Linux.Siggen.2023

Linux.Siggen.2023

Added to the Dr.Web virus database: 2019-07-23

Virus description added: 2019-07-23

Malicious functions:

Launches itself as a daemon

Substitutes application name for:

Modifies firewall settings:

Launches processes:

sh -c rm -rf /var/spool/cr*/* ; rm -rf /etc/cron.*/* ; crontab -r ; > /dev/null 2>&1
rm -rf /var/spool/cron/atjobs /var/spool/cron/atspool /var/spool/cron/crontabs
sh -c chattr -R -i /tmp/* ; rm -rf /tmp/.* ; rm -rf /tmp/* ; crontab -r ; for i in `atq | awk '{print $1}'`; do atrm $i; done ; rm -rf /dev/shm/* ; rm -rf /dev/shm/* ; rm -rf /var/tmp/* ; rm -rf /var/tmp/.* ; chattr -R -i /var/spool/*/* ; rm -rf /var/spool/*/*/* ; mkdir /tmp ; >/dev/null 2>&1
chattr -R -i /tmp/*
rm -rf /tmp/. /tmp/.. /tmp/.ICE-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
sh -c iptables -F ; iptables-save >/dev/null 2>&1
sh -c /root/wjociy
/root/wjociy
iptables-save
sh -c chattr -R -i /tmp/* ; rm -rf /tmp/.* ; rm -rf /tmp/* ; for i in `atq | awk '{print $1}'`; do atrm $i; done ; rm -rf /dev/shm/* ; rm -rf /dev/shm/* ; rm -rf /var/tmp/* ; rm -rf /var/tmp/.* ; chattr -R -i /var/spool/*/* ; rm -rf /var/spool/*/*/* ; >/dev/null 2>&1
rm -rf /tmp/. /tmp/.. /tmp/.Test-unix /tmp/.X11-unix /tmp/.XIM-unix /tmp/.font-unix
rm -rf /tmp/*
sh -c /root/kkvs kkvs
/root/kkvs kkvs
sh -c /root/wgyxgi wgyx
/root/wgyxgi wgyx

Kills system processes:

Kills the following processes:

Performs operations with the file system:

Modifies file access rights:

Deletes folders:

Creates or modifies files:

Deletes files:

Network activity:

HTTP GET requests: