マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.3051

Added to the Dr.Web virus database: 2020-05-25

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Substitutes application name for:
  • /var/Sofia
Performs operations with the file system:
Modifies file access rights:
  • /bin/systemctl
Deletes files:
  • /dev/zero
Network activity:
Awaits incoming connections on ports:
  • 0.0.0.0:9105
Establishes connection:
  • 8.#.8.8:53
  • 51.##.180.147:28344
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
Sends data to the following servers:
  • 19#.##5.188.179:23
  • 17#.##.27.249:23
  • 12#.#8.1.139:23
  • 20#.##4.168.62:23
  • 15#.#.171.93:23
  • 11#.##6.233.143:23
  • 49.###.125.19:23
  • 18#.##.191.71:23
  • 17#.#.238.147:23

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number