用户服务中心

My library

+ Add to library

Search

24/7 Tech support | Rules regarding submitting

Send a message

Call us

+7 (495) 789-45-86

Forum

Your tickets

Total: -
Active: -
Latest: -

Call us

+7 (495) 789-45-86

CN

RU CN DE EN ES FR IT JP KZ UZ PL BY

Dr.Web vxCube

打开分析仪

计算机病毒事件调查

病毒知识库

技术

术语

教育培训

误区

有关反病毒软件的误区

Linux.Siggen.7938

Added to the Dr.Web virus database: 2024-08-15

Virus description added: 2024-08-15

Technical Information

Malicious functions:

Manages services:

['systemctl', 'list-unit-files']
['systemctl', 'status', 'trojan']

Launches processes:

head -n 1
grep tag_name
id -u
uname -m
curl -LO --progress-bar https://github.com/trojan-gfw/trojan/releases/download/v1.16.0/trojan-1.16.0-linux-amd64.tar.xz
cut -d\x22 -f4
sed s/v//g
grep trojan.service
mktemp -d
tar xf trojan-1.16.0-linux-amd64.tar.xz
mkdir -p /usr/bin/trojan /usr/local/etc/trojan
curl -H Cache-Control: no-cache -s https://api.github.com/repos/trojan-gfw/trojan/releases/latest
bash -c systemctl list-unit-files|grep trojan.service
bash -c systemctl status trojan
<0xbb>
xz -d

Performs operations with the file system:

Modifies file access rights:

/tmp/tmp.DfiiJhMHoc/trojan/examples/forward.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/server.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/trojan.service-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/client.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/nat.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples
/tmp/tmp.DfiiJhMHoc/trojan/config.json

Modifies file owner:

/tmp/tmp.DfiiJhMHoc/trojan/examples/forward.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/server.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/trojan.service-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/client.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/nat.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples
/tmp/tmp.DfiiJhMHoc/trojan/config.json

Creates folders:

/var/lib/trojan-manager
/tmp/tmp.DfiiJhMHoc
/usr/bin/trojan
/usr/local/etc/trojan
/tmp/tmp.DfiiJhMHoc/trojan
/tmp/tmp.DfiiJhMHoc/trojan/examples

Creates or modifies files:

/var/lib/trojan-manager/LOCK
/var/lib/trojan-manager/LOG
/var/lib/trojan-manager/MANIFEST-000000
/var/lib/trojan-manager/CURRENT.0
/var/lib/trojan-manager/000001.log
/var/lib/trojan-manager/000002.log
/var/lib/trojan-manager/MANIFEST-000003
/var/lib/trojan-manager/CURRENT.bak
/var/lib/trojan-manager/CURRENT.3
/tmp/tmp.DfiiJhMHoc/trojan-1.16.0-linux-amd64.tar.xz
/tmp/tmp.DfiiJhMHoc/trojan/examples/forward.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/server.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/trojan.service-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/client.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/nat.json-example
/tmp/tmp.DfiiJhMHoc/trojan/config.json
/tmp/tmp.DfiiJhMHoc/trojan/trojan

Deletes files:

/var/lib/trojan-manager/MANIFEST-000000
/var/lib/trojan-manager/000001.log

Locks files:

/var/lib/trojan-manager/LOCK

Changes time of creation/access/modification of files:

/tmp/tmp.DfiiJhMHoc/trojan/examples/forward.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/server.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/trojan.service-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/client.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples/nat.json-example
/tmp/tmp.DfiiJhMHoc/trojan/examples
/tmp/tmp.DfiiJhMHoc/trojan/config.json

Network activity:

Establishes connection:

8.#.8.8:53
14#.##.121.5:443
14#.##.121.3:443
18#.##9.111.133:443
(e##val)
18#.##9.110.133:443
18#.##9.108.133:443
18#.##9.109.133:443

DNS ASK:

ap#.#ithub.com
gi##ub.com
ob#####.#ithubusercontent.com

Sends data to the following servers:

14#.##.121.5:443
14#.##.121.3:443
18#.##9.111.133:443

Receives data from the following servers:

14#.##.121.5:443
14#.##.121.3:443
18#.##9.111.133:443

Other:

Collects information about network activity

Curing recommendations

Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number