Linux.Siggen.6485

Added to the Dr.Web virus database: 2024-01-24

Virus description added: 2024-01-23

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Manages services:

Launches processes:

crontab -l
cp \x27<SAMPLE_FULL_PATH>\x27 \x27/usr/bin/4752558e\x27
(crontab -l 2>/dev/null; echo \x22@reboot /usr/bin/4752558e\x22) | crontab -
chmod +x \x27/etc/init.d/mushi_1697006310\x27 && update-rc.d \x27/etc/init.d/mushi_1697006310\x27 defaults
cp <SAMPLE_FULL_PATH> /usr/bin/4752558e
chmod +x /etc/init.d/mushi_1697006310
/usr/bin/perl /usr/sbin/update-rc.d /etc/init.d/mushi_1697006310 defaults
systemctl daemon-reload && systemctl enable /etc/systemd/system/mushi1697006311.service
crontab -

Kills the following processes:

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Changes time of creation/access/modification of files:

Network activity:

Awaits incoming connections on ports:

Establishes connection:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers: