Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.5704

Added to the Dr.Web virus database: 2023-10-07

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • nfgf0i6ln5p6o
Performs process tracing:
  • swapper/0
Performs operations with the file system:
Deletes folders:
  • <SAMPLE_FULL_PATH>
Creates or modifies files:
  • <SAMPLE_FULL_PATH>
Deletes files:
  • <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:13289
Establishes connection:
  • 8.#.8.8:53
  • 5.###.227.65:2231
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 60.###.235.71:23
  • 10.###.42.139:23
  • 63.###.158.56:23
  • 23#.##0.183.37:23
  • 22#.##9.191.172:23
  • 5.###.246.72:23
  • 14#.##8.233.181:23
  • 22#.##.243.17:23
  • 17#.#.164.69:23
  • 10#.##4.214.254:23
  • 18#.##8.188.149:23
  • 24#.##2.113.21:23
  • 22#.#8.90.39:23
  • 20#.##6.149.78:23
  • 18#.##5.231.121:23
  • 14#.##1.234.28:23
  • 23.##.249.182:23
  • 26.##.185.157:23
  • 24#.##0.42.34:23
  • 66.###.102.50:23
  • 7.###.21.219:23
  • 77.##.84.184:23
  • 24#.##4.171.194:23
  • 3.##.128.169:23
  • 18.##.112.111:23
  • 20#.##9.126.221:23
  • 23#.##6.40.48:23
  • 14#.##.93.125:23
  • 22#.#.119.208:23
  • 17#.##5.47.249:23
  • 18#.##8.144.215:23
  • 18#.##3.1.183:23
  • 22#.##2.169.197:23
  • 10#.##3.230.17:23
  • 17#.##.231.23:23
  • 13#.##.105.18:23
  • 39.##.203.6:23
  • 20.###.154.171:23
  • 11#.##1.124.107:23
  • 20#.##6.18.246:23
  • 10#.##5.222.96:23
  • 18#.##3.119.22:23
  • 22#.##3.231.88:23
  • 24#.#.57.48:23
  • 16#.#9.211.4:23
  • 24#.##.184.157:23
  • 97.###.221.244:23
  • 22#.##2.73.181:23
  • 18#.#.214.222:23
  • 22#.#.141.166:23
  • 11.###.150.252:23
  • 18#.##.97.180:23
  • 14#.##.130.208:23
  • 18#.##.160.216:23
  • 53.###.210.14:23
  • 12#.##4.205.47:23
  • 52.###.219.210:23
  • 12.###.171.146:23
  • 21#.##9.180.226:23
  • 24#.##8.89.252:23
  • 27.###.154.81:23
  • 10#.##0.179.120:23
  • 17.##.156.67:23
  • 23.###.91.231:23
  • 33.##.72.93:23
  • 19#.#5.7.119:23
  • 17#.##.180.199:23
  • 12#.##.58.161:23
  • 33.###.169.150:23
  • 17#.##4.84.54:23
  • 71.#.118.38:23
  • 86.##.217.156:23
  • 25#.#6.1.251:23
  • 19#.##.123.183:23
  • 21#.##9.181.100:23
  • 15#.##.223.70:23
  • 12#.##4.176.42:23
  • 17#.##2.44.26:23
  • 45.##.2.115:23
  • 12#.##.108.253:23
  • 20#.##.245.26:23
  • 64.##.6.102:23
  • 21#.##.177.44:23
  • 6.###.100.189:23
  • 18.###.189.90:23
  • 20#.##3.212.184:23
  • 97.###.66.245:23
  • 23#.##0.71.49:23
  • 11#.##7.132.165:23
  • 18#.##.158.154:23
  • 14#.##2.155.252:23
  • 19#.##8.242.248:23
  • 19.##.65.72:23
  • 31.##.248.125:23
  • 22#.##.253.218:23
  • 10#.##5.167.147:23
  • 11#.#.79.107:23
  • 11#.##.82.232:23
  • 21#.##1.100.230:23
  • 54.###.168.64:23
  • 53.###.135.39:23
  • 68.##4.92.68:23

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number