Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.6731

Added to the Dr.Web virus database: 2024-03-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/dnsconfig
  • /etc/rc.d/init.d/dnsconfigs
  • /var/spool/cron/crontabs/root
Creates or modifies the following symlinks:
  • /etc/rc0.d/S99dnsconfig
  • /etc/rc1.d/S99dnsconfig
  • /etc/rc2.d/S99dnsconfig
  • /etc/rc3.d/S99dnsconfig
  • /etc/rc4.d/S99dnsconfig
  • /etc/rc5.d/S99dnsconfig
  • /etc/rc6.d/S99dnsconfig
  • /etc/rc0.d/S99dnsconfigs
  • /etc/rc1.d/S99dnsconfigs
  • /etc/rc2.d/S99dnsconfigs
  • /etc/rc3.d/S99dnsconfigs
  • /etc/rc4.d/S99dnsconfigs
  • /etc/rc5.d/S99dnsconfigs
  • /etc/rc6.d/S99dnsconfigs
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • (sd-askpwagent)
Manages services:
  • ['systemctl', 'daemon-reload']
  • ['systemctl', 'enable', 'dnsconfigs.service']
  • ['systemctl', 'start', 'dnsconfigs.service']
Launches processes:
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs
  • ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1
  • systemctl start dnsconfigs.service > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig
  • ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig
  • ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs
  • ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1
  • crontab /var/tmp/.recoverys
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1
  • mount -o bind /tmp/nginx_server /proc/731/ > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs
  • ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig
  • systemctl enable dnsconfigs.service > /dev/null 2>&1
  • mount -o bind /tmp/nginx_server /proc/724/
  • ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig
  • mount -o bind /tmp/nginx_server /proc/731/
  • ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig
  • cp -f <SAMPLE_FULL_PATH> /var/tmp/nginx_kel
  • mount -o bind /tmp/nginx_server /proc/724/ > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig
  • ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs
  • ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs
  • ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1
  • systemctl daemon-reload > /dev/null 2>&1
  • ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig
Kills the following processes:
  • systemctl
Performs operations with the file system:
Modifies file access rights:
  • /etc/init.d/dnsconfig
  • /var/spool/cron/crontabs/tmp.2t29vM
Creates folders:
  • /tmp/nginx_server
Creates symlinks:
  • /etc/rcS.d/S99dnsconfig
Creates or modifies files:
  • /var/tmp/.recoverys
  • /var/tmp/nginx_kel
  • /tmp/server_session.lock
  • /var/spool/cron/crontabs/tmp.2t29vM
  • /etc/systemd/system/dnsconfigs.service
  • /dev/tty
Mounts file systems:
  • /tmp/nginx_server
Changes time of creation/access/modification of files:
  • /var/spool/cron/crontabs
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • 12#.#.15.28:123
  • 1.#.0.1:53
  • 14#.##.12.176:24150
  • 14#.##.12.176:17560
DNS ASK:
  • 1a######1f.dontargetme.nl
Sends data to the following servers:
  • 12#.#.15.28:123
  • 14#.##.12.176:17560
Receives data from the following servers:
  • 12#.#.15.28:123
  • 14#.##.12.176:24150
  • 14#.##.12.176:17560

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number