Para el funcionamiento correcto del sitio web, debe activar el soporte de JavaScript en su navegador.
Linux.Siggen.4081
Added to the Dr.Web virus database:
2021-08-02
Virus description added:
2021-08-01
Technical Information
Malicious functions:
Launches processes:
/bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
<SAMPLE_FULL_PATH>
/bin/bash <SAMPLE_FULL_PATH> -c
mv /bin/pidof /bin/prednizons
id -u
rm -rf /usr/lib/.dsht
rm -rf /usr/lib/scroll
clear
useradd -N -m -r -p 1234567890 aktif
nscd -i passwd
nscd -i group
passwd aktif aktif aktif
mkdir /home/aktif/ads
sleep 3
grep ^NAME
grep CentOS
cat /etc/os-release
grep Ubuntu
grep Debian
apt-get update -y
/usr/bin/dpkg --print-foreign-architectures
/usr/lib/apt/methods/http
Kills the following processes:
/usr/lib/apt/methods/http
Performs operations with the file system:
Modifies file access rights:
/home/aktif
/home/aktif/.bashrc
/home/aktif/.bash_logout
/home/aktif/.profile
/etc/passwd+
/etc/shadow+
/etc/subuid+
/etc/subgid+
Creates folders:
/home/aktif
/home/aktif/ads
Creates symlinks:
/etc/passwd.lock
/etc/group.lock
/etc/gshadow.lock
/etc/subuid.lock
/etc/subgid.lock
/etc/shadow.lock
Creates or modifies files:
/bin/pidof
/etc/.pwd.lock
/etc/passwd.717
/etc/group.717
/etc/gshadow.717
/etc/subuid.717
/etc/subgid.717
/etc/shadow.717
/var/log/faillog
/var/log/lastlog
/home/aktif/.bashrc
/home/aktif/.bash_logout
/home/aktif/.profile
/etc/passwd-
/etc/passwd+
/etc/shadow-
/etc/shadow+
/etc/subuid-
/etc/subuid+
/etc/subgid-
/etc/subgid+
/var/lib/apt/lists/lock
/var/lib/apt/lists/security.debian.org_dists_jessie_updates_InRelease
/var/lib/apt/lists/ftp.ru.debian.org_debian_dists_jessie-updates_InRelease
Deletes files:
/usr/lib/.dsht
/usr/lib/scroll
/etc/passwd.717
/etc/group.717
/etc/gshadow.717
/etc/subuid.717
/etc/subgid.717
/etc/shadow.717
/etc/shadow.lock
/etc/passwd.lock
/etc/group.lock
/etc/gshadow.lock
/etc/subuid.lock
/etc/subgid.lock
Network activity:
Establishes connection:
<LOCAL_DNS_SERVER>
15#.##1.2.132:80
15#.##1.66.132:80
15#.##1.130.132:80
15#.##1.194.132:80
[2####4e42::644]:80
[2#####e42:600::644]:80
[2#####e42:400::644]:80
[2#####e42:200::644]:80
85.###.112.112:80
DNS ASK:
ft#.##.debian.org
se####ty.debian.org
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Descargue Dr.Web para Android
Gratis por 3 meses
Todos los componentes de protección
Renovación de la demo a través de AppGallery/Google Pay
Si Vd. continúa usando este sitio web, esto significa que Vd. acepta el uso de archivos Cookie y otras tecnologías para que recabemos las estadísticas sobre los visitantes. Más información
OK