マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.508

Added to the Dr.Web virus database: 2018-04-01

Virus description added:

Technical Information

Malicious functions:
Kills the following processes:
  • <SAMPLE>
Performs operations with the file system:
Deletes folders:
  • /var/run/.lightscan"
Creates or modifies files:
  • /run/.lightpid
Network activity:
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Connects to the following servers over the IRC protocol:
  • Server: 21#.#09.222.122; Command: PASS fuckya\n
  • Server: 21#.#09.222.122; Command: NICK [M]tzdlsti6n2\n
  • Server: 21#.#09.222.122; Command: USER FOR FREE localhost :G66K ;)\n
  • Server: 21#.#09.222.122; Command: TOPIC #g66k\n
  • Server: 21#.#09.222.122; Command: PONG :31212BA0
  • Server: 21#.#09.222.122; Command: JOIN #g66k :key\n
  • Server: 21#.#09.222.122; Command: NOTICE #g66k :[advscan] scanning range: 54.#2.0.0/16 (user:admin pass:admin). wait..\n
  • Server: 21#.#09.222.122; Command: PONG 366
  • Server: 21#.#09.222.122; Command: PONG PRIVMSG
  • Server: 21#.#09.222.122; Command: PONG NOTICE

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number