Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Siggen.4186

Added to the Dr.Web virus database: 2021-08-18

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Modifies firewall settings:
  • iptables -I INPUT -s 8.210.0.0/16 -j ACCEPT
  • iptables -I OUTPUT -s 8.210.0.0/16 -j ACCEPT
  • iptables -I INPUT -s 8.9.0.0/16 -j ACCEPT
  • iptables -I OUTPUT -s 8.9.0.0/16 -j ACCEPT
  • iptables -I INPUT -s 45.76.0.0/16 -j ACCEPT
  • iptables -I OUTPUT -s 45.76.0.0/16 -j ACCEPT
  • iptables -I INPUT -s 202.182.0.0/16 -j ACCEPT
  • iptables -I OUTPUT -s 202.182.0.0/16 -j ACCEPT
  • iptables -I INPUT -s 108.61.0.0/16 -j ACCEPT
  • iptables -I OUTPUT -s 108.61.0.0/16 -j ACCEPT
  • iptables -I INPUT -s 45.77.0.0/16 -j ACCEPT
  • iptables -I OUTPUT -s 45.77.0.0/16 -j ACCEPT
Manages services:
  • service iptables restart
  • systemctl restart iptables.service
Launches processes:
  • sh -c iptables -I INPUT -s 8.210.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 8.210.0.0/16 -j ACCEPT
  • sh -c iptables -I INPUT -s 8.9.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 8.9.0.0/16 -j ACCEPT
  • sh -c iptables -I INPUT -s 45.76.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 45.76.0.0/16 -j ACCEPT
  • sh -c iptables -I INPUT -s 202.182.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 202.182.0.0/16 -j ACCEPT
  • sh -c iptables -I INPUT -s 108.61.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 108.61.0.0/16 -j ACCEPT
  • sh -c iptables -I INPUT -s 45.77.0.0/16 -j ACCEPT;iptables -I OUTPUT -s 45.77.0.0/16 -j ACCEPT
Performs operations with the file system:
Creates or modifies files:
  • /tmp/.vos30000.srv
  • /etc/acpi/events/.kunshi_sys.conf
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:9091
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 95.###.130.69:8099
DNS ASK:
  • sv##.z97.co

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number