Mi biblioteca
Mi biblioteca

+ Añadir a la biblioteca

Soporte
Soporte 24 horas | Normas de contactar

Sus solicitudes

Perfil

Linux.Siggen.6745

Added to the Dr.Web virus database: 2024-03-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/<SAMPLE>
Malicious functions:
Launches processes:
  • cp -f <SAMPLE_FULL_PATH> /etc/init.d/
  • /tmp/wc071txf36ca1a78/9w21y4iozkq8c84dd4e
  • /bin/sh -c cp -f <SAMPLE_FULL_PATH> /etc/init.d/ > /dev/null 2>&1
Performs operations with the file system:
Modifies file access rights:
  • /tmp/wc071txf36ca1a78/libc.so.0
  • /tmp/wc071txf36ca1a78/ld-uClibc.so.1
  • /tmp/wc071txf36ca1a78/9w21y4iozkq8c84dd4e
Creates folders:
  • /tmp/wc071txf36ca1a78
Deletes folders:
  • /tmp/systemd-private-95298ad62da64de1a9ee6e74ec2d8c27-logrotate.service-ecI5vh/tmp
  • /tmp/systemd-private-95298ad62da64de1a9ee6e74ec2d8c27-logrotate.service-ecI5vh
  • /tmp/tmux-0
  • /tmp/.font-unix
  • /tmp/.X11-unix
  • /tmp/systemd-private-95298ad62da64de1a9ee6e74ec2d8c27-systemd-timesyncd.service-Zvqbaf/tmp
  • /tmp/systemd-private-95298ad62da64de1a9ee6e74ec2d8c27-systemd-timesyncd.service-Zvqbaf
  • /tmp/.ICE-unix
  • /tmp/.XIM-unix
  • /tmp/systemd-private-95298ad62da64de1a9ee6e74ec2d8c27-systemd-logind.service-wQrxif/tmp
  • /tmp/systemd-private-95298ad62da64de1a9ee6e74ec2d8c27-systemd-logind.service-wQrxif
  • /tmp/.Test-unix
Creates or modifies files:
  • /tmp/wc071txf36ca1a78/libc.so.0
  • /tmp/wc071txf36ca1a78/ld-uClibc.so.1
  • /tmp/wc071txf36ca1a78/9w21y4iozkq8c84dd4e
  • /tmp/wc071txf36ca1a78
Deletes files:
  • /tmp/tmux-0/default
Network activity:
Establishes connection:
  • 47.##3.46.11:80
DNS ASK:
  • se####.#ystemupdatecdn.de
Sends data to the following servers:
  • 47.##3.46.11:80
Receives data from the following servers:
  • 47.##3.46.11:80

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number