Linux.Siggen.7173
Added to the Dr.Web virus database:
2024-04-19
Virus description added:
2024-04-18
Technical Information
Malicious functions:
Launches itself as a daemon
Substitutes application name for:
Performs operations with the file system:
Deletes folders:
- /null
- /var/log/syslog
- /var/log/daemon.log
- /tmp/clearsigned.message.cBNHlY
- /tmp/clearsigned.message.ql2Opd
- /tmp/clearsigned.message.4BdW6e
- /tmp/clearsigned.message.gb24Ai
- /tmp/clearsigned.message.UNxp4K
- /tmp/clearsigned.message.USxtZM
- /var/log/kern.log.1.gz
Deletes files:
- /null
- /var/log/syslog
- /var/log/daemon.log
- /tmp/clearsigned.message.cBNHlY
- /tmp/clearsigned.message.ql2Opd
- /tmp/clearsigned.message.4BdW6e
- /tmp/clearsigned.message.gb24Ai
- /tmp/clearsigned.message.UNxp4K
- /tmp/clearsigned.message.USxtZM
- /var/log/kern.log.1.gz
Network activity:
Awaits incoming connections on ports:
Establishes connection:
- 8.#.8.8:53
- 18#.##1.61.24:53
- 0.0.0.0:0
- 91.###.137.37:53
- 19#.##.144.87:53
- 16#.###.128.166:64356
DNS ASK:
- hs####df2z.pirate
- ph####9rqd.parody
Sends data to the following servers:
Receives data from the following servers:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
欢迎下载
Dr.Web for Android
-
免费3个月
-
可使用所有保护组件
-
可在AppGallery/Google Pay延期
继续使用此网站意味着您同意我们使用Cookie文件和其他用于收集网站访问统计信息的技术手段。详细信息