Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.4355

Added to the Dr.Web virus database: 2022-01-26

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/rc.local
  • /etc/rc.d/rc.local
Malicious functions:
Performs process tracing:
  • <SAMPLE>
  • <SAMPLE_FULL_PATH>
Modifies firewall settings:
  • iptables -A INPUT -p udp -m udp --sport 10004 -j ACCEPT
  • iptables -A INPUT -p tcp -m tcp --sport 10004 -j ACCEPT
  • iptables -A FORWARD -p udp -m udp --dport 10004 -j ACCEPT
  • iptables -A FORWARD -p tcp -m tcp --dport 10004 -j ACCEPT
  • iptables -A OUTPUT -p udp -m udp --dport 10004 -j ACCEPT
  • iptables -A OUTPUT -p tcp -m tcp --dport 10004 -j ACCEPT
Launches processes:
  • /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
  • <SAMPLE_FULL_PATH>
  • /bin/bash <SAMPLE_FULL_PATH> -c
  • hostname
  • sed -r s/[^a-zA-Z0-9\-]+/_/g
  • cut -f1 -d.
  • sed -i s/\"pass\": *\"[^\"]*\
  • mkdir /etc/sysconfig
  • iptables-save
  • iptables-restore /etc/sysconfig/iptables
  • iptables-restore /etc/iptables
  • mkdir /usr/src
  • chattr -R -iadA /usr/bin
  • chattr -R -iadA /usr/sbin
  • cp /usr/bin/chattr /usr/bin/t
  • yes
  • cp /usr/bin/chattr /usr/bin/lynx
  • lynx -r -iadA /usr/sbin
  • lynx -R -iadA /usr/bin
  • cp /usr/bin/lockr /usr/bin/t
  • cp /usr/bin/lockr /usr/bin/lynx
  • lynx -R -iadA /usr/src
Kills the following processes:
  • <SAMPLE>
  • <SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates folders:
  • /etc/sysconfig
Creates or modifies files:
  • /etc/sysconfig/iptables
  • /etc/iptables
  • /usr/bin/t
  • /usr/bin/lynx
Network activity:
Establishes connection:
  • [:##]:10004
  • 127.0.0.1:10004
Other:
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number