マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.847

Added to the Dr.Web virus database: 2018-08-19

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/samba
Creates or modifies the following symlinks:
  • /etc/rc3.d/S99samba
Malicious functions:
Launches processes:
  • <SAMPLE_FULL_PATH> postgresql-auto-update
  • /root/linux-gnu system-update
Performs operations with the file system:
Creates folders:
  • /tmp/seconfig
  • /etc/seconfig
Creates or modifies files:
  • /root/linux-gnu
  • <SAMPLE_FULL_PATH>
  • /tmp/seconfig/z.sh
Deletes files:
  • /var/log/utmp
  • /var/log/wtmp
  • /var/log/lastlog
  • /var/log/secure
  • /root/linux-gnu
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:47292
  • 127.0.0.1:37373
Establishes connection:
  • 10#.##3.83.23:27
HTTP GET requests:
  • 10#.###.#2.32/xorgg_linux_amd64
Receives data from the following servers:
  • 10#.##3.83.23:27
  • 10#.##3.82.32:80

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number