Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Siggen.599

Added to the Dr.Web virus database: 2018-05-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/crontab
Malicious functions:
Launches itself as a daemon
Launches processes:
  • /bin/bash -c echo '0 */12 * * * * root <SAMPLE_FULL_PATH>' >> /etc/crontab
  • /bin/bash -c ./xxsdwak<SAMPLE> -B -o stratum+tcp://xmr.ip28.net:443 -u 45KGejq1HDHXB618E3aeWHFyoLh1kM5syRG8FHDiQ4pZXZF1pieqW7DM5HHe3Y2oc1YwoEc7ofjgtbeEqV3UrkS9SVygJPT -p x -k
  • ./xxsdwak<SAMPLE> -B -o stratum+tcp://xmr.ip28.net:443 -u 45KGejq1HDHXB618E3aeWHFyoLh1kM5syRG8FHDiQ4pZXZF1pieqW7DM5HHe3Y2oc1YwoEc7ofjgtbeEqV3UrkS9SVygJPT -p x -k
Performs operations with the file system:
Creates or modifies files:
  • /root/xxszznk
  • /root/xxsdwak<SAMPLE>
  • /root/.cnrig.cacert.pem
Network activity:
Establishes connection:
  • 16#.##2.205.136:443
  • 15#.##1.84.133:443
DNS ASK:
  • xm#.#p28.net
  • ra#.####ubusercontent.com
Sends data to the following servers:
  • 16#.##2.205.136:443
  • 15#.##1.84.133:443
Receives data from the following servers:
  • 16#.##2.205.136:443
  • 15#.##1.84.133:443
Other:
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number