Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.7174

Added to the Dr.Web virus database: 2024-04-19

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • e38387
Kills the following processes:
  • systemd
  • kthreadd
  • ksoftirqd/0
  • kworker/0:0
  • kworker/0:0H
  • watchdog/0
  • khelper
  • kdevtmpfs
  • netns
  • khungtaskd
  • writeback
  • ksmd
  • crypto
  • kintegrityd
  • bioset
  • kblockd
  • kswapd0
  • fsnotify_mark
  • kthrotld
  • ipv6_addrconf
  • deferwq
  • kworker/u2:1
  • kpsmoused
  • scsi_eh_0
  • scsi_tmf_0
  • kworker/0:1H
  • kworker/u2:2
  • jbd2/sda1-8
  • ext4-rsv-conver
  • kauditd
  • kworker/0:3
  • systemd-journal
  • systemd-udevd
  • rpciod
  • nfsiod
  • systemd-logind
  • kworker/0:1
  • dhclient
  • kworker/0:2
  • 9bc2fd2a
  • systemd-cgroups
  • systemctl
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:33337
Establishes connection:
  • 8.#.8.8:53
  • 45.###.232.208:33335
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
  • ro##me.xyz
Sends data to the following servers:
  • 45.###.232.208:33335
  • 42.##.143.233:23
  • 19#.##4.189.93:23
  • 40.###.173.176:23
  • 21#.##.181.182:23
  • 49.##.55.54:23
  • 19#.##.48.246:23
  • 27.##.43.177:23
  • 23#.##.255.52:23
  • 10#.##2.211.237:23
  • 96.###.204.13:23
  • 58.#.14.204:23
  • 79.###.248.156:23
  • 62.###.92.123:23
  • 21#.##.203.213:23
  • 25.#.55.56:23
  • 11#.##0.151.211:23
  • 4.##.73.148:23
  • 16#.##.144.22:23
  • 24.###.246.171:23
  • 15#.##.181.252:23
  • 18#.#.21.239:23
  • 14#.##.179.192:23
  • 18.###.74.179:23
  • 25#.#.219.18:23
  • 18#.##4.245.155:23
  • 73.###.35.177:23
  • 66.###.118.49:23
  • 52.#.207.196:23
  • 13#.##9.29.232:23
  • 19#.##4.73.98:23
  • 41.###.154.105:23
  • 62.##6.204.8:23
  • 20#.##.247.44:23
  • 88.##.80.217:23
  • 17.##7.6.150:23
  • 16#.##2.10.236:23
  • 22#.##1.18.94:23
  • 10#.##9.47.139:23
  • 18#.##.138.199:23
  • 14#.##.186.75:23
  • 70.###.48.183:23
  • 18#.##7.230.228:23
  • 52.##.119.53:23
  • 24#.##4.62.19:23
  • 22#.#.22.235:23
  • 82.##.115.226:23
  • 13#.##2.10.178:23
  • 12#.#9.51.25:23
  • 42.###.214.95:23
  • 23#.##9.155.245:23
  • 80.##.129.79:23
  • 11#.##.203.187:23
  • 39.##.90.138:23
  • 47.##7.31.73:23
  • 17#.##.102.166:23
  • 59.##6.94.88:23
  • 23#.##5.241.17:23
  • 21#.##1.108.188:23
  • 82.###.244.206:23
  • 50.###.23.116:23
  • 18#.##7.200.96:23
  • 10#.##7.71.102:23
  • 63.##.98.230:23
  • 32.##.24.93:23
  • 92.##0.14.72:23
  • 14#.##7.148.47:23
  • 84.##.51.60:23
  • 20#.##2.118.198:23
  • 42.##.152.249:23
  • 69.##6.82.96:23
  • 1.###.22.162:23
  • 72.##.218.248:23
  • 18.###.159.204:23
  • 24#.##7.46.19:23
  • 24#.#8.47.59:23
  • 21#.##2.135.217:23
  • 38.##.24.27:23
  • 10#.##5.181.203:23
  • 22#.##6.200.196:23
  • 70.##.212.29:23
  • 50.###.157.131:23
  • 12#.##3.184.186:23
  • 11#.##.119.67:23
  • 25#.##.194.40:23
  • 45.#.128.149:23
  • 25#.##0.146.12:23
  • 18#.##6.140.213:23
  • 20#.##.221.23:23
  • 96.##.251.14:23
Receives data from the following servers:
  • 45.###.232.208:33335

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number