マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Linux.Siggen.6868

Added to the Dr.Web virus database: 2024-03-23

Virus description added:

Technical Information

To ensure autorun and distribution:
Creates or modifies the following files:
  • /etc/init.d/knlib
  • /var/spool/cron/crontabs/root
  • /etc/cron.d/.lib-knlib4
  • /etc/cron.hourly/.lib-knlib4
  • /etc/cron.daily/.lib-knlib4
  • /etc/cron.weekly/.lib-knlib4
  • /etc/cron.monthly/.lib-knlib4
Malicious functions:
Manages services:
  • ['systemctl', 'daemon-reload']
  • ['systemctl', 'enable', 'knlibe.service']
Launches processes:
  • chattr -ia /etc/cron.daily/apt-compat
  • hostname -I
  • ps -A -ostat,ppid 2>/dev/null | awk \x27/[zZ]/ && !a[$2]++ {print $2}\x27 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done;if `id -u 2>/dev/null` -eq \x270\x27 ; then ps x 2>/dev/null | grep /etc/cron 2>/dev/null | grep -v grep 2>/dev/null | while read procid; do kill -9 $procid 2>/dev/null; done fi
  • <0xa4>
  • /usr/bin/mawk awk {print $1}
  • chattr -ia /etc/cron.daily/man-db
  • nohup /tmp/bin.64 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn &
  • whoami
  • grep Port
  • hostname
  • chattr -ia /var/spool/cron/crontabs
  • bash -c echo \x22* * * * * /home/.klibsystem5 >/dev/null 2>&1\x22 | crontab -
  • grep -m 1 model name /proc/cpuinfo
  • chattr +ia /etc/systemd/system/knlibe.service
  • bash -c crontab -l
  • /usr/bin/mawk awk {print \x22-\x22$2}
  • bash -c rm -rf /etc/sysctl.conf ; echo fs.file-max = 2097152 > /etc/sysctl.conf ; sysctl -p ; ulimit -Hn ; ulimit -n 99999 -u 999999
  • cp -f -r -- /bin/knlib /bin/klibsystem4
  • crontab -l
  • chattr -ia /etc/cron.daily/dpkg
  • chattr -ia /etc/cron.daily/.placeholder
  • crontab -r
  • /tmp/bin.64 -c -p 80 -p 8080 -p 443 -tls -dp 80 -dp 8080 -dp 443 -tls -d -pwn &
  • sed -e s/^ *//
  • chattr -ia /etc/cron.weekly/man-db
  • chattr -ia /etc/cron.d/e2scrub_all
  • rm -rf -- klibsystem4
  • chattr -ia /etc/cron.d/.placeholder
  • /usr/bin/mawk awk /[zZ]/ && !a[$2]++ {print $2}
  • grep -c ^processor /proc/cpuinfo
  • rm -rf /etc/sysctl.conf
  • chattr +ia /etc/init.d/knlib
  • bash -c crontab -r
  • /bin/bash /etc/init.d/knlib start
  • chattr -ia /etc/cron.daily/logrotate
  • crontab -
  • cat /etc/ssh/sshd_config
  • head -n 1
  • sysctl -p
  • cut -d: -f2
  • nohup ./klibsystem4
  • sed -e s/$//
  • chattr -ia /etc/cron.monthly/.placeholder
  • chattr +ia /bin/knlib
  • chattr -ia /etc/cron.weekly/.placeholder
  • ps -A -ostat,ppid
  • chattr -ia /etc/cron.hourly/.placeholder
Performs operations with the file system:
Modifies file access rights:
  • /etc/init.d/knlib
  • /usr/bin/knlib
  • /var/spool/cron/crontabs/tmp.hK6W6M
  • /etc/cron.d/.lib-knlib4
  • /var/spool/cron/.lib-knlib4
  • /etc/cron.hourly/.lib-knlib4
  • /etc/cron.daily/.lib-knlib4
  • /etc/cron.weekly/.lib-knlib4
  • /etc/cron.monthly/.lib-knlib4
  • /etc/anacrontab
Modifies file owner:
  • /var/spool/cron/crontabs
Creates folders:
  • /var/spool/cron/crontabs
Deletes folders:
  • /var/spool/cron/crontabs
Creates or modifies files:
  • /etc/sysctl.conf
  • /proc/sys/fs/file-max
  • /tmp/.knipsystem4.lock
  • /etc/systemd/system/knlibe.service
  • /usr/bin/knlib
  • /home/.klibsystem5
  • /var/spool/cron/crontabs/tmp.hK6W6M
  • /var/spool/cron/.lib-knlib4
  • /etc/anacrontab
  • /tmp/bi.64
  • /tmp/bin.64
Deletes files:
  • /etc/sysctl.conf
  • /etc/cron.d/.placeholder
  • /etc/cron.d/e2scrub_all
  • /var/spool/cron/crontabs
  • /etc/cron.hourly/.placeholder
  • /etc/cron.daily/.placeholder
  • /etc/cron.daily/apt-compat
  • /etc/cron.daily/dpkg
  • /etc/cron.daily/logrotate
  • /etc/cron.daily/man-db
  • /etc/cron.weekly/.placeholder
  • /etc/cron.weekly/man-db
  • /etc/cron.monthly/.placeholder
Locks files:
  • /tmp/.knipsystem4.lock
Changes time of creation/access/modification of files:
  • /var/spool/cron/crontabs
Network activity:
Establishes connection:
  • 8.#.8.8:53
  • 5.##.80.215:80
DNS ASK:
  • ru#.#ck-dns.ws
Sends data to the following servers:
  • 5.##.80.215:80
Receives data from the following servers:
  • 5.##.80.215:80
Other:
Collects OS information
Collects CPU information
Collects RAM information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number