Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Linux.Siggen.3456

Added to the Dr.Web virus database: 2020-11-28

Virus description added:

Technical Information

Malicious functions:
Removes itself
Launches itself as a daemon
Substitutes application name for:
  • (sd-pam)
Kills the following processes:
  • <SAMPLE>
Performs operations with the file system:
Creates or modifies files:
  • <SAMPLE_FULL_PATH>
Network activity:
Awaits incoming connections on ports:
  • 19#.##8.218.50:3467
Establishes connection:
  • 8.#.8.8:53
  • 19#.##9.147.16:4321
  • 37.##.150.53:7685
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 19#.##9.147.16:4321
  • 37.##.150.53:7685
  • 0.0.0.0:0
  • 80.##.73.96:23
  • 11#.##3.222.101:23
  • 58.##6.0.100:23
  • 63.#.117.36:23
  • 65.##.122.40:23
  • 13#.#3.85.74:23
  • 12#.##3.196.102:23
  • 27.##4.88.61:23
  • 12#.##9.66.160:23
  • 23#.#3.201.5:23
  • 24#.##.178.165:23
  • 15#.##1.195.5:23
  • 94.###.95.100:23
  • 19#.##7.214.219:23
  • 16#.##2.41.133:23
  • 19#.##.173.14:23
  • 14#.##.171.91:23
  • 76.##.37.58:23
  • 10#.##.87.172:23
  • 25#.##.17.150:23
  • 15#.#8.38.36:23
  • 18.###.31.109:23
  • 9.###.28.135:23
  • 35.##.9.70:23
  • 18#.#.57.100:23
  • 75.###.131.119:23
  • 12#.##2.153.95:23
  • 18#.##.239.31:23
  • 17#.##5.64.10:23
  • 21#.##6.189.235:23
  • 18#.##.249.11:23
  • 70.##.192.250:23
  • 1.##.213.158:23
  • 3.##.56.63:23
  • 24#.##6.238.31:23
  • 15#.##1.105.60:23
  • 19#.##0.221.56:23
  • 95.###.235.58:23
  • 30.###.90.194:23
  • 13#.#2.130.0:23
  • 12#.##2.221.79:23
  • 11#.##4.44.244:23
  • 76.##.214.186:23
  • 19.##.137.48:23
  • 12#.##.254.140:23
  • 18#.##9.194.101:23
  • 54.##.89.152:23
  • 17#.##.47.208:23
  • 21#.##.103.81:23
  • 22#.##5.242.134:23
  • 17#.##.221.230:23
  • 12#.##.15.183:23
  • 17#.##4.110.104:23
  • 13#.##.39.211:23
  • 13#.##6.90.101:23
  • 12#.##0.49.22:23
  • 22#.##5.229.247:23
  • 19.###.61.242:23
  • 21#.##.232.108:23
  • 23#.##.102.152:23
  • 5.#.#6.146:23
  • 25#.##8.233.132:23
  • 12#.##2.104.140:23
  • 20.##8.64.97:23
  • 23#.##9.188.158:23
  • 19.##2.8.183:23
  • 54.###.190.170:23
  • 10#.##2.181.248:23
  • 21#.##.216.63:23
  • 13#.##8.235.147:23
  • 22#.##.197.224:23
  • 70.##.39.97:23
  • 13#.##4.112.224:23
  • 82.###.224.155:23
  • 20#.##9.130.104:23
  • 61.###.135.131:23
  • 21#.##3.159.58:23
  • 21#.##3.201.60:23
  • 16#.##.186.85:23
  • 83.###.142.86:23
  • 11#.##8.39.253:23
  • 11#.##1.116.165:23
  • 8.##.143.232:23
  • 37.##.252.252:23
Receives data from the following servers:
  • 37.##.150.53:7685
  • 19#.##9.147.16:4321

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number