Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.7158

Added to the Dr.Web virus database: 2024-04-18

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • e28081
Kills the following processes:
  • kthreadd
  • rcu_gp
  • rcu_par_gp
  • kworker/0:0
  • kworker/0:0H
  • kworker/u2:0
  • mm_percpu_wq
  • ksoftirqd/0
  • rcu_sched
  • rcu_bh
  • migration/0
  • cpuhp/0
  • kdevtmpfs
  • netns
  • kauditd
  • khungtaskd
  • oom_reaper
  • writeback
  • kcompactd0
  • ksmd
  • crypto
  • kintegrityd
  • kblockd
  • ata_sff
  • devfreq_wq
  • watchdogd
  • kworker/0:1H
  • kswapd0
  • kthrotld
  • ipv6_addrconf
  • kworker/u2:2
  • kstrp
  • scsi_eh_0
  • scsi_tmf_0
  • scsi_eh_1
  • scsi_tmf_1
  • kworker/0:2
  • kworker/u3:0
  • jbd2/sda1-8
  • ext4-rsv-conver
  • kworker/0:1
  • 9bc2fd2a
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:33337
Establishes connection:
  • 8.#.8.8:53
  • 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
  • ro##me.xyz
Sends data to the following servers:
  • 45.###.232.208:33335
  • 10#.##.120.140:23
  • 12#.#.2.169:23
  • 24#.##6.89.212:23
  • 15.##2.216.9:23
  • 31.##.16.75:23
  • 71.###.147.192:23
  • 19#.##.117.135:23
  • 12#.##9.142.128:23
  • 12.###.35.223:23
  • 11#.##5.218.246:23
  • 19#.##0.211.129:23
  • 15#.##2.245.149:23
  • 19#.##.111.86:23
  • 65.##.209.204:23
  • 94.###.41.204:23
  • 16#.#3.6.93:23
  • 22#.##3.216.240:23
  • 23#.##.241.115:23
  • 13#.##.232.253:23
  • 49.###.233.68:23
  • 13#.#7.14.92:23
  • 12#.#5.74.88:23
  • 65.##.158.59:23
  • 15#.##6.141.248:23
  • 24#.##.121.65:23
  • 21#.##8.197.33:23
  • 13#.##1.152.95:23
  • 94.###.60.144:23
  • 18#.##1.42.38:23
  • 11#.##.115.67:23
  • 12#.#6.101.1:23
  • 44.##9.51.20:23
  • 21#.##7.112.228:23
  • 12#.##.188.160:23
  • 10#.##.144.155:23
  • 10#.#.233.9:23
  • 78.###.108.194:23
  • 13#.##.146.122:23
  • 50.##.151.113:23
  • 24#.##2.30.147:23
  • 32.##7.79.96:23
  • 13#.##5.136.33:23
  • 14#.##1.140.101:23
  • 12#.##0.204.207:23
  • 22#.##.237.57:23
  • 12#.#6.60.42:23
  • 22.###.174.167:23
  • 19#.##9.7.114:23
  • 52.##.140.115:23
  • 24#.##.237.136:23
  • 95.###.100.216:23
  • 67.###.21.232:23
  • 34.##5.108.2:23
  • 13#.##8.239.66:23
  • 6.###.105.233:23
  • 40.##.49.71:23
  • 93.##.44.152:23
  • 75.##.167.125:23
  • 16#.##.254.190:23
  • 40.###.160.103:23
  • 24#.#.231.216:23
  • 41.###.103.50:23
  • 36.###.223.244:23
  • 10#.#58.7.13:23
  • 79.###.241.162:23
  • 38.##6.6.167:23
  • 15#.##7.154.73:23
  • 23#.##.181.58:23
  • 24#.##.247.195:23
  • 14#.##.194.148:23
  • 66.###.26.140:23
  • 17.###.127.34:23
  • 22#.##.166.96:23
  • 14#.##.224.109:23
  • 14#.##.200.234:23
  • 82.##.43.188:23
  • 19#.##6.87.223:23
  • 22#.##9.114.151:23
  • 81.###.132.118:23
  • 25#.##.89.111:23
  • 99.###.107.115:23
  • 84.##.140.228:23
  • 16#.##0.242.5:23
  • 15#.##.199.16:23
  • 41.###.125.243:23
  • 80.###.240.28:23
  • 19#.##.23.158:23
  • 18#.##5.211.9:23
  • 17#.##1.86.185:23
  • 83.##.76.59:23
  • 19#.#3.62.17:23
  • 5.#.#43.92:23
  • 54.###.153.217:23
  • 14#.##0.219.20:23
  • 18#.##.146.216:23
  • 19#.##.114.92:23
  • 23#.##.74.138:23
  • 13#.##9.68.157:23
  • 17#.##1.34.21:23
  • 4.###.43.135:23
  • 17.##.23.247:23
  • 22#.##.114.195:23
  • 22#.#8.96.32:23
  • 18#.##3.26.21:23
  • 35.##3.43.23:23
  • 87.##.57.136:23
  • 23#.##2.197.221:23
  • 53.##.245.217:23
  • 73.###.221.21:23
  • 61.##5.54.95:23
  • 11#.##2.226.146:23
  • 20#.##3.33.233:23
  • 12#.##9.63.18:23
  • 25#.##.81.166:23
  • 11#.##.249.179:23
  • 15#.##2.136.133:23
  • 11#.##8.155.175:23
  • 24#.##7.108.99:23
  • 17#.##0.58.59:23
  • 12#.##.155.69:23
  • 97.###.224.12:23
  • 17#.#85.30.6:23
  • 2.###.122.49:23
  • 18#.##4.220.253:23
  • 18#.##0.226.174:23
  • 24#.##.135.32:23
  • 37.###.144.187:23
  • 24#.#1.0.70:23
  • 19#.##4.55.118:23
  • 22#.##2.56.197:23
  • 18#.##0.59.90:23
  • 4.###.133.74:23
Receives data from the following servers:
  • 45.###.232.208:33335

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number