マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.2004

Added to the Dr.Web virus database: 2019-07-16

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • /bin/busybox
Kills the following processes:
  • <SAMPLE>
Network activity:
Establishes connection:
  • 19#.##.97.85:9090
  • 15#.##.20.54:37215
  • 19#.##.20.54:37215
  • 15#.#.216.111:37215
  • 15#.###.143.245:37215
  • 41.###.68.236:37215
  • 19#.###.248.25:37215
  • 41.###.202.201:37215
  • 19#.##.14.20:37215
  • 19#.###.123.227:37215
  • 41.###.25.249:37215
  • 15#.###.95.249:37215
  • 41.##.144.255:37215
  • 15#.##.113.114:37215
  • 15#.###.205.118:37215
  • 15#.##.147.96:37215
  • 41.##.226.68:37215
  • 41.###.220.46:37215
  • 15#.###.23.200:37215
  • 15#.###.233.204:37215
  • 41.##.118.201:37215
  • 41.###.17.25:37215
  • 41.###.16.11:37215
  • 41.##.68.132:37215
  • 41.###.18.56:37215
  • 15#.##.37.237:37215
  • 19#.##7.3.163:37215
  • 41.##.130.137:37215
  • 19#.###.173.21:37215
  • 15#.###.191.63:37215
  • 41.###.250.252:37215
  • 15#.###.85.127:37215
  • 41.###.217.223:37215
  • 41.###.194.204:37215
  • 41.###.115.39:37215
  • 41.##.100.241:37215
  • 19#.##.17.16:37215
  • 19#.##5.19.19:37215
  • 41.###.214.187:37215
  • 15#.###.171.48:37215
  • 19#.###.163.103:37215
  • 19#.##.33.115:37215
  • 19#.##9.68.57:37215
  • 41.##.141.185:37215
  • 15#.##0.42.59:37215
  • 41.##.47.165:37215
  • 41.###.146.240:37215
  • 19#.##3.244.9:37215
  • 19#.##.97.36:37215
  • 15#.###.50.114:37215
  • 19#.##.110.222:37215
  • 19#.###.222.81:37215
  • 41.##.145.226:37215
  • 15#.###.148.208:37215
  • 41.##.18.79:37215
  • 41.##.165.180:37215
  • 19#.##.243.249:37215
  • 19#.###.190.219:37215
  • 19#.##6.96.40:37215
  • 19#.#.242.7:37215
  • 15#.###.247.43:37215
  • 15#.###.116.248:37215
  • 41.###.57.180:37215
  • 19#.##.171.129:37215
  • 15#.###.20.111:37215
  • 19#.###.54.124:37215
  • 41.##.83.24:37215
  • 19#.###.54.161:37215
  • 15#.###.102.117:37215
  • 41.###.13.194:37215
  • 15#.###.48.214:37215
  • 15#.###.101.141:37215
  • 41.###.37.180:37215
  • 15#.###.123.96:37215
  • 15#.##.180.20:37215
  • 15#.##2.93.52:37215
  • 15#.###.14.241:37215
  • 41.###.120.143:37215
  • 19#.###.245.25:37215
  • 15#.###.27.207:37215
  • 41.###.189.173:37215
  • 19#.###.67.128:37215
  • 41.###.139.62:37215
  • 19#.###.248.16:37215
  • 15#.###.174.102:37215
  • 41.###.15.254:37215
  • 19#.##2.98.53:37215
  • 41.#.#90.176:37215
  • 19#.##.63.192:37215
  • 41.###.157.210:37215
  • 19#.##.89.70:37215
  • 19#.##.102.29:37215
  • 19#.##.70.31:37215
  • 19#.##0.28.61:37215
  • 15#.###.127.153:37215
  • 41.##.26.152:37215
  • 15#.#.53.1:37215
  • 41.##.193.22:37215
  • 19#.###.255.97:37215
  • 19#.###.46.236:37215
  • 15#.###.253.220:37215
  • 41.###.119.138:37215
  • 15#.###.144.67:37215
  • 41.##.107.186:37215
  • 41.###.238.177:37215
  • 19#.##.90.122:37215
  • 41.#.#52.131:37215
  • 19#.##6.4.55:37215
  • 15#.##5.56.13:37215
  • 41.##.162.128:37215
  • 41.##.197.164:37215
  • 41.###.135.10:37215
  • 15#.###.191.65:37215
  • 19#.##.102.134:37215
  • 41.##.26.198:37215
  • 19#.##7.13.86:37215
  • 15#.###.136.91:37215
  • 19#.#.26.219:37215
  • 15#.###.235.80:37215
  • 15#.#.217.207:37215
  • 15#.##.63.24:37215
  • 41.##.29.202:37215
  • 19#.##.179.161:37215
  • 19#.##7.4.218:37215
  • 15#.###.121.101:37215
  • 41.###.56.59:37215
  • 15#.##9.7.0:37215
  • 15#.##.49.254:37215
  • 19#.###.198.62:37215
  • 19#.##.147.123:37215
  • 19#.##2.44.19:37215
  • 15#.###.165.110:37215
  • 15#.###.110.204:37215
  • 41.##.129.12:37215
  • 19#.##6.14.72:37215
  • 15#.#.141.52:37215
  • 15#.###.128.197:37215
  • 15#.##.183.169:37215
  • 15#.##2.97.23:37215
  • 15#.##0.2.131:37215
  • 41.###.12.254:37215
  • 41.###.238.243:37215
  • 19#.##5.94.86:37215
  • 19#.###.108.80:37215
  • 19#.##.240.127:37215
  • 41.###.231.153:37215
  • 41.###.183.115:37215
  • 15#.##.239.85:37215
  • 41.##.147.156:37215
  • 19#.###.251.35:37215
  • 19#.##.34.253:37215
  • 19#.###.188.25:37215
  • 41.###.80.18:37215
  • 15#.##8.12.20:37215
  • 19#.###.172.232:37215
  • 15#.##.169.189:37215
  • 41.###.234.10:37215
  • 19#.###.190.191:37215
  • 15#.###.107.225:37215
  • 15#.##8.60.88:37215
  • 41.##.125.32:37215
  • 15#.##.117.157:37215
  • 15#.##.176.32:37215
  • 15#.##.168.17:37215
  • 15#.##.58.92:37215
  • 15#.##.24.241:37215
  • 15#.##.205.21:37215
  • 19#.##.243.122:37215
  • 15#.##.121.62:37215
  • 19#.###.91.154:37215
  • 15#.##8.79.81:37215
  • 15#.###.62.230:37215
  • 15#.###.169.171:37215
  • 41.##.17.140:37215
  • 41.#.#3.97:37215
  • 19#.##6.59.43:37215
  • 15#.###.58.225:37215
  • 41.##.91.200:37215
  • 19#.###.202.110:37215
  • 41.###.221.86:37215
  • 19#.##.99.222:37215
  • 41.##.56.28:37215
  • 41.###.109.83:37215
  • 15#.###.225.229:37215
  • 41.###.208.219:37215
  • 19#.###.121.126:37215
  • 15#.###.157.244:37215
  • 15#.###.147.152:37215
  • 41.###.112.229:37215
  • 19#.##.144.220:37215
  • 19#.###.133.139:37215
  • 15#.###.254.235:37215
  • 15#.##0.0.117:37215
  • 19#.###.255.83:37215
  • 19#.###.233.93:37215
  • 41.###.178.51:37215
  • 15#.###.65.254:37215
  • 15#.##.56.5:37215
  • 19#.###.10.226:37215
  • 19#.##9.95.90:37215
  • 41.###.9.87:37215
  • 19#.###.183.218:37215
  • 15#.###.112.13:37215
  • 41.###.25.123:37215
  • 19#.##.102.89:37215
  • 19#.###.10.188:37215
  • 19#.###.133.12:37215
  • 15#.##.29.246:37215
  • 15#.###.238.196:37215
  • 41.##.63.84:37215
  • 19#.###.104.54:37215
  • 41.##.208.238:37215
  • 19#.##0.72.9:37215
  • 19#.##.93.56:37215
  • 41.###.252.191:37215
  • 41.###.168.17:37215
  • 15#.##.89.116:37215
  • 19#.##.90.70:37215
  • 41.###.128.185:37215
  • 19#.###.195.80:37215
  • 19#.###.131.97:37215
  • 19#.##.96.222:37215
  • 15#.###.87.189:37215
  • 19#.##4.124.7:37215
  • 19#.###.10.107:37215
  • 41.###.101.2:37215
  • 15#.##.206.43:37215
  • 19#.##.207.190:37215
  • 41.###.9.207:37215
  • 19#.###.168.18:37215
  • 19#.##.67.207:37215
  • 41.###.0.21:37215
  • 41.###.150.145:37215
  • 19#.###.115.249:37215
  • 19#.##.84.153:37215
  • 41.###.106.210:37215
  • 19#.##.207.85:37215
  • 15#.##.155.26:37215
  • 41.###.18.56:37215
  • 15#.##.72.218:37215
  • 15#.###.229.105:37215
  • 19#.#.223.230:37215
  • 15#.##7.180.9:37215
  • 15#.###.234.175:37215
  • 19#.###.100.65:37215
  • 19#.##8.4.139:37215
  • 15#.###.193.24:37215
  • 19#.#.31.150:37215
  • 41.##.137.18:37215
  • 41.##.253.223:37215
  • 15#.###.255.175:37215
  • 19#.###.180.17:37215
  • 15#.##.97.89:37215
  • 15#.##1.250.7:37215
  • 41.##.59.27:37215
  • 41.###.74.150:37215
  • 19#.###.247.105:37215
  • 19#.##3.31.72:37215
  • 19#.###.65.133:37215
  • 15#.###.138.116:37215
  • 15#.##.164.3:37215
  • 41.##.250.244:37215
  • 19#.##.208.255:37215
  • 41.###.98.210:37215
  • 41.###.43.139:37215
  • 41.##.189.145:37215
  • 41.##.251.163:37215
  • 19#.###.205.196:37215
  • 15#.###.174.154:37215
  • 19#.##2.51.73:37215
  • 15#.###.26.192:37215
  • 19#.##.144.195:37215
  • 15#.###.22.101:37215
  • 19#.##1.8.160:37215
  • 19#.###.68.150:37215
  • 15#.###.173.19:37215
  • 41.##.179.47:37215
  • 15#.##0.54.19:37215
  • 15#.###.208.108:37215
  • 15#.###.246.114:37215
  • 19#.###.44.124:37215
  • 19#.###.112.71:37215
  • 41.###.200.212:37215
  • 19#.###.126.85:37215
  • 19#.##.180.239:37215
  • 41.###.124.166:37215
  • 41.##.168.174:37215
  • 19#.###.220.155:37215
  • 19#.##.47.181:37215
  • 41.###.109.66:37215
  • 19#.###.24.199:37215
  • 41.###.149.236:37215
  • 15#.###.240.119:37215
  • 41.###.64.156:37215
  • 19#.###.130.111:37215
  • 15#.##2.21.96:37215
  • 19#.##.146.164:37215
  • 41.###.196.105:37215
  • 19#.##4.94.35:37215
  • 19#.##.148.17:37215
  • 15#.##.171.122:37215
  • 19#.##.60.236:37215
  • 41.###.65.218:37215
  • 15#.###.184.64:37215
  • 15#.##.128.48:37215
  • 41.###.57.71:37215
  • 19#.##.33.240:37215
  • 19#.###.52.232:37215
  • 19#.###.149.76:37215
  • 15#.##.249.5:37215
  • 15#.##.42.174:37215
  • 41.###.215.202:37215
  • 15#.##.121.57:37215
  • 15#.##.92.223:37215
  • 15#.##1.79.89:37215
  • 15#.##4.97.43:37215
  • 19#.##.167.194:37215
  • 41.#.#85.171:37215
  • 41.###.66.132:37215
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 19#.##.97.85:9090
Other:
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number