マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.6746

Added to the Dr.Web virus database: 2024-03-15

Virus description added:

Technical Information

Malicious functions:
Launches itself as a daemon
Launches processes:
  • iptables -A INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
  • /var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
  • /usr/sbin/xtables-nft-multi iptables -L OUTPUT -t raw --line-numbers
  • /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
  • iptables -D INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -I INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -C INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
  • iptables -D INPUT -p tcp --syn -j DROP
  • iptables -D INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
  • iptables -L OUTPUT -t raw --line-numbers
  • /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
  • iptables -t raw -I OUTPUT -p tcp --sport 46759 -j NOTRACK
  • /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
  • iptables -A INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -j DROP
  • iptables -A INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
  • iptables -D INPUT -p tcp --syn -s 10.0.0.0/8 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
  • iptables -D INPUT -p tcp --syn -s 192.0.0.0/8 -j ACCEPT
  • iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
  • iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
  • iptables -I INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
  • iptables -A INPUT -p tcp --syn -s 172.16.0.0/12 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -D INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -D OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
  • iptables -D OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -t raw -I OUTPUT -p tcp --sport 46759 -j NOTRACK
  • iptables -D INPUT -p tcp --syn -s 100.64.0.0/10 -j ACCEPT
  • iptables -A INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -j DROP
  • iptables -A INPUT -p tcp --syn -j DROP
  • iptables -L INPUT --line-numbers
  • iptables -D INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -A INPUT -p tcp --syn -s 127.0.0.0/8 -j ACCEPT
  • iptables -C INPUT -p tcp --syn -s 45.95.146.93 -j ACCEPT
  • /usr/sbin/xtables-nft-multi iptables -L INPUT --line-numbers
Performs operations with the file system:
Modifies file access rights:
  • /var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
Creates or modifies files:
  • /var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
  • /dev/watchdog
  • /proc/sys/net/netfilter/nf_conntrack_max
  • /proc/sys/net/ipv4/ip_forward
Deletes files:
  • /var/tmp/MzxvzbtPR3HHkV3LYw1RTNz0k
Mounts file systems:
  • /boot/none
Network activity:
Awaits incoming connections on ports:
  • 127.0.0.1:65528
  • 127.0.0.1:65531
Establishes connection:
  • 45.##.146.93:82
  • 8.#.8.8:53
  • 45.##.146.93:81
Attacks using a special dictionary (brute-force technique) via the Telnet protocol.
DNS ASK:
  • 0.#.#.#0.in-addr.arpa
  • 0.#.##.100.in-addr.arpa
  • 0.#.#.#27.in-addr.arpa
  • 0.#.##.172.in-addr.arpa
  • 0.#.#.#92.in-addr.arpa
Sends data to the following servers:
  • 45.##.146.93:82
  • 45.##.146.93:81
