マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.2865

Added to the Dr.Web virus database: 2020-05-08

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /var/spool/cron/crontabs/root
Malicious functions:
Launches itself as a daemon
Launches processes:
  • sh -c echo 'echo 128 > /proc/sys/vm/nr_hugepages;sysctl -w vm.nr_hugepages=128>/dev/null'|nohup sh >/dev/null 2>&1 &
  • nohup sh
  • sh
  • sysctl -w vm.nr_hugepages=128
  • sh -c echo \"echo '*/1 * * * * echo Y2QgL3Jvb3QvOy9yb290LzdiNWEwMjRjYWYzNmJiNWVlM2FmMDBjYzNkZWQxNWNlZGJhMGMyYjU=|base64 -d|sh'|crontab\"|nohup sh >/dev/null 2>&1 &
  • sh -c echo 'sleep 2;<SAMPLE_FULL_PATH>'|nohup sh >/dev/null 2>&1 &
  • sh -c echo 'chattr -ia /root/.Historys;rm -rf /root/.Historys;cp <SAMPLE_FULL_PATH> /root/.Historys;chmod 775 /root/.Historys;/root/.Historys <SAMPLE_FULL_PATH>;rm -f /root/.Historys;'|nohup sh >/dev/null 2>&1 &
  • crontab
  • sleep 2
  • chattr -ia /root/.Historys
  • rm -rf /root/.Historys
  • cp <SAMPLE_FULL_PATH> /root/.Historys
  • chmod 775 /root/.Historys
  • /root/.Historys <SAMPLE_FULL_PATH>
  • rm -f /root/.Historys
  • sh -c chmod 775 /root/.systemLog;/root/.systemLog;rm /root/.systemLog
  • chmod 775 /root/.systemLog
  • /root/.systemLog
  • <SAMPLE_FULL_PATH>
  • rm /root/.systemLog
  • sh -c ps aux |grep -v 9999999 | awk '{if($3>39.0) print $2}' | while read procid; do kill -9 $procid; done
  • ps aux
  • grep -v 9999999
  • awk {if($3>39.0) print $2}
  • sh -c echo 'chattr +ia <SAMPLE_FULL_PATH>;'|nohup sh >/dev/null 2>&1 &
  • chattr +ia <SAMPLE_FULL_PATH>
Kills the following processes:
  • bash
  • run.sh
  • /bin/sh
  • /root/.systemLog
Performs operations with the file system:
Modifies file access rights:
  • /var/spool/cron/crontabs/tmp.jbKdLj
  • /root/.Historys
  • /root/.systemLog
  • /var/spool/cron/crontabs/tmp.535DE5
Creates or modifies files:
  • /proc/sys/vm/nr_hugepages
  • /var/spool/cron/crontabs/tmp.jbKdLj
  • /root/.Historys
  • /root/.systemLog
  • /var/spool/cron/crontabs/tmp.535DE5
Deletes files:
  • /root/.Historys
  • /root/.systemLog
Network activity:
Establishes connection:
  • 15#.##9.48.33:80
DNS ASK:
  • xm######ast1.nanopool.org
  • p.###cow.vip
Other:
Collects CPU information
Collects RAM information
Collects information about network activity

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number