JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.6749
Added to the Dr.Web virus database:
2024-03-15
Virus description added:
2024-03-15
Technical Information
Malicious functions:
Launches itself as a daemon
Removes the following system files:
/usr/bin/udevadm
/usr/sbin/cron
/usr/bin/dbus-daemon
/usr/sbin/agetty
/usr/sbin/sshd
/usr/sbin/dhclient
/usr/bin/bash
/usr/bin/tmux
/usr/bin/dash
Kills system processes:
Kills the following processes:
systemd-journal
systemd-udevd
systemd-timesyn
cron
dbus-daemon
systemd-logind
agetty
systemd
(sd-pam)
dhclient
run.sh
(ogrotate)
tmux: client
dash
Performs operations with the file system:
Modifies file access rights:
/var/tmp/MX0Rp6R0y8dQHIXFYqLhDgP7q
Creates or modifies files:
/var/tmp/MX0Rp6R0y8dQHIXFYqLhDgP7q
Deletes files:
/usr/lib/systemd/systemd-journald
/usr/lib/systemd/systemd-timesyncd
/usr/lib/systemd/systemd-logind
/usr/lib/systemd/systemd
Mounts file systems:
Network activity:
Awaits incoming connections on ports:
127.0.0.1:65528
127.0.0.1:65531
Establishes connection:
45.##.146.93:82
94.###.188.167:82
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK