Linux.Siggen.2038

Linux.Siggen.2038

Added to the Dr.Web virus database: 2019-07-29

Virus description added: 2019-07-29

To ensure autorun and distribution:

Creates or modifies the following files:

Creates or modifies the following symlinks:

Malicious functions:

Launches itself as a daemon

Compiles a program from source codes:

gcc /usr/local/lib/libboost_threads.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libboost_threads.so

Manages services:

Launches processes:

<SAMPLE_FULL_PATH>
/usr/local/sbin/libexeced
/bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;chkconfig --add sshservice
/bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;systemctl enable sshservice
/sbin/insserv sshservice
/bin/sh -c chattr -i /etc/ld.so.preload
chattr -i /etc/ld.so.preload
/bin/sh -c chattr -i /usr/local/lib/libboost_threads.so
chattr -i /usr/local/lib/libboost_threads.so
/bin/sh -c chattr -i /usr/local/lib/libboost_threads.c
chattr -i /usr/local/lib/libboost_threads.c
/bin/sh -c export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin;gcc /usr/local/lib/libboost_threads.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libboost_threads.so

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Awaits incoming connections on ports:

Establishes connection:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers:

Other:

Collects RAM information