Um eine korrekte Funktionsweise unserer Website zu gewährleisten, müssen Sie die Unterstützung für JavaScript in Ihrem Browser aktivieren.
Linux.Siggen.7731
Added to the Dr.Web virus database:
2024-07-02
Virus description added:
2024-07-02
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/dpkg-deb-package
/etc/cron.d/dbus-manager
/etc/cron.hourly/dbus-manager
/etc/cron.daily/dbus-manager
/etc/cron.weekly/dbus-manager
/etc/cron.monthly/dbus-manager
Creates or modifies the following symlinks:
/etc/rc2.d/S01dpkg-deb-package
/etc/rc3.d/S01dpkg-deb-package
/etc/rc4.d/S01dpkg-deb-package
/etc/rc5.d/S01dpkg-deb-package
Malicious functions:
Substitutes application name for:
Manages services:
['systemctl', 'daemon-reload']
['systemctl', 'enable', 'dpkg-deb-package.service']
Launches processes:
bash -c find /dev/shm -type f -regextype egrep -regex \x27.*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\x27 -exec rm -rf {} +
grep Port
/usr/bin/mawk awk {print \x22-\x22$2}
ps aux
chattr +ia /bin/dpkg-debian
head -n 1
chattr -ia /etc/cron.weekly/man-db
lsof -t -i :444
chattr +ia /root/.bash_profile
pgrep -f sysrv
/bin/sh /lib/systemd/systemd-sysv-install enable dpkg-deb-package
chattr +ia /etc/init.d/dpkg-deb-package
cp -f -r -- /bin/dpkg-debian /bin/dpkg-deb-package
chattr -ia /var/spool/cron/crontabs
hostname
chattr -ia /etc/cron.daily/apt-compat
<0x2bd>
/usr/bin/mawk awk {print $1}
/usr/bin/perl /usr/sbin/update-rc.d dpkg-deb-package defaults
chattr -ia /etc/cron.d/e2scrub_all
hostname -I
chattr -ia /etc/cron.daily/man-db
ps x
/usr/bin/mawk awk {if($3>30.0) print $2}
chattr -ia /etc/cron.daily/logrotate
lsof -t -i :59475
cat /etc/ssh/sshd_config
ps -eo pid,ppid,comm,%cpu --sort=-%cpu
chattr -ia /etc/cron.daily/.placeholder
<0x3a0>
pgrep -f ksysr
bash -c ufw disable
/usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
chattr -ia /etc/cron.d/.placeholder
/tmp/-python37-85c333f4-cfaa-40d8-af62-a0913106b417
grep -c ^processor /proc/cpuinfo
chattr -ia /etc/cron.weekly/.placeholder
ps -A -ostat,ppid
rm -rf -- dpkg-deb-package
chattr +ia /etc/systemd/system/dpkg-deb-package.service
id -u
find /dev/shm -type f -regextype egrep -regex .*[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12} -exec rm -rf {} +
ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
grep /etc/cron
whoami
/bin/bash /etc/init.d/dpkg-deb-package start
sed -e s/^ *//
nohup ./dpkg-deb-package
chattr -ia /etc/cron.monthly/.placeholder
grep -v grep
cut -d: -f2
grep -v -- -bash[[:space:]]*$
/usr/bin/perl /usr/sbin/update-rc.d dpkg-deb-package enable
/tmp/-bash-540478f0-69e4-4cf6-a250-8bdce5f3129c -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d
chattr -ia /etc/cron.hourly/.placeholder
pgrep -f klibsystem4
getopt -o r: --long root: -- enable dpkg-deb-package
sed -e s/$//
grep -m 1 model name /proc/cpuinfo
grep -v /usr/sbin/httpd
chattr -ia /etc/cron.daily/dpkg
pgrep -f klibsystem5
Kills the following processes:
Performs operations with the file system:
Modifies file access rights:
/etc/init.d/dpkg-deb-package
/usr/bin/dpkg-debian
Deletes folders:
Creates or modifies files:
/etc/systemd/system/dpkg-deb-package.service
/root/.bash_profile
/usr/bin/dpkg-debian
/tmp/-python37-85c333f4-cfaa-40d8-af62-a0913106b417
/tmp/.bashirc
/tmp/-bash-540478f0-69e4-4cf6-a250-8bdce5f3129c
/var/spool/cron/dbus-manager
Deletes files:
/etc/cron.d/.placeholder
/tmp/-python37-85c333f4-cfaa-40d8-af62-a0913106b417
/etc/cron.d/e2scrub_all
/var/spool/cron/crontabs
/etc/cron.hourly/.placeholder
/etc/cron.daily/.placeholder
/etc/cron.daily/apt-compat
/etc/cron.daily/dpkg
/etc/cron.daily/logrotate
/etc/cron.daily/man-db
/etc/cron.weekly/.placeholder
/etc/cron.weekly/man-db
/etc/cron.monthly/.placeholder
Locks files:
Network activity:
Awaits incoming connections on ports:
Establishes connection:
80.##.24.30:80
80.##.24.30:443
77.###.149.212:80
77.###.149.212:443
DNS ASK:
c4####cd.pwndns.pw
pl##.sck-dns.cc
Sends data to the following servers:
80.##.24.30:80
77.###.149.212:80
Receives data from the following servers:
80.##.24.30:80
77.###.149.212:80
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
Laden Sie Dr.Web für Android herunter
Kostenlos für 3 Monate
Alle Schutzkomponenten
Verlängerung der Testversion über AppGallery/Google Pay
Wenn Sie diese Webseite weiter benutzen, bedeutet dies, dass Sie mit der Verarbeitung von Cookies sowie dem Einsatz anderer Technologien zur Sammlung von statistischen Nutzerdaten einverstanden sind. Mehr dazu
OK