Linux.Siggen.7830

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

/etc/init.d/dpkg-deb-package

Malicious functions:

Launches processes:

/usr/bin/pgrep pkill -9 -f phpupdate
/usr/bin/pgrep pkill -9 -f /tmp/java
/usr/bin/pgrep pkill -9 -f watchbog
/usr/bin/pgrep pkill -9 -f init\x5c.sh
/usr/bin/pgrep pkill -9 -f \x5c.rsyslogds
cat /dev/null
bash -c ufw disable
/usr/bin/pgrep pkill -9 -f sysDworker
/usr/bin/pgrep pkill -9 -f 118/cf\x5c.sh
/usr/bin/pgrep pkill -9 -f \x5c.inis
/usr/bin/pgrep pkill -9 -f meminitsrv
bash -c iptables -P INPUT ACCEPT
bash -c cat /dev/null > /etc/ld.so.preload
/tmp/662a638f-426a-4249-905c-64b07c396de0 kworker/R-debug
/usr/bin/pgrep pkill -9 -f pnscan
grep -Po \x5cd+
crontab -
/usr/sbin/xtables-nft-multi iptables -F
/usr/bin/pgrep pkill -9 -f stratum
/usr/bin/pgrep pkill -9 -f 8005/cc5
bash -c chattr -ia /etc/ld.so.preload
/usr/bin/pgrep pkill -9 -f \x5c./python
/usr/bin/pgrep pkill -9 -f xmrig
/usr/bin/pgrep pkill -9 -f b64decode
bash -c iptables -P OUTPUT ACCEPT
sed /\x5c.bashgo\x5c|pastebin\x5c|onion\x5c|bprofr\x5c|python\x5c|curl\x5c|wget\x5c|\x5c.sh/d
/usr/sbin/xtables-nft-multi iptables -P FORWARD ACCEPT
/usr/bin/pgrep pkill -9 -f kinsing
xargs -I % kill -9 %
/usr/bin/pgrep pkill -9 -f attack
cat /proc/mounts
/usr/bin/pgrep pkill -9 -f juiceSSH
/usr/bin/pgrep pkill -9 -f gitlabkill
/usr/bin/pgrep pkill -9 -f phpguard
/usr/bin/pgrep pkill -9 -f donate
/usr/bin/pgrep pkill -9 -f sysguard
/usr/bin/pgrep pkill -9 -f bash -s kthreaddk
chattr -ia /etc/ld.so.preload
/usr/bin/pgrep pkill -9 -f kthreaddi
/usr/bin/pgrep pkill -9 -f dovecat
/usr/bin/pgrep pkill -9 -f javae
/usr/bin/pgrep pkill -9 -f monero
/usr/bin/pgrep pkill -9 -f kthreaddkk
/usr/bin/pgrep pkill -9 -f unls64\x5c.sh
/usr/sbin/xtables-nft-multi iptables -P INPUT ACCEPT
/usr/bin/pgrep pkill -9 -f \x5c./httpd
/usr/bin/pgrep pkill -9 -f sysupdate
chattr +ia /etc/init.d/dpkg-deb-package
/usr/bin/pgrep pkill -9 -f so\x5c.txt
ps -eo pid,ppid,comm,%cpu --sort=-%cpu
/usr/bin/pgrep pkill -9 -f \x5c./\x5c.
bash -c iptables -P FORWARD ACCEPT
/usr/bin/pgrep pkill -9 -f solrd
/usr/bin/pgrep pkill -9 -f ksoftriqd
/usr/bin/pgrep pkill -9 -f load\x5c.sh
bash -c iptables -F
/usr/bin/pgrep pkill -9 -f /dev/shm
/usr/bin/pgrep pkill -9 -f confluence/install\x5c.sh
/usr/bin/pgrep pkill -9 -f agettyd
bash -c crontab -l | sed \x27/\x5c.bashgo\x5c|pastebin\x5c|onion\x5c|bprofr\x5c|python\x5c|curl\x5c|wget\x5c|\x5c.sh/d\x27 | crontab -
/usr/bin/pgrep pkill -9 -f \x5c./cliented
/usr/bin/pgrep pkill -9 -f mysqlserver
/usr/bin/pgrep pkill -9 -f loligang
/usr/bin/pgrep pkill -9 -f crond64
/usr/bin/pgrep pkill -9 -f xmr-stak
/usr/bin/pgrep pkill -9 -f bash -s 3673
/usr/bin/pgrep pkill -9 -f \x5c./system-xfwm4-session
/usr/bin/pgrep pkill -9 -f sshexec
/usr/bin/pgrep pkill -9 -f solr\x5c.sh
/usr/bin/pgrep pkill -9 -f kthreaddk
/usr/bin/pgrep pkill -9 -f \x5c./lin64
/usr/bin/pgrep pkill -9 -f scan\x5c.log
/usr/bin/pgrep pkill -9 -f networkmanager
/usr/sbin/xtables-nft-multi iptables -P OUTPUT ACCEPT
/usr/bin/pgrep pkill -9 -f \x5c./crun
/usr/bin/pgrep pkill -9 -f excludefile
/usr/bin/pgrep pkill -9 -f sshpass
/usr/bin/pgrep pkill -9 -f pastebin
/usr/bin/pgrep pkill -9 -f knthread
grep -P /proc/\x5cd+
/usr/bin/pgrep pkill -9 -f /tmp/\x5c.
/usr/bin/pgrep pkill -9 -f networkservice
/usr/bin/pgrep pkill -9 -f zgrab
/usr/bin/pgrep pkill -9 -f masscan
crontab -l
/usr/bin/pgrep pkill -9 -f MCf8
/usr/bin/pgrep pkill -9 -f /tmp/system
/usr/bin/pgrep pkill -9 -f /var/tmp
/usr/bin/pgrep pkill -9 -f \x5c.6379
/usr/bin/pgrep pkill -9 -f polska
/usr/bin/pgrep pkill -9 -f kdevtmpfsi
/usr/bin/pgrep pkill -9 -f kthreaddw
/usr/bin/pgrep pkill -9 -f mysqldd
/usr/bin/mawk awk {print $2}
/usr/bin/pgrep pkill -9 -f certutil
/usr/bin/pgrep pkill -9 -f cnrig
bash -c cat /proc/mounts | awk \x27{print $2}\x27 | grep -P \x27/proc/\x5cd+\x27 | grep -Po \x27\x5cd+\x27 | xargs -I % kill -9 %
bash -c pgrep -f \x27meshagent|kdevchecker|ipv6_addrconfd|kworkerr|cpuhelp|deamon|ksoftriqd|pastebin|solr.sh|solrd|kinsing|kdevtmpfsi|kthreaddk|linuxsys|rnv2ymcl|skid.x86|getpy.sh\x27 | xargs -r kill

Kills the following processes:

ps
bash

Performs operations with the file system:

Modifies file access rights:

/tmp/662a638f-426a-4249-905c-64b07c396de0
/etc/init.d/dpkg-deb-package

Creates or modifies files:

/tmp/662a638f-426a-4249-905c-64b07c396de0
/tmp/7877e997-d4cd-47a5-a6df-4cb00e5599d9
/var/spool/cron/crontabs/tmp.ZOhTBA
/etc/ld.so.preload

Network activity:

Awaits incoming connections on ports:

127.0.0.1:10444

Establishes connection:

127.0.0.1:10444

Other:

Collects OS information

Collects CPU information

Collects RAM information

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement