Linux.Siggen.6232

Added to the Dr.Web virus database: 2023-12-16

Virus description added: 2023-12-16

Malicious functions:

Removes itself

Gains root privileges

Launches itself as a daemon

Substitutes application name for:

Launches processes:

netstat -nlp | grep \x27:22 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
grep :111
netstat -nlp
grep :40326
/usr/bin/mawk awk -F: {print $NF}
pgrep -o .
cut -d/ -f1
grep :50801
netstat -nlp | grep \x27:111 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
sort -u
/usr/bin/mawk awk /^tcp/ {print $4}
netstat -nlp | grep \x27:25 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
netstat -nlp | grep \x27:40326 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
netstat -nlp | grep \x27:50801 \x27 | awk \x27{print $7}\x27 | cut -d/ -f1
grep :22
grep :25
/usr/bin/mawk awk {print $7}
netstat -nlp | awk \x27/^tcp/ {print $4}\x27 | awk -F\x27:\x27 \x27{print $NF}\x27 | sort -u

Kills system processes:

Kills the following processes:

Performs operations with the file system:

Deletes folders:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

Sends data to the following servers:

Receives data from the following servers:

Other:

Collects CPU information

Collects RAM information