Linux.Siggen.4383
Added to the Dr.Web virus database:
2022-02-03
Virus description added:
2022-02-03
Technical Information
Malicious functions:
Removes itself
Gets access to SSH keys
- /root/.ssh/authorized_keys
Launches processes:
- uname -a
- cat /proc/cpuinfo
- cat /etc/issue
- free -h
- uptime
- /bin/bash -
- journalctl -S @0 -u sshd
- chattr -ia /root/.ssh/authorized_keys
- cat /var/log/auth*
- zcat /var/log/auth*
- gzip -cd /var/log/auth*
Performs operations with the file system:
Creates folders:
Deletes files:
- /dev/shm/<SAMPLE_FULL_PATH>
- /tmp/<SAMPLE_FULL_PATH>
- /var/tmp/<SAMPLE_FULL_PATH>
- /root/<SAMPLE_FULL_PATH>
- /etc/<SAMPLE_FULL_PATH>
Network activity:
Establishes connection:
- 127.0.0.1:9
- [:#1]:9
- [:##]:1234
- 127.0.0.1:1234
- [:##]:22
Sends data to the following servers:
Receives data from the following servers:
Other:
Collects OS information
Collects CPU information
Collects RAM information
Collects information about network activity
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
このウェブサイトを継続して訪問する場合、訪問者に関する統計データを収集するためのCookieファイルおよび他のテクノロジーを弊社が利用することに同意したものとします。詳細