Linux.Siggen.1604

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

/etc/init.d/netdns
/etc/init.d/.depend.boot
/etc/init.d/.depend.start
/etc/init.d/.depend.stop

Creates or modifies the following symlinks:

/etc/rc0.d/K01netdns
/etc/rc1.d/K01netdns
/etc/rc2.d/S01netdns
/etc/rc3.d/S01netdns
/etc/rc4.d/S01netdns
/etc/rc5.d/S01netdns
/etc/rc6.d/K01netdns

Malicious functions:

Launches itself as a daemon

Manages services:

systemctl enable netdns
/usr/sbin/update-rc.d netdns defaults
systemctl daemon-reload

Launches processes:

<SAMPLE_FULL_PATH> [kerberods]
/bin/bash -c chattr -i /usr/lib/systemd/system/netdns.service
chattr -i /usr/lib/systemd/system/netdns.service
/bin/bash -c chkconfig --add netdns
/bin/bash -c systemctl enable netdns
/sbin/insserv netdns

Performs operations with the file system:

Creates or modifies files:

/tmp/.X11unix
/usr/sbin/kerberods
/usr/lib/systemd/system/netdns.service

Locks files:

/tmp/.X11unix

Network activity:

Establishes connection:

<LOCAL_DNS_SERVER>
[2########::f03c:91ff:fe70:2b9d]:9
17#.#8.123.25:9
19#.##8.205.99:6379
19#.##8.205.0:6379
<LOCAL_GATE>:6379
19#.##8.205.2:6379
19#.##8.205.3:6379
19#.##8.205.4:6379
19#.##8.205.5:6379
19#.##8.205.6:6379
19#.##8.205.7:6379
19#.##8.205.8:6379
19#.##8.205.9:6379
<LOCAL_GATE>0:6379
<LOCAL_GATE>1:6379
<LOCAL_GATE>2:6379
<LOCAL_GATE>3:6379
<LOCAL_GATE>4:6379
<LOCAL_GATE>5:6379
<LOCAL_GATE>6:6379
<LOCAL_GATE>8:6379
<LOCAL_GATE>9:6379
19#.##8.205.20:6379
19#.##8.205.21:6379
19#.##8.205.22:6379
19#.##8.205.23:6379
19#.##8.205.24:6379
19#.##8.205.25:6379
19#.##8.205.26:6379
19#.##8.205.27:6379
19#.##8.205.28:6379
19#.##8.205.29:6379
19#.##8.205.30:6379
19#.##8.205.31:6379
19#.##8.205.32:6379
19#.##8.205.33:6379
19#.##8.205.34:6379
19#.##8.205.35:6379
19#.##8.205.36:6379
19#.##8.205.37:6379
19#.##8.205.38:6379
19#.##8.205.39:6379
19#.##8.205.41:6379
19#.##8.205.42:6379
19#.##8.205.43:6379
19#.##8.205.44:6379
19#.##8.205.45:6379
19#.##8.205.46:6379
19#.##8.205.47:6379
19#.##8.205.48:6379
19#.##8.205.49:6379
19#.##8.205.50:6379
19#.##8.205.51:6379
19#.##8.205.52:6379
19#.##8.205.53:6379
19#.##8.205.54:6379
19#.##8.205.55:6379
19#.##8.205.56:6379
19#.##8.205.57:6379
19#.##8.205.58:6379
19#.##8.205.59:6379
19#.##8.205.60:6379
19#.##8.205.61:6379
19#.##8.205.62:6379
19#.##8.205.63:6379
19#.##8.205.64:6379
19#.##8.205.65:6379
19#.##8.205.66:6379
19#.##8.205.67:6379
19#.##8.205.68:6379
19#.##8.205.69:6379
19#.##8.205.70:6379
19#.##8.205.71:6379
19#.##8.205.72:6379
19#.##8.205.73:6379
19#.##8.205.74:6379
19#.##8.205.75:6379
19#.##8.205.76:6379
19#.##8.205.77:6379
19#.##8.205.78:6379
19#.##8.205.79:6379
19#.##8.205.80:6379
19#.##8.205.81:6379
19#.##8.205.82:6379
19#.##8.205.83:6379
19#.##8.205.84:6379
19#.##8.205.85:6379
19#.##8.205.86:6379
19#.##8.205.87:6379
19#.##8.205.88:6379
19#.##8.205.89:6379
19#.##8.205.90:6379
19#.##8.205.91:6379
19#.##8.205.92:6379
19#.##8.205.93:6379
19#.##8.205.94:6379
19#.##8.205.95:6379
19#.##8.205.96:6379
19#.##8.205.97:6379
19#.##8.205.98:6379
<LOCAL_GATE>7:6379
19#.##8.205.40:6379
<LOCAL_GATE>00:6379
<LOCAL_GATE>01:6379
<LOCAL_GATE>02:6379
<LOCAL_GATE>03:6379
<LOCAL_GATE>04:6379
<LOCAL_GATE>05:6379
<LOCAL_GATE>06:6379
<LOCAL_GATE>07:6379
<LOCAL_GATE>08:6379
<LOCAL_GATE>09:6379
<LOCAL_GATE>10:6379
<LOCAL_GATE>11:6379
<LOCAL_GATE>12:6379
<LOCAL_GATE>13:6379
<LOCAL_GATE>14:6379
<LOCAL_GATE>15:6379
<LOCAL_GATE>16:6379
<LOCAL_GATE>17:6379
<LOCAL_GATE>18:6379
<LOCAL_GATE>19:6379
<LOCAL_GATE>20:6379
<LOCAL_GATE>21:6379
<LOCAL_GATE>22:6379
<LOCAL_GATE>23:6379
<LOCAL_GATE>24:6379
<LOCAL_GATE>26:6379
<LOCAL_GATE>27:6379
<LOCAL_GATE>28:6379
<LOCAL_GATE>25:6379
<LOCAL_GATE>29:6379
<LOCAL_GATE>30:6379
<LOCAL_GATE>31:6379
<LOCAL_GATE>32:6379
<LOCAL_GATE>33:6379
<LOCAL_GATE>34:6379
<LOCAL_GATE>35:6379
<LOCAL_GATE>36:6379
<LOCAL_GATE>37:6379
<LOCAL_GATE>38:6379
<LOCAL_GATE>39:6379
<LOCAL_GATE>40:6379
<LOCAL_GATE>41:6379
<LOCAL_GATE>42:6379
<LOCAL_GATE>43:6379
<LOCAL_GATE>44:6379
<LOCAL_GATE>45:6379
<LOCAL_GATE>46:6379
<LOCAL_GATE>47:6379
<LOCAL_GATE>48:6379
<LOCAL_GATE>49:6379
<LOCAL_GATE>50:6379
<LOCAL_GATE>51:6379
<LOCAL_GATE>52:6379
<LOCAL_GATE>53:6379
<LOCAL_GATE>54:6379
<LOCAL_GATE>55:6379
<LOCAL_GATE>56:6379
<LOCAL_GATE>57:6379
<LOCAL_GATE>58:6379
<LOCAL_GATE>59:6379
<LOCAL_GATE>60:6379
<LOCAL_GATE>61:6379
<LOCAL_GATE>62:6379
<LOCAL_GATE>64:6379
<LOCAL_GATE>63:6379
<LOCAL_GATE>65:6379
<LOCAL_GATE>67:6379
<LOCAL_GATE>68:6379
<LOCAL_GATE>69:6379
<LOCAL_GATE>70:6379
<LOCAL_GATE>66:6379
<LOCAL_GATE>71:6379
<LOCAL_GATE>72:6379
<LOCAL_GATE>73:6379
<LOCAL_GATE>74:6379
<LOCAL_GATE>75:6379
<LOCAL_GATE>76:6379
<LOCAL_GATE>77:6379
<LOCAL_GATE>78:6379
<LOCAL_GATE>79:6379
<LOCAL_GATE>80:6379
