Linux.Siggen.3512

Linux.Siggen.3512

Added to the Dr.Web virus database: 2021-01-10

Virus description added: 2021-01-10

To ensure autorun and distribution:

Creates or modifies the following files:

Malicious functions:

Launches processes:

sh -c touch -r /opt/zimbra/jetty/webapps/zimbraAdmin/public/jsp/Zimbra.jsp /opt/zimbra/jetty/webapps/zimbraAdmin/public/jsp/Alert.jsp
touch -r /opt/zimbra/jetty/webapps/zimbraAdmin/public/jsp/Zimbra.jsp /opt/zimbra/jetty/webapps/zimbraAdmin/public/jsp/Alert.jsp
sh -c touch -r /opt/zimbra/jetty/webapps/zimbra/public/jsp/Crypt.jsp /opt/zimbra/jetty/webapps/zimbra/public/jsp/CryptCore.jsp
touch -r /opt/zimbra/jetty/webapps/zimbra/public/jsp/Crypt.jsp /opt/zimbra/jetty/webapps/zimbra/public/jsp/CryptCore.jsp
sh -c (crontab -l|grep -v 'zmstorewatch'|grep -v '/tmp/'|grep -v 'wget'|grep -v 'curl')|crontab -
crontab -
crontab -l
grep -v zmstorewatch
grep -v wget
grep -v /tmp/
grep -v curl
sh -c (crontab -l|grep -v zmlogswatch|grep -v 'DO NOT EDIT ANYTHING';printf \"*/60 * * * * /opt/zimbra/lib/zmlogswatc
grep -v zmlogswatch
grep -v DO NOT EDIT ANYTHING

Performs operations with the file system:

Modifies file access rights:

Creates folders:

Creates or modifies files:

Deletes files: