マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.3845

Added to the Dr.Web virus database: 2021-04-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/cron.hourly/checkpaidversionvpssim
Malicious functions:
Launches processes:
  • /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
  • <SAMPLE_FULL_PATH>
  • /bin/bash <SAMPLE_FULL_PATH> -c
  • cat
  • grep opcache.blacklist /etc/php.d/opcache.ini
  • /etc/vpssim/menu/inc/re-start-php-fpm-service
  • chmod +x /etc/cron.hourly/checkpaidversionvpssim
Performs operations with the file system:
Modifies file access rights:
  • /etc/cron.hourly/checkpaidversionvpssim
Creates or modifies files:
  • /etc/logrotate.d/nginx
  • /tmp/sh-thd-201187253
  • /etc/logrotate.d/php-fpm
  • /tmp/sh-thd-201187252
  • /etc/logrotate.d/mysql
  • /etc/php.d/opcache.ini
  • /etc/vpssim/opcache.blacklist
  • /etc/vpssim/vpssim.config.firstime
Deletes files:
  • /tmp/sh-thd-201187253
  • /tmp/sh-thd-201187252
Other:
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number