Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.7131

Added to the Dr.Web virus database: 2024-04-18

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • e28081
Kills the following processes:
  • systemd
  • kthreadd
  • ksoftirqd/0
  • kworker/0:0H
  • kworker/u2:0
  • watchdog/0
  • khelper
  • kdevtmpfs
  • netns
  • khungtaskd
  • writeback
  • ksmd
  • crypto
  • kintegrityd
  • bioset
  • kblockd
  • ata_sff
  • kworker/0:1
  • kswapd0
  • fsnotify_mark
  • kthrotld
  • scsi_eh_0
  • scsi_tmf_0
  • scsi_eh_1
  • scsi_tmf_1
  • ipv6_addrconf
  • deferwq
  • kworker/u2:2
  • kworker/0:1H
  • jbd2/sda3-8
  • ext4-rsv-conver
  • kauditd
  • kworker/0:3
  • systemd-journal
  • systemd-udevd
  • ttm_swap
  • rpciod
  • nfsiod
  • systemd-logind
  • kworker/0:0
  • kworker/0:2
  • dhclient
  • 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:33337
Establishes connection:
  • 8.#.8.8:53
  • 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
  • ro##me.xyz
Sends data to the following servers:
  • 45.###.232.208:33335
  • 14#.##6.89.115:23
  • 29.##.169.207:23
  • 5.##.22.7:23
  • 97.##.214.169:23
  • 16#.##.214.157:23
  • 11#.##.58.252:23
  • 78.###.232.22:23
  • 23#.##8.164.248:23
  • 15#.##.142.191:23
  • 24.###.130.243:23
  • 49.###.159.226:23
  • 20#.##.43.223:23
  • 18#.##0.125.177:23
  • 12#.##6.238.175:23
  • 23#.##.108.243:23
  • 72.##.192.114:23
  • 49.##.184.133:23
  • 2.#.#2.118:23
  • 91.##.79.182:23
  • 19#.#3.8.23:23
  • 60.###.37.249:23
  • 19.##.59.62:23
  • 19#.##4.245.232:23
  • 87.##7.47.52:23
  • 13.##.130.116:23
  • 13#.##2.149.49:23
  • 16#.##6.113.73:23
  • 18#.##7.161.110:23
  • 20#.##.123.238:23
  • 17#.#.45.14:23
  • 50.#.4.93:23
  • 20.##.225.242:23
  • 68.#.214.202:23
  • 24#.##.223.222:23
  • 23#.##2.5.166:23
  • 49.#.31.15:23
  • 93.##1.193.0:23
  • 38.##0.79.89:23
  • 22#.##9.150.146:23
  • 17#.##6.221.107:23
  • 15#.##.190.195:23
  • 14#.#4.16.60:23
  • 22#.##9.16.100:23
  • 19#.##7.79.26:23
  • 38.##4.45.55:23
  • 18#.##8.174.95:23
  • 16#.#9.34.73:23
  • 24#.##.155.171:23
  • 14#.##4.236.95:23
  • 23#.##4.212.120:23
  • 10#.#31.40.1:23
Receives data from the following servers:
  • 45.###.232.208:33335

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number