La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Linux.Siggen.514

Aggiunto al database dei virus Dr.Web: 2018-04-05

La descrizione è stata aggiunta:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • telnetd
Modifies firewall settings:
  • iptables -A INPUT -p tcp --destination-port 23 -j DROP
  • iptables -A INPUT -p tcp --destination-port 7547 -j DROP
  • iptables -A INPUT -p tcp --destination-port 5555 -j DROP
  • iptables -A INPUT -p tcp --destination-port 5358 -j DROP
  • iptables -D INPUT -j CWMP_CR
  • iptables -X CWMP_CR
  • iptables -I INPUT -p udp --dport 25522 -j ACCEPT
Launches processes:
  • sh -c iptables -A INPUT -p tcp --destination-port 23 -j DROP
  • sh -c iptables -A INPUT -p tcp --destination-port 7547 -j DROP
  • sh -c iptables -A INPUT -p tcp --destination-port 5555 -j DROP
  • sh -c iptables -A INPUT -p tcp --destination-port 5358 -j DROP
  • sh -c iptables -D INPUT -j CWMP_CR
  • sh -c iptables -X CWMP_CR
  • sh -c iptables -I INPUT -p udp --dport 25522 -j ACCEPT
Performs operations with the file system:
Creates folders:
  • /root/.p
Deletes folders:
  • <SAMPLE_FULL_PATH>"
  • /root/.p/.d"
Deletes files:
  • <SAMPLE_FULL_PATH>"
  • /tmp/ftpupdate.sh"
  • /tmp/ftpupload.sh"
Network activity:
Awaits incoming connections on ports:
  • 0.0.0.0:25522
Establishes connection:
  • 8.#.8.8:53
  • <LOCAL_DNS_SERVER>
  • [:##]:25522
  • 127.0.0.1:25522
DNS ASK:
  • po##.ntp.org
  • ro####.utorrent.com
  • ro####.bittorrent.com
Sends data to the following servers:
  • 46.###.216.12:123
  • 82.###.103.244:6881
  • 67.###.246.10:6881
  • 11#.###.77.190:16001
  • 10#.##2.90.255:4128
  • 92.###.122.61:6881
  • 18.###.151.4:3282
  • 18#.##.28.162:29316
  • 49.##.231.104:22124
  • 2.##.#1.124:43254
  • 17#.###.188.198:6881
  • 89.##.142.147:20180
  • 10#.###.143.241:2187
  • 18#.##.10.195:51110
  • 5.###.152.182:15782
  • 90.###.138.110:6884
  • 92.##.183.220:6882

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number