Linux.Siggen.3867

Linux.Siggen.3867

Added to the Dr.Web virus database: 2021-05-01

Virus description added: 2021-05-01

To ensure autorun and distribution:

Creates or modifies the following files:

Creates or modifies the following symlinks:

Malicious functions:

Launches itself as a daemon

Manages services:

Launches processes:

sh -c chattr -i /bin/sysetmd792d80b2
chattr -i /bin/sysetmd792d80b2
sh -c chattr +i /bin/sysetmd792d80b2
chattr +i /bin/sysetmd792d80b2
sh -c chkconfig --add sysetmd792d80b2
sh -c update-rc.d sysetmd792d80b2 defaults
/sbin/insserv sysetmd792d80b2
sh -c sed -i '/\/etc\/cron.hourly\/cron.sh/d' /etc/crontab ; echo '*/3 * * * * root /etc/cron.hourly/cron.sh' >> /etc/crontab
sed -i /\/etc\/cron.hourly\/cron.sh/d /etc/crontab
sh -c sed -i '/\/bin\/sysetmd792d80b2/d' /root/.profile; echo '/bin/sysetmd792d80b2 d > /dev/null 2>&1' >> /root/.profile
sed -i /\/bin\/sysetmd792d80b2/d /root/.profile
sh -c sed -i '/\/bin\/sysetmd792d80b2/d' /root/.bashrc; echo '/bin/sysetmd792d80b2 d > /dev/null 2>&1' >> /root/.bashrc
sed -i /\/bin\/sysetmd792d80b2/d /root/.bashrc
/bin/sysetmd792d80b2
sh -c sed -i '/\/etc\/cron.hourly\/cron.sh/d' /etc/crontab
sh -c sed -i '/\/bin\/sysetmd792d80b2/d' /root/.profile
sh -c sed -i '/\/bin\/sysetmd792d80b2/d' /root/.bashrc

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates or modifies files:

Deletes files:

Locks files: