Linux.Siggen.3383

Linux.Siggen.3383

Added to the Dr.Web virus database: 2020-11-12

Virus description added: 2020-11-12

To ensure autorun and distribution:

Creates or modifies the following files:

Creates or modifies the following symlinks:

Malicious functions:

Launches itself as a daemon

Manages services:

Launches processes:

sh -c chattr -i /bin/sysetmdfb4eadd4
chattr -i /bin/sysetmdfb4eadd4
sh -c chattr +i /bin/sysetmdfb4eadd4
chattr +i /bin/sysetmdfb4eadd4
sh -c chkconfig --add sysetmdfb4eadd4
sh -c update-rc.d sysetmdfb4eadd4 defaults
/sbin/insserv sysetmdfb4eadd4
sh -c sed -i '/\/etc\/cron.hourly\/cron.sh/d' /etc/crontab ; echo '*/3 * * * * root /etc/cron.hourly/cron.sh' >> /etc/crontab
sed -i /\/etc\/cron.hourly\/cron.sh/d /etc/crontab
sh -c sed -i '/\/bin\/sysetmdfb4eadd4/d' /root/.profile; echo '/bin/sysetmdfb4eadd4 d > /dev/null 2>&1' >> /root/.profile
sed -i /\/bin\/sysetmdfb4eadd4/d /root/.profile
sh -c sed -i '/\/bin\/sysetmdfb4eadd4/d' /root/.bashrc; echo '/bin/sysetmdfb4eadd4 d > /dev/null 2>&1' >> /root/.bashrc
sed -i /\/bin\/sysetmdfb4eadd4/d /root/.bashrc
/bin/sysetmdfb4eadd4
sh -c sed -i '/\/etc\/cron.hourly\/cron.sh/d' /etc/crontab
sh -c sed -i '/\/bin\/sysetmdfb4eadd4/d' /root/.profile
sh -c sed -i '/\/bin\/sysetmdfb4eadd4/d' /root/.bashrc

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates or modifies files:

Deletes files:

Locks files: