Launches processes:
crontab -r
command -v php >/dev/null 2>&1
which httpd
which apache2
command -v nginx >/dev/null 2>&1
/bin/sh /usr/bin/which httpd
/usr/sbin/xtables-nft-multi iptables -I INPUT -p tcp --dport 11460 -j ACCEPT
/bin/sh /usr/bin/which apache2
crontab -r >/dev/null 2>&1; echo \x22@reboot <SAMPLE_FULL_PATH>\x22 | crontab -
iptables -I INPUT -p tcp --dport 11460 -j ACCEPT >/dev/null 2>&1
crontab -
command -v crontab >/dev/null 2>&1
Performs operations with the file system:
Modifies file access rights:
/var/spool/cron/crontabs/tmp.Z61LR0
Creates or modifies files:
/var/spool/cron/crontabs/tmp.Z61LR0
Changes time of creation/access/modification of files:
Other:
Collects CPU information
Collects RAM information
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK