La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Linux.Siggen.2665

Aggiunto al database dei virus Dr.Web: 2020-04-09

La descrizione è stata aggiunta:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/profile.d/bash_config.sh
  • /etc/rc.local
  • /etc/init.d/linux_kill
  • /etc/profile.d/linux.sh
  • /etc/profile.d/bash_config
  • /etc/crontab
  • /etc/init.d/acpid
  • /etc/init.d/bootlogs
  • /etc/init.d/bootmisc.sh
  • /etc/init.d/checkfs.sh
  • /etc/init.d/checkroot.sh
  • /etc/init.d/console-setup
  • /etc/init.d/cron
  • /etc/init.d/dbus
  • /etc/init.d/exim4
  • /etc/init.d/halt
  • /etc/init.d/hostname.sh
  • /etc/init.d/hwclock.sh
  • /etc/init.d/kbd
  • /etc/init.d/keyboard-setup
  • /etc/init.d/killprocs
  • /etc/init.d/kmod
  • /etc/init.d/motd
  • /etc/init.d/mountall.sh
  • /etc/init.d/mountdevsubfs.sh
  • /etc/init.d/mountkernfs.sh
  • /etc/init.d/mountnfs.sh
  • /etc/init.d/networking
  • /etc/init.d/nfs-common
  • /etc/init.d/procps
  • /etc/init.d/rc
  • /etc/init.d/rc.local
  • /etc/init.d/rmnologin
  • /etc/init.d/rpcbind
  • /etc/init.d/rsyslog
  • /etc/init.d/sendsigs
  • /etc/init.d/skeleton
  • /etc/init.d/ssh
  • /etc/init.d/udev
  • /etc/init.d/umountfs
  • /etc/init.d/umountnfs.sh
  • /etc/init.d/urandom
  • /etc/init.d/x11-common
  • /etc/init.d/.depend.boot
  • /etc/init.d/.depend.start
  • /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
  • /etc/rc0.d/linux_kill
  • /etc/rc1.d/linux_kill
  • /etc/rc2.d/linux_kill
  • /etc/rc3.d/linux_kill
  • /etc/rc4.d/linux_kill
  • /etc/rc5.d/linux_kill
  • /etc/rc6.d/linux_kill
  • /etc/rc2.d/S01linux_kill
  • /etc/rc3.d/S01linux_kill
  • /etc/rc4.d/S01linux_kill
  • /etc/rc5.d/S01linux_kill
Malicious functions:
Replaces the following system files:
  • /usr/bin/lsof
Manages services:
  • update-rc.d linux_kill defaults
  • systemctl daemon-reload
  • systemctl enable linux.service
Launches processes:
  • <SAMPLE_FULL_PATH> &
  • /bin/bash -c echo -e \"#!/bin/sh\n BEGIN INIT INFO\n#chkconfig: 2345 10 90\n#description:System.img.config\n# Default-Start: 2 3 4 5\n# Default-Stop: \n END INIT INFO\n/boot/System.img.config &\nexit 0\" > /etc/init.d/linux_kill;chmod +x /etc/init.d/linux_kill
  • /bin/bash -c echo -e \"#!/bin/sh\nwhile [ 1 ]; do\nsleep 30\n/etc/id.services.conf &\ndone\n\" > /etc/32679
  • /bin/bash -c echo \"#!/bin/sh\" > /etc/profile.d/linux.sh
  • /bin/bash -c echo -e \"#!/bin/sh\n/usr/lib/libdlrpcld.so &\" > /.img
  • chmod +x /etc/init.d/linux_kill
  • /bin/bash -c chmod 0755 /etc/32679
  • /bin/bash -c
  • chmod 0755 /etc/32679
  • /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
  • /bin/bash -c echo \"* * * * * root /.img \" >> /etc/crontab
  • ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc0.d/linux_kill
  • /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
  • ln -s /etc/init.d/linux_kill /etc/rc0.d/linux_kill
  • /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
  • nohup /etc/32679 &
  • /bin/bash -c chmod 0755 /.img
  • /etc/32679 &
  • ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc1.d/linux_kill
  • sleep 30
  • chmod 0755 /.img
  • /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill
  • ln -s /etc/init.d/linux_kill /etc/rc1.d/linux_kill
  • /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc2.d/linux_kill
  • ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc2.d/linux_kill
  • /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc2.d/linux_kill
  • ln -s /etc/init.d/linux_kill /etc/rc2.d/linux_kill
  • /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc3.d/linux_kill
  • ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc3.d/linux_kill
  • /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc3.d/linux_kill
  • ln -s /etc/init.d/linux_kill /etc/rc3.d/linux_kill
  • /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc4.d/linux_kill
  • ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc4.d/linux_kill
  • /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc4.d/linux_kill
  • ln -s /etc/init.d/linux_kill /etc/rc4.d/linux_kill
  • /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc5.d/linux_kill
  • ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc5.d/linux_kill
  • /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc5.d/linux_kill
  • ln -s /etc/init.d/linux_kill /etc/rc5.d/linux_kill
  • /bin/bash -c ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc6.d/linux_kill
  • ln -s /etc/rc.d/init.d/linux_kill /etc/rc.d/rc6.d/linux_kill
  • /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rc6.d/linux_kill
  • ln -s /etc/init.d/linux_kill /etc/rc6.d/linux_kill
  • /bin/bash -c ln -s /etc/init.d/linux_kill /etc/rcS.d/linux_kill
  • ln -s /etc/init.d/linux_kill /etc/rcS.d/linux_kill
  • /bin/bash -c update-rc.d linux_kill defaults;chkconfig --add linux_kill
  • /sbin/insserv linux_kill
  • /bin/bash -c echo -e \"[Unit]\nDescription=\n[Service]\nType=forking\nExecStart=/boot/System.img.config &\nExecReload=/boot/System.img.config &\nExecStop=/boot/System.img.config &\n[Install]\nWantedBy=multi-user.target\" > /etc/systemd/system/linux.service;chmod +x /etc/systemd/system/linux.service;systemctl enable linux.service
  • chmod +x /etc/systemd/system/linux.service
  • /etc/id.services.conf
Performs operations with the file system:
Modifies file access rights:
  • /etc/init.d/linux_kill
  • /etc/32679
  • /.img
  • /etc/systemd/system/linux.service
Creates folders:
  • /usr/bin/lib
Creates symlinks:
  • /etc/rcS.d/linux_kill
Creates or modifies files:
  • /tmp/.img
  • /usr/bin/find
  • /etc/32679
  • /.img
  • /lib/system-monitor
  • /usr/sbin/ifconfig.conf
  • /usr/bin/lsof
  • /etc/id.services.conf
  • /usr/lib/libdlrpcld.so
  • /boot/System.img.config
  • /etc/systemd/system/linux.service
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • 0.0.0.0:45566
DNS ASK:
  • 1.####ionday.xyz
Other:
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number