Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.654

Added to the Dr.Web virus database: 2018-06-10

Virus description added:

Technical Information

Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
  • bphekotvft
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:3902
Establishes connection:
  • <LOCAL_DNS_SERVER>
  • 18#.##1.97.249:5600
  • 23.###.50.205:80
HTTP GET requests:
  • http://###.#33.2.213/
DNS ASK:
  • i.##ppr.cc
Sends data to the following servers:
  • 14#.##9.157.250:80
  • 25#.##6.250.86:80
  • 31.##.113.181:80
  • 11#.##4.90.20:80
  • 18.##.206.190:80
  • 19#.##1.47.70:80
  • 23.###.50.205:80
  • 22#.##6.200.89:80
  • 25#.##0.163.153:80
  • 21#.##.158.180:80
  • 22#.##3.239.158:80
  • 15#.##1.247.125:80
  • 14#.##9.92.202:80
  • 24#.##9.161.148:80
  • 15#.##8.225.103:80
  • 24#.##2.105.217:80
  • 13#.##1.157.252:80
  • 21#.##9.107.29:80
  • 21#.##.246.106:80
  • 22#.##.201.78:80
  • 84.##.116.140:80
  • 21#.##1.64.114:80
  • 53.###.130.75:80
  • 19#.##5.231.162:80
  • 12.###.96.151:80
  • 25#.##7.175.148:80
  • 23#.##.54.228:80
  • 57.##0.53.6:80
  • 19#.##8.41.177:80
  • 16#.##4.119.100:80
  • 39.###.229.15:80
  • 20#.##6.123.131:80
  • 71.##.244.161:80
  • 22#.##5.57.90:80
  • 22#.##1.105.119:80
  • 22#.##1.220.221:80
  • 10#.##.146.134:80
  • 24.##.33.185:80
  • 10#.#.183.14:80
  • 76.###.170.22:80
  • 25.###.168.186:80
  • 25.###.197.80:80
  • 16#.##5.166.8:80
  • 15#.##.84.144:80
  • 95.###.170.201:80
  • 60.##.20.129:80
  • 18#.##7.70.100:80
  • 19#.##.116.194:80
  • 21#.##.232.119:80
  • 11#.##6.77.180:80
  • 19#.##9.126.91:80
  • 54.###.183.189:80
  • 11#.##.156.117:80
  • 27.###.156.234:80
  • 29.###.194.39:80
  • 10#.##.199.52:80
  • 12#.##1.250.143:80
  • 78.###.216.222:80
  • 18#.##.246.92:80
  • 18#.#.13.241:80
  • 13#.##.116.95:80
  • 22#.##4.215.231:80
  • 24#.##2.155.254:80
  • 56.##9.2.18:80
  • 90.###.154.56:80
  • 11#.##2.196.235:80
  • 17#.##2.41.207:80
  • 16#.##6.141.140:80
  • 15#.##.102.201:80
  • 18#.##3.235.39:80
  • 17#.##2.39.251:80
  • 75.##.41.235:80
  • 14#.##2.21.251:80
  • 14#.##3.65.191:80
  • 24#.##6.176.148:80
  • 44.##4.9.167:80
  • 24#.##7.157.250:80
  • 20#.##9.204.5:80
  • 13#.##5.209.95:80
  • 24#.##7.222.103:80
  • 16#.##.31.148:80
  • 24#.##.219.243:80
  • 37.###.164.93:80
  • 40.##.145.26:80
  • 78.##.115.109:80
  • 23#.##5.115.19:80
  • 17#.#6.44.37:80
  • 70.##7.91.13:80
  • 98.###.145.225:80
  • 11#.##.206.134:80
  • 49.###.151.209:80
  • 22#.##3.35.25:80
  • 20#.##.232.201:80
  • 20#.##.137.103:80
  • 10#.##3.109.136:80
  • 10#.##4.223.204:80
  • 19#.##.97.225:80
  • 23#.##5.194.216:80
  • 17#.##9.46.206:80
  • 17.##1.229.4:80
  • 56.##5.6.113:80
  • 10#.##1.80.42:80
  • 18.###.213.125:80
  • 27.##.243.170:80
  • 23#.#.141.168:80
  • 22#.##1.235.223:80
  • 13#.##.250.117:80
  • 67.###.140.122:80
  • 19#.##2.202.203:80
  • 62.###.211.78:80
  • 20#.##4.4.157:80
  • 25#.##2.72.224:80
  • 16#.##7.243.120:80
  • 6.###.34.224:80
  • 16#.#.168.185:80
  • 71.##.152.133:80
  • 26.###.249.91:80
  • 17#.##4.93.47:80
  • 32.##6.1.208:80
  • 24#.##.222.251:80
  • 24#.##8.131.123:80
  • 13#.##.109.245:80
  • 17#.##.85.166:80
  • 24#.##1.225.196:80
  • 22#.##2.84.204:80
  • 19#.#.120.213:80
  • 20#.##4.212.165:80
  • 17#.##.183.145:80
  • 15#.##1.184.4:80
  • 22#.##8.58.188:80
  • 12#.##4.189.27:80
  • 19#.##8.28.72:80
  • 14#.##0.119.163:80
  • 23#.##8.227.66:80
  • 21#.##2.8.154:80
  • 13#.##.248.107:80
  • 36.###.136.47:80
  • 16#.##0.11.251:80
  • 55.###.219.98:80
  • 19#.##5.146.77:80
  • 24#.##9.2.173:80
  • 6.###.27.94:80
  • 70.###.172.230:80
  • 53.##.252.236:80
  • 11#.##9.97.189:80
  • 51.###.163.40:80
  • 54.###.59.154:80
  • 2.###.22.74:80
  • 18#.##6.237.170:80
  • 83.###.47.212:80
  • 12#.##1.243.124:80
  • 17#.#3.43.82:80
  • 4.###.97.194:80
  • 21#.##.190.59:80
  • 19#.##.238.226:80
  • 21#.##8.241.139:80
  • 13.##.122.204:80
  • 16.###.253.119:80
  • 29.##.27.91:80
  • 18#.##1.97.249:5600

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number