  • 45.##.146.93:8083
  • 10.#.193.37:23
  • 10.#.0.222:23
  • 10.###.113.173:23
  • 10.##8.66.67:23
  • 10.##4.1.158:23
  • 10.###.81.213:23
  • 10.##3.99.16:23
  • 10.###.226.128:23
  • 10.#.112.125:23
  • 10.###.17.198:23
  • 10.###.178.53:23
  • 10.###.231.217:23
  • 10.###.70.104:23
  • 10.###.76.187:23
  • 10.###.231.59:23
  • 10.###.246.109:23
  • 10.###.247.220:23
  • 10.###.54.126:23
  • 10.###.113.240:23
  • 10.###.199.254:23
  • 10.###.157.25:23
  • 10.###.53.115:23
  • 10.##9.62.61:23
  • 10.##3.49.51:23
  • 10.##9.1.188:23
  • 10.###.182.12:23
  • 10.###.64.150:23
  • 10.###.102.24:23
  • 10.###.71.147:23
  • 10.##0.51.48:23
  • 10.###.210.182:23
  • 10.###.177.100:23
  • 10.###.49.240:23
  • 10.###.161.251:23
  • 10.###.151.49:23
  • 10.##7.7.149:23
  • 10.###.17.119:23
  • 10.###.232.16:23
  • 10.###.49.142:23
  • 10.##3.80.87:23
  • 10.###.80.106:23
  • 10.###.236.186:23
  • 10.###.54.231:23
  • 10.###.112.242:23
  • 10.##5.61.63:23
  • 10.##1.55.62:23
  • 10.###.66.119:23
  • 10.###.144.51:23
  • 10.###.184.121:23
  • 10.###.119.15:23
  • 10.###.247.90:23
  • 10.##0.6.34:23
  • 10.###.237.113:23
  • 10.###.130.64:23
  • 10.###.224.116:23
  • 10.###.192.245:23
  • 10.##1.7.92:23
  • 10.###.114.126:23
  • 10.###.126.208:23
  • 10.###.120.83:23
  • 10.###.13.201:23
  • 10.###.162.162:23
  • 10.###.253.205:23
  • 10.###.231.245:23
  • 10.###.166.56:23
  • 10.###.193.225:23
  • 10.###.241.96:23
  • 10.##7.25.12:23
  • 10.##3.23.21:23
  • 10.###.39.162:23
  • 10.##4.72.25:23
  • 10.###.145.176:23
  • 10.###.215.176:23
  • 10.###.118.36:23
  • 10.###.247.233:23
  • 10.###.152.83:23
  • 10.###.231.110:23
  • 10.###.38.247:23
  • 10.###.240.68:23
  • 10.###.161.244:23
  • 10.##0.2.14:23
  • 10.###.161.132:23
  • 10.###.119.69:23
  • 10.##8.146.6:23
  • 10.###.194.90:23
  • 10.###.178.188:23
  • 10.###.205.245:23
  • 10.###.215.202:23
  • 10.###.45.156:23
  • 10.###.65.155:23
  • 10.###.209.116:23
  • 10.###.93.175:23
  • 10.###.152.173:23
  • 10.###.225.122:23
  • 10.###.129.170:23
  • 10.###.161.101:23
  • 10.###.210.91:23
  • 10.###.151.241:23
  • 10.##6.34.35:23
  • 10.##2.97.61:23
  • 10.###.97.253:23
  • 10.###.114.48:23
  • 10.###.130.85:23
  • 10.###.225.222:23
  • 10.###.48.188:23
  • 10.##2.1.163:23
  • 10.###.174.111:23
  • 10.##0.98.48:23
  • 10.###.77.216:23
  • 10.###.49.168:23
  • 10.###.62.254:23
  • 10.###.215.32:23
  • 10.###.97.102:23
  • 10.###.161.163:23
  • 10.##8.34.75:23
  • 10.###.97.172:23
  • 10.###.114.96:23
  • 10.###.96.228:23
  • 10.###.183.121:23
  • 10.###.248.131:23
  • 10.##5.104.6:23
  • 10.##8.50.51:23
  • 10.##7.67.78:23
  • 10.###.67.117:23
  • 10.##9.45.64:23
  • 10.###.224.70:23
  • 10.##7.97.75:23
  • 10.###.225.27:23
  • 10.###.114.18:23
  • 10.###.227.56:23
  • 10.##4.1.99:23
  • 10.###.80.114:23
  • 10.###.193.16:23
  • 10.###.166.87:23
  • 10.###.241.132:23
  • 10.###.177.82:23
  • 10.###.130.98:23
  • 10.##5.1.75:23
  • 10.###.80.240:23
  • 10.###.209.39:23
  • 10.###.93.173:23
  • 10.###.161.91:23
  • 10.##5.2.144:23
  • 10.###.237.134:23
  • 10.###.61.231:23
  • 10.###.246.149:23
Receives data from the following servers:
  • 45.##.146.93:82
  • 45.##.146.93:81

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number