Linux.Siggen.7858

Added to the Dr.Web virus database: 2024-07-30

Virus description added: 2024-07-29

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches processes:

date
mkdir -p /etc/dlemp/.tmp/saoluuwebsitethanhconghostingaz
rm -rf /etc/dlemp/.tmp/checksite-list
rm -rf /etc/dlemp/.tmp/dlemp-replace
clear
chmod +x /etc/dlemp/.tmp/dlemp-replace
cat /etc/dlemp/.tmp/checksite-list
cut -c 1-15
<SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
sed -i /0-DLEMP-SHORTCUT/d /etc/dlemp/.tmp/dlemp-websitelist
cat
wc -l
<0x12>
cat /etc/dlemp/.tmp/dlemp-websitelist
mkdir -p /etc/dlemp/.tmp/saoluuwebsitethatbaihostingaz
sed -i /oanh/d /etc/dlemp/.tmp/dlemp-websitelist
rm -rf /etc/dlemp/.tmp/*hostingaz*
rm -rf /etc/dlemp/.tmp/dlemp_check_site
md5sum
touch /etc/cron.d/dlemp.code.cron
sed -i //d /etc/dlemp/.tmp/dlemp-websitelist
ls /bin/

Performs operations with the file system:

Modifies file access rights:

Modifies file owner:

Creates folders:

Creates or modifies files:

Deletes files:

Changes time of creation/access/modification of files: