Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.2067

Added to the Dr.Web virus database: 2019-08-12

Virus description added:

Technical Information

Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
  • grep -v grep
  • ps
  • grep tcpdump
  • ps aux
  • ps -w
Performs operations with the file system:
Creates or modifies files:
  • /root/.torrc_5
Deletes files:
  • /root/.torrc_5
  • /root/_wfs34d53uioj_rtg564w-__ewfd-ad--sdf.ad3sf/key-pinning-entries_5
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:60005
  • 0.0.0.0:20005
  • 0.0.0.0:40005
Establishes connection:
  • 127.0.0.1:60001
  • 127.0.0.1:60002
  • 127.0.0.1:60003
  • 127.0.0.1:60004
  • 18.#.0.1:9
  • 13#.###.47.229:30004
  • 45.##.110.200:30004
Other:
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number