La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Linux.Siggen.3903

Aggiunto al database dei virus Dr.Web: 2021-05-17

La descrizione è stata aggiunta:

Technical Information

Malicious functions:
Launches itself as a daemon
Modifies firewall settings:
  • /sbin/iptables -t mangle -D PREROUTING -p tcp --dport 80 -j QUEUE
  • /sbin/iptables -t mangle -D POSTROUTING -p tcp --sport 80 -j QUEUE
  • /sbin/iptables -n -L OUTPUT
Launches processes:
  • /bin/sh -c /sbin/iptables -t mangle -D PREROUTING -p tcp --dport 80 -j QUEUE
  • /bin/sh -c /sbin/iptables -t mangle -D POSTROUTING -p tcp --sport 80 -j QUEUE
  • /bin/sh -c /sbin/iptables -n -L OUTPUT > /tmp/pink/protect_ipt_check
Performs operations with the file system:
Creates folders:
  • /tmp/pink
Creates or modifies files:
  • /tmp/pink/cnc_live
  • /tmp/pink/p2p_cncproxy_status
  • /tmp/pink/cnc_live_proxy
  • /tmp/pink/cnc_runtype
  • /tmp/pink/protect_ipt_check
Deletes files:
  • /tmp/client
  • /tmp/pink/cncproxy_validinfo
  • /tmp/pink/fc_ip
  • /tmp/pink/fc_port
  • /tmp/pink/cache_finder_page_web
Locks files:
  • /tmp/pink/cnc_live
  • /tmp/pink/cnc_live_proxy
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:61889
  • 0.0.0.0:123
  • 127.0.0.1:61869
Establishes connection:
  • 8.#.8.8:53
  • 20#.##.56.48:1088
HTTP GET requests:
  • 48.##.11.204/
DNS ASK:
  • cn#.##nklander.com

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number