Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Siggen.3760

Added to the Dr.Web virus database: 2021-03-14

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Modifies firewall settings:
  • iptables -F
Manages services:
  • service iptables stop
  • systemctl stop iptables.service
Launches processes:
  • <SAMPLE_FULL_PATH>
  • bash -c
  • id -u
  • chattr -i /etc/ld.so.preload
  • sysctl kernel.nmi_watchdog=0
  • nproc --all
  • sysctl -w vm.nr_hugepages=1
  • chattr -R -ia /var/spool/cron
  • chattr -ia /etc/crontab
  • chattr -R -ia /var/spool/cron/crontabs
  • chattr -R -ia /etc/cron.d
  • chattr -iua /tmp/
  • chattr -iua /var/tmp/
  • ps aux
  • grep -v grep
  • xargs -I % kill -9 %
  • egrep
  • awk {print $2}
  • grep -E
  • kill -9 705
  • ps auxf
  • egrep xiaoyao|xiaoxue|mine.moneropool.com|pool.t00ls.ru|xmr.crypto-pool.fr|zhuabcn@yahoo.com|monerohash.com|/tmp/a7b104c270|xmrpool.eu|stratum.f2pool.com:8888
  • grep -E xiaoyao|xiaoxue|mine.moneropool.com|pool.t00ls.ru|xmr.crypto-pool.fr|zhuabcn@yahoo.com|monerohash.com|/tmp/a7b104c270|xmrpool.eu|stratum.f2pool.com:8888
  • egrep 2mr.sh|cr5.sh|luk-cpu|ficov|he.sh|nullcrew
  • egrep wget|curl
  • grep -E wget|curl
  • grep -E 2mr.sh|cr5.sh|luk-cpu|ficov|he.sh|nullcrew
Attempts to kill the following processes:
  • killall log_rot
Kills the following processes:
  • run.sh
Performs operations with the file system:
Creates or modifies files:
  • /proc/sys/kernel/nmi_watchdog
  • /etc/sysctl.conf
  • /etc/selinux/config
  • /proc/sys/vm/nr_hugepages
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:52017
Establishes connection:
  • 127.0.0.1:9
  • [:#1]:9
  • [:##]:52017
  • 127.0.0.1:52017
Other:
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number