Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Linux.Siggen.1501
Added to the Dr.Web virus database:
2019-03-08
Virus description added:
2019-03-08
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/samba
/etc/rc.local
Malicious functions:
Launches itself as a daemon
Launches processes:
<SAMPLE_FULL_PATH> postgresql-auto-update
/root/linux-gnu system-update
/bin/sh -c cd /tmp/seconfig/ && /bin/sh z.sh
/bin/sh z.sh
/bin/sh -c /tmp/seconfig/xorgg
/tmp/seconfig/xorgg
Performs operations with the file system:
Creates folders:
/tmp/seconfig
/etc/seconfig
Creates or modifies files:
/root/linux-gnu
<SAMPLE_FULL_PATH>
/tmp/seconfig//xorgg
/tmp/seconfig/xorgg
/tmp/seconfig/config.json
Deletes files:
/var/log/utmp
/var/log/wtmp
/var/log/lastlog
/var/log/secure
/root/linux-gnu
/tmp/seconfig/z.sh
Network activity:
Awaits incoming connections on ports:
127.0.0.1:47292
127.0.0.1:37373
Establishes connection:
10#.##3.83.23:27
<LOCAL_DNS_SERVER>
37.##.45.174:0
78.##.91.134:0
37.##.44.93:0
37.##.54.205:0
37.##7.154.79:0
17#.#.53.68:0
37.##.55.60:0
17#.#.53.68:7777
HTTP GET requests:
21#.###.114.75/iizxcv.sh
21#.###.##4.75/xorgg_linux_amd64
21#.##5.114.75/con
DNS ASK:
Sends data to the following servers:
Receives data from the following servers:
10#.##3.83.23:27
17#.#.53.68:7777
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK