Technical Information
Malicious functions:
Gains root privileges
Launches itself as a daemon
Launches processes:
- /usr/bin/Mail x -s x -c
- /usr/sbin/sendmail send-mail -i -- x
- /usr/sbin/exim4 #-E
- /usr/sbin/exim4 -Mc 1eSmuH-0000BR-E7
Performs operations with the file system:
Modifies file access rights:
- /var/spool/exim4/input/1eSmuH-0000BR-E7-D
- /var/spool/exim4/input/hdr.709
- /var/spool/exim4/msglog/1eSmuH-0000BR-E7
- /var/spool/exim4/input/1eSmuH-0000BR-E7-J
- /var/mail/user
Creates symlinks:
- /var/mail/user.lock"
Creates or modifies files:
- /tmp/mail.RsXXXXTMqUMw
- /tmp/mail.RsXXXX0SYYI9
- /tmp/mail.RsXXXX0SYYI9 (deleted)
- /var/spool/exim4/input//1eSmuH-0000BR-E7-D
- /var/spool/exim4/input/1eSmuH-0000BR-E7-D
- /var/spool/exim4/input//hdr.709
- /var/spool/exim4/input/hdr.709
- /var/spool/exim4/msglog//1eSmuH-0000BR-E7
- /var/spool/exim4/msglog/1eSmuH-0000BR-E7
- /var/log/exim4/mainlog
- /root/dead.letter
- /var/spool/exim4/db/retry.lockfile
- /var/spool/exim4/input//1eSmuH-0000BR-E7-J
- /var/mail/user.lock.box-amd64.5a3e87e2.000002c9
- /var/mail/user
- /var/spool/exim4/input/1eSmuH-0000BR-E7-J
Deletes files:
- /tmp/mail.RsXXXXTMqUMw"
- /tmp/mail.RsXXXX0SYYI9"
- /var/mail/user.lock.box-amd64.5a3e87e2.000002c9"
- /var/mail/user.lock"
- /var/spool/exim4/msglog//1eSmuH-0000BR-E7"
- /var/spool/exim4/input//1eSmuH-0000BR-E7-D"
- /var/spool/exim4/input//1eSmuH-0000BR-E7-H"
- /var/spool/exim4/input//1eSmuH-0000BR-E7-J"
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
DNS ASK:
- bo##amd64
Other:
Collects CPU information