Linux.Siggen.7762

Linux.Siggen.7762

Added to the Dr.Web virus database: 2024-07-08

Virus description added: 2024-07-08

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Gets access to SSH keys

Substitutes application name for:

Replaces the following system files:

Manages services:

Launches processes:

chattr -ia /root/.ssh/authorized_keys
grep :65533
touch -t 201605070000 /usr/bin/kill
netstat -anp | grep :10771 | awk \x27{print $7}\x27 | awk -F\x27[/]\x27 \x27{print $1}\x27 | grep -v \x22-\x22 | xargs -I % kill -9 %
touch -t 201903060000 /usr/bin/chmod
systemctl daemon-reload;systemctl enable CLAMAV
touch -t 201507020000 /usr/bin/cd
netstat -anp | grep :25000 | awk \x27{print $7}\x27 | awk -F\x27[/]\x27 \x27{print $1}\x27 | grep -v \x22-\x22 | xargs -I % kill -9 %
netstat -anp | grep :65533 | awk \x27{print $7}\x27 | awk -F\x27[/]\x27 \x27{print $1}\x27 | grep -v \x22-\x22 | xargs -I % kill -9 %
grep :10771
touch -t 201808020000 /usr/bin/rm
grep -v -
touch -t 201807090000 /usr/bin/ls
xargs -I % kill -9 %
touch -t 201905090000 /usr/bin/chattr
grep :10991
grep :25000
/usr/bin/mawk awk {print $7}
touch -t 201706090000 /usr/bin/find
grep :6001
chattr -ia /root/.ssh
/usr/bin/mawk awk -F[/ {print $1}
netstat -anp | grep :6001 | awk \x27{print $7}\x27 | awk -F\x27[/]\x27 \x27{print $1}\x27 | grep -v \x22-\x22 | xargs -I % kill -9 %
netstat -anp | grep :10991 | awk \x27{print $7}\x27 | awk -F\x27[/]\x27 \x27{print $1}\x27 | grep -v \x22-\x22 | xargs -I % kill -9 %
hash -r

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates or modifies files:

Mounts file systems:

Changes time of creation/access/modification of files:

Network activity:

Awaits incoming connections on ports:

Establishes connection:

DNS ASK: