Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.4367

Added to the Dr.Web virus database: 2022-01-29

Virus description added:

Technical Information

Malicious functions:
Gains root privileges
Compiles a program from source codes:
  • gcc pwnkit/pwnkit.c -o pwnkit/pwnkit.so -shared -fPIC
Launches processes:
  • mkdir -p GCONV_PATH=.
  • touch GCONV_PATH=./pwnkit
  • chmod a+x GCONV_PATH=./pwnkit
  • mkdir -p pwnkit
  • /usr/bin/pkexec (null
  • rm -rf GCONV_PATH=. pwnkit
Performs operations with the file system:
Modifies file access rights:
  • /root/GCONV_PATH=./pwnkit
  • /root/pwnkit/pwnkit.so
Creates folders:
  • /root/GCONV_PATH=.
  • /root/pwnkit
Creates or modifies files:
  • /root/GCONV_PATH=./pwnkit
  • /root/pwnkit/gconv-modules
  • /root/pwnkit/pwnkit.c
  • /tmp/cc1Z9h5t.s
  • /tmp/ccz28Lk1.o
  • /tmp/cc7BHCWz.res
  • /tmp/ccvOGoy7.c
  • /tmp/ccAgZ4FG.o
  • /tmp/cc2bbpOf.ld
  • /tmp/ccszRmXO.le
  • /root/pwnkit/pwnkit.so
Deletes files:
  • /tmp/cc2bbpOf.ld
  • /tmp/ccszRmXO.le
  • /tmp/ccvOGoy7.c
  • /tmp/ccAgZ4FG.o
  • /tmp/cc7BHCWz.res
  • /tmp/ccz28Lk1.o
  • /tmp/cc1Z9h5t.s
  • /root/pwnkit
Other:
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number