Per il corretto funzionamento del sito, è necessario attivare il supporto di JavaScript nel browser.
Linux.Siggen.4059
Aggiunto al database dei virus Dr.Web:
2021-07-20
La descrizione è stata aggiunta:
2021-07-19
Technical Information
Malicious functions:
Performs process tracing:
<SAMPLE>
<SAMPLE_FULL_PATH>
Modifies firewall settings:
/usr/sbin/iptables -A OUTPUT -m set --match-set block src -j DROP
/usr/sbin/iptables -A OUTPUT -m set --match-set block dst -j DROP
/usr/sbin/iptables -I INPUT -m set --match-set block src -j DROP
/usr/sbin/iptables -I INPUT -m set --match-set block dst -j DROP
/usr/sbin/iptables -A INPUT -m set --match-set block src -j DROP
/usr/sbin/iptables -A INPUT -m set --match-set block dst -j DROP
/usr/sbin/iptables -I OUTPUT -m set --match-set block src -j DROP
/usr/sbin/iptables -I OUTPUT -m set --match-set block dst -j DROP
/usr/sbin/iptables -A OUTPUT -m set --match-set block src -j REJECT
/usr/sbin/iptables -A OUTPUT -m set --match-set block dst -j REJECT
/usr/sbin/iptables -I INPUT -m set --match-set block src -j REJECT
/usr/sbin/iptables -I INPUT -m set --match-set block dst -j REJECT
/usr/sbin/iptables -A INPUT -m set --match-set block src -j REJECT
/usr/sbin/iptables -A INPUT -m set --match-set block dst -j REJECT
/usr/sbin/iptables -I OUTPUT -m set --match-set block src -j REJECT
/usr/sbin/iptables -I OUTPUT -m set --match-set block dst -j REJECT
Launches processes:
/bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
<SAMPLE_FULL_PATH>
/bin/bash <SAMPLE_FULL_PATH> -c
/usr/sbin/ipset create block hash:net
wget http://srv62.com/block.txt -O /tmp/block.txt
Kills the following processes:
<SAMPLE>
<SAMPLE_FULL_PATH>
Performs operations with the file system:
Creates or modifies files:
Network activity:
Establishes connection:
<LOCAL_DNS_SERVER>
10#.##1.51.40:80
DNS ASK:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Scaricate Dr.Web per Android
Gratis per 3 mesi
Tutti i componenti di protezione
Rinnovo versione di prova tramite AppGallery/Google Pay
Continuando a utilizzare questo sito, l'utente acconsente al nostro utilizzo di file Cookie e di altre tecnologie per la raccolta di informazioni statistiche sui visitatori. Per maggiori informazioni
OK