DLA UŻYTKOWNIKÓW

My library

+ Add to library

Search

24/7 Tech support | Rules regarding submitting

Send a message

Call us

+7 (495) 789-45-86

Forum

PL

RU CN DE EN ES FR IT JP KZ UZ PL BY

Support services

Dr.Web vxCube

Sign in to Dr.Web vxCube

VCI investigations

Virus library

Knowledge base

Technologies

Terminology

Training and education

Myths

Myths about anti-viruses

Linux.Siggen.5719

Added to the Dr.Web virus database: 2023-10-07

Virus description added: 2023-10-07

Technical Information

Malicious functions:

Substitutes application name for:

<SAMPLE>

Launches processes:

/bin/sh -c uname -p 2> /dev/null
uname -p

Performs operations with the file system:

Modifies file access rights:

/tmp/_MEI0ARScA/lib-dynload/_bz2.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_cn.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_hk.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_iso2022.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_jp.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_kr.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_tw.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_hashlib.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_lzma.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_multibytecodec.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_ssl.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/resource.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/termios.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/libbz2.so.1.0.4
/tmp/_MEI0ARScA/libcrypto.so.1.1
/tmp/_MEI0ARScA/libexpat.so.1.6.7
/tmp/_MEI0ARScA/liblzma.so.5.2.2
/tmp/_MEI0ARScA/libpython3.7m.so.1.0
/tmp/_MEI0ARScA/libssl.so.1.1
/tmp/_MEI0ARScA/libz.so.1.2.11
/tmp/_MEI0ARScA/base_library.zip

Creates folders:

/tmp/_MEI0ARScA
/tmp/_MEI0ARScA/lib-dynload

Creates or modifies files:

/tmp/_MEI0ARScA/lib-dynload/_bz2.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_cn.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_hk.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_iso2022.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_jp.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_kr.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_codecs_tw.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_hashlib.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_lzma.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_multibytecodec.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/_ssl.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/resource.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/lib-dynload/termios.cpython-37m-x86_64-linux-gnu.so
/tmp/_MEI0ARScA/libbz2.so.1.0.4
/tmp/_MEI0ARScA/libcrypto.so.1.1
/tmp/_MEI0ARScA/libexpat.so.1.6.7
/tmp/_MEI0ARScA/liblzma.so.5.2.2
/tmp/_MEI0ARScA/libpython3.7m.so.1.0
/tmp/_MEI0ARScA/libssl.so.1.1
/tmp/_MEI0ARScA/libz.so.1.2.11
/tmp/_MEI0ARScA/base_library.zip

Network activity:

Awaits incoming connections on ports:

0.0.0.0:9990

Curing recommendations

Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number