Technical Information
Malicious functions:
Gains root privileges
Launches itself as a daemon
Launches processes:
- /usr/sbin/exim4 #-E
- /usr/sbin/exim4 -Mc 1eSlSH-0000BT-Oy
Performs operations with the file system:
Modifies file access rights:
- /var/spool/exim4/input/1eSlSH-0000BT-Oy-D
- /var/spool/exim4/input/hdr.711
- /var/spool/exim4/msglog/1eSlSH-0000BT-Oy
- /var/spool/exim4/input/1eSlSH-0000BT-Oy-J
- /var/mail/user
Creates symlinks:
- /var/mail/user.lock"
Creates or modifies files:
- /var/spool/exim4/input//1eSlSH-0000BT-Oy-D
- /var/spool/exim4/input/1eSlSH-0000BT-Oy-D
- /var/spool/exim4/input//hdr.711
- /var/spool/exim4/input/hdr.711
- /var/spool/exim4/msglog//1eSlSH-0000BT-Oy
- /var/spool/exim4/msglog/1eSlSH-0000BT-Oy
- /var/log/exim4/mainlog
- /var/spool/exim4/db/retry.lockfile
- /var/spool/exim4/input//1eSlSH-0000BT-Oy-J
- /var/mail/user.lock.box-amd64.5a3e7216.000002cb
- /var/mail/user
- /var/spool/exim4/input/1eSlSH-0000BT-Oy-J
Deletes files:
- /var/mail/user.lock.box-amd64.5a3e7216.000002cb"
- /var/mail/user.lock"
- /var/spool/exim4/msglog//1eSlSH-0000BT-Oy"
- /var/spool/exim4/input//1eSlSH-0000BT-Oy-D"
- /var/spool/exim4/input//1eSlSH-0000BT-Oy-H"
- /var/spool/exim4/input//1eSlSH-0000BT-Oy-J"
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
DNS ASK:
- bo##amd64
Other:
Collects CPU information