Linux.Siggen.5562
Added to the Dr.Web virus database:
2023-08-09
Virus description added:
2023-08-09
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /var/spool/cron/crontabs/root
Malicious functions:
Gets access to SSH keys
Launches processes:
- crontab -
- (2>/dev/null crontab -l ; echo \x22*/1 * * * * ~/.ssh/<SAMPLE> -mc\x22) | crontab -
- crontab -l
- ~/.ssh/<SAMPLE> -ms
Performs operations with the file system:
Modifies file access rights:
- /var/spool/cron/crontabs/tmp.zjo5uv
Creates or modifies files:
- /var/spool/cron/crontabs/tmp.zjo5uv
- /var/spool/cron/.ssh/.c
Changes time of creation/access/modification of files:
Other:
Collects CPU information
Collects RAM information
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息