<LOCAL_GATE>81:6379
<LOCAL_GATE>82:6379
<LOCAL_GATE>83:6379
<LOCAL_GATE>85:6379
<LOCAL_GATE>86:6379
<LOCAL_GATE>87:6379
<LOCAL_GATE>88:6379
<LOCAL_GATE>89:6379
<LOCAL_GATE>90:6379
<LOCAL_GATE>84:6379
<LOCAL_GATE>91:6379
<LOCAL_GATE>92:6379
<LOCAL_GATE>93:6379
<LOCAL_GATE>94:6379
<LOCAL_GATE>95:6379
<LOCAL_GATE>96:6379
<LOCAL_GATE>98:6379
<LOCAL_GATE>99:6379
<LOCAL_GATE>97:6379
19#.###.205.200:6379
19#.###.205.201:6379
19#.###.205.202:6379
19#.###.205.203:6379
19#.###.205.204:6379
19#.###.205.205:6379
19#.###.205.206:6379
19#.###.205.207:6379
19#.###.205.208:6379
19#.###.205.209:6379
19#.###.205.210:6379
19#.###.205.211:6379
19#.###.205.212:6379
19#.###.205.214:6379
19#.###.205.213:6379
19#.###.205.215:6379
19#.###.205.216:6379
19#.###.205.217:6379
19#.###.205.218:6379
19#.###.205.219:6379
19#.###.205.220:6379
19#.###.205.221:6379
19#.###.205.222:6379
19#.###.205.223:6379
19#.###.205.224:6379
19#.###.205.225:6379
19#.###.205.226:6379
19#.###.205.227:6379
19#.###.205.229:6379
19#.###.205.230:6379
19#.###.205.232:6379
19#.###.205.233:6379
19#.###.205.228:6379
19#.###.205.231:6379
19#.###.205.234:6379
19#.###.205.235:6379
19#.###.205.246:6379
19#.###.205.236:6379
19#.###.205.237:6379
19#.###.205.238:6379
19#.###.205.239:6379
19#.###.205.240:6379
19#.###.205.242:6379
19#.###.205.243:6379
19#.###.205.244:6379
19#.###.205.245:6379
19#.###.205.241:6379
19#.###.205.247:6379
19#.###.205.248:6379
19#.###.205.249:6379
19#.###.205.250:6379
19#.###.205.251:6379
19#.###.205.252:6379
19#.###.205.254:6379
19#.###.205.255:6379
95.##1.0.1:6379
95.##1.0.2:6379
95.##1.0.3:6379
95.##1.0.4:6379
95.##1.0.5:6379
95.##1.0.6:6379
95.##1.0.7:6379
95.##1.0.8:6379
95.##1.0.9:6379
19#.###.205.253:6379
95.##1.0.0:6379
95.###.0.10:6379
95.###.0.11:6379
95.###.0.12:6379
95.###.0.14:6379
95.###.0.15:6379
95.###.0.16:6379
95.###.0.17:6379
95.###.0.18:6379
95.###.0.19:6379
95.###.0.20:6379
95.###.0.21:6379
95.###.0.23:6379
95.###.0.25:6379
95.###.0.26:6379
95.###.0.27:6379
95.###.0.28:6379
95.###.0.29:6379
95.###.0.30:6379
95.###.0.13:6379
95.###.0.22:6379
95.###.0.24:6379
95.###.0.31:6379
95.###.0.32:6379
95.###.0.34:6379
95.###.0.35:6379
95.###.0.37:6379
95.###.0.38:6379

HTTP GET requests:

id##t.me/

DNS ASK:

id##t.me

Other:

Collects RAM information

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations