Техническая информация
Вредоносные функции:
Запускает процессы:
- cut -d = -f 2
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
- sed s/\x22//g
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
- cat /etc/os-release
- gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --quiet --check-trustdb --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
- apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
- readlink -f /etc/apt/trusted.gpg.d/
- cp -a /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
- cut -d . -f1
- apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
- <SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
- id -u
- /usr/bin/mawk awk {print tolower($0)}
- sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg --quiet --batch --import -
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
- grep -e ^ID=
- sudo apt-key add -
- sed -e s#\x27#\x27\x22\x27\x22\x27#g
- readlink -f /tmp/apt-key-gpghome.M3u1Rwsa8J
- /usr/bin/dpkg --print-foreign-architectures
- chmod 700 /tmp/apt-key-gpghome.M3u1Rwsa8J
- sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.1.sh --quiet --batch --import -
- sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh --batch --import
- apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
- sort
- <0x9c>
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
- apt-config shell GPG_EXE Apt::Key::gpgcommand
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
- touch /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
- gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --no-auto-check-trustdb --trust-model always --batch --import
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
- grep -e ^VERSION_ID
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
- wget -qO - https://pkg.licensehosts.com/deb1/debian/11/public-key.file
- touch /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
- find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 ( -name *.gpg -o -name *.asc )
- apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
- apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
- gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg --quiet --batch --import -
- mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
- rm -f /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
- /bin/sh /usr/bin/apt-key add -
- apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
- apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
Выполняет операции с файловой системой:
Модифицирует права доступа к файлам:
- /tmp/apt-key-gpghome.M3u1Rwsa8J
Создает папки:
- /tmp/apt-key-gpghome.M3u1Rwsa8J
Создает символические ссылки (симлинки):
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799x
- /tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg.lock
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799x
- /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg.lock
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808x
- /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx.lock
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808x
Создает или модифицирует файлы:
- /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh
- /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
- /tmp/apt-key-gpghome.M3u1Rwsa8J/gpgoutput.log
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799
- /tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808
- /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808
- /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
- /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
- /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.1.sh
Удаляет файлы:
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799x
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799x
- /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg.lock
- /tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg.lock
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808x
- /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx.lock
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808x
- /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808
Изменяет время создания/доступа/модификации файлов:
- /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
- /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
- /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
Сетевая активность:
Устанавливает соединение:
- 8.#.8.8:53
DNS ASK:
- pk#.###ensehosts.com
