Linux.Siggen.1913
Added to the Dr.Web virus database:
2019-07-03
Virus description added:
2019-07-03
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/init.d/netdns
- /etc/init.d/.depend.boot
- /etc/init.d/.depend.start
- /etc/init.d/.depend.stop
Creates or modifies the following symlinks:
- /etc/rc0.d/K01netdns
- /etc/rc1.d/K01netdns
- /etc/rc2.d/S01netdns
- /etc/rc3.d/S01netdns
- /etc/rc4.d/S01netdns
- /etc/rc5.d/S01netdns
- /etc/rc6.d/K01netdns
Malicious functions:
Manages services:
- systemctl enable netdns
- /usr/sbin/update-rc.d netdns defaults
- systemctl daemon-reload
Launches processes:
- /bin/bash -c chattr -i /etc/ld.so.preload
- chattr -i /etc/ld.so.preload
- /bin/bash -c chattr -i /usr/local/lib/libioset.so
- chattr -i /usr/local/lib/libioset.so
- /bin/bash -c chattr -i /usr/lib/systemd/system/netdns.service
- chattr -i /usr/lib/systemd/system/netdns.service
- /bin/bash -c chkconfig --add netdns
- /bin/bash -c systemctl enable netdns
- /sbin/insserv netdns
Performs operations with the file system:
Creates or modifies files:
- /tmp/.lsdpid
- /usr/sbin/kthrotlds
- /usr/lib/systemd/system/netdns.service
Deletes files:
- /etc/ld.so.preload
- /usr/local/lib/libioset.so
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
このウェブサイトを継続して訪問する場合、訪問者に関する統計データを収集するためのCookieファイルおよび他のテクノロジーを弊社が利用することに同意したものとします。詳細