Linux.Siggen.7810

Техническая информация

Вредоносные функции:

Управляет службами:

['systemctl', 'daemon-reload']
['systemctl', 'enable', 'supdate.service']
['systemctl', 'start', 'supdate.service']

Запускает процессы:

touch /tmp/installed
chmod 700 /tmp/apt-key-gpghome.YNFsKhbSJv
cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
cp -a /tmp/apt-key-gpghome.YNFsKhbSJv/pubring.gpg /tmp/apt-key-gpghome.YNFsKhbSJv/pubring.orig.gpg
apt update
/usr/bin/dpkg --print-foreign-architectures
whoami
/usr/lib/apt/methods/http
find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 ( -name *.gpg -o -name *.asc )
cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
gpg-connect-agent --no-autostart --dirmngr KILLDIRMNGR
ls /tmp/installed
apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
gpgconf --kill all
mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
/bin/sh -c yum update -y && yum install epel-release -y && yum install screen hping3 -y
cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
rm -rf /tmp/apt-key-gpghome.YNFsKhbSJv
/bin/sh /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.vTjy1Q /tmp/apt.data.e2rdpO
ps aux
cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
/usr/lib/apt/methods/https
gpgv --homedir /tmp/apt-key-gpghome.YNFsKhbSJv --keyring /tmp/apt-key-gpghome.YNFsKhbSJv/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.3Apwlp /tmp/apt.data.ecmRro
/usr/lib/apt/methods/gpgv
sort
sed -e s#\x27#\x27\x22\x27\x22\x27#g
rm -f /tmp/apt-key-gpghome.YNFsKhbSJv/pubring.gpg
/usr/lib/apt/methods/store
/bin/sh -c apt update && apt install screen hping3 -y
crontab -l
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
apt-config shell GPGV Apt::Key::gpgvcommand
readlink -f /etc/apt/trusted.gpg.d/
apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
gpg-connect-agent -s --no-autostart GETINFO scd_running /if ${! $?} scd killscd /end
/bin/sh -c ls /tmp/installed
/bin/sh -c touch /tmp/installed
readlink -f /tmp/apt-key-gpghome.YNFsKhbSJv
cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
gpg-connect-agent --no-autostart KILLAGENT
/bin/sh /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.3Apwlp /tmp/apt.data.ecmRro
touch /tmp/apt-key-gpghome.YNFsKhbSJv/pubring.gpg

Завершает следующие процессы:

http
gpgv
store

Выполняет операции с файловой системой:

Модифицирует права доступа к файлам:

/var/lib/apt/lists/partial
/var/lib/apt/lists/auxfiles
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_InRelease
/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye_InRelease
/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye-updates_InRelease
/var/lib/apt/lists/partial/download.docker.com_linux_debian_dists_bullseye_InRelease
/tmp/apt-key-gpghome.YNFsKhbSJv
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources.KTMSsB
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages.1FebqB
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en.OI6Dwz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en

Модифицирует владельца файлов:

/var/lib/apt/lists/partial
/var/lib/apt/lists/auxfiles
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_InRelease
/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye_InRelease
/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye-updates_InRelease
/var/lib/apt/lists/partial/download.docker.com_linux_debian_dists_bullseye_InRelease
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en

Создает папки:

/tmp/apt-key-gpghome.YNFsKhbSJv

Удаляет папки:

/tmp/apt-key-gpghome.YNFsKhbSJv

Создает или модифицирует файлы:

/tmp/installed
/tmp/#130836 (deleted)
/root/.bashrc
/etc/systemd/system/supdate.service
/var/lib/apt/lists/lock
/var/lib/apt/lists/partial/.apt-acquire-privs-test.nmoYCy
/var/lib/apt/lists/partial/.apt-acquire-privs-test.4bwlkC
/var/lib/apt/lists/partial/.apt-acquire-privs-test.fkYgsB
/var/lib/apt/lists/partial/.apt-acquire-privs-test.2Tbxqy
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_InRelease
/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye_InRelease
/var/lib/apt/lists/partial/download.docker.com_linux_debian_dists_bullseye_InRelease
/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye-updates_InRelease
/tmp/apt.conf.1MSaTo
/tmp/apt.sig.3Apwlp
/tmp/apt.data.ecmRro
/tmp/apt-key-gpghome.YNFsKhbSJv/pubring.gpg
/tmp/apt-key-gpghome.YNFsKhbSJv/pubring.orig.gpg
/tmp/apt-key-gpghome.YNFsKhbSJv/gpg.1.sh
/tmp/#130829 (deleted)
/tmp/apt.conf.azsCuO
/tmp/apt.sig.vTjy1Q
/tmp/apt.data.e2rdpO
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources.KTMSsB
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages.1FebqB
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en.OI6Dwz

Удаляет файлы:

/var/lib/apt/lists/partial/.apt-acquire-privs-test.nmoYCy
/var/lib/apt/lists/partial/.apt-acquire-privs-test.4bwlkC
/var/lib/apt/lists/partial/.apt-acquire-privs-test.fkYgsB
/var/lib/apt/lists/partial/.apt-acquire-privs-test.2Tbxqy
/tmp/apt-key-gpghome.YNFsKhbSJv/pubring.orig.gpg
/tmp/apt-key-gpghome.YNFsKhbSJv/pubring.gpg
/tmp/apt-key-gpghome.YNFsKhbSJv/gpg.1.sh
/tmp/apt.conf.1MSaTo
/tmp/apt.sig.3Apwlp
/tmp/apt.data.ecmRro

Изменяет время создания/доступа/модификации файлов:

/tmp/installed
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_InRelease
/var/lib/apt/lists/partial/download.docker.com_linux_debian_dists_bullseye_InRelease
/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye_InRelease
/var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye-updates_InRelease
/tmp/apt-key-gpghome.YNFsKhbSJv/pubring.gpg
/tmp/apt-key-gpghome.YNFsKhbSJv/pubring.orig.gpg
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_source_Sources
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en.xz
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages
/var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en

Сетевая активность:

Устанавливает соединение:

8.#.8.8:53
10#.#0.3.235:9
17#.#7.19.24:9
10#.#0.4.235:9
[2######00:10::6814:4eb]:9
[2######00:10::ac43:1318]:9
[2######00:10::6814:3eb]:9
10#.##.3.235:443
[2#######0:10::6814:4eb]:443
[2#######0:10::ac43:1318]:443
[2#######0:10::6814:3eb]:443
18#.##4.99.34:4444
[2#####e42:3a::644]:80
(e##val)
15#.##1.246.132:80
[2##########78f:3c00:3:db06:4200:93a1]:443
[2##########78f:a400:3:db06:4200:93a1]:443
[2##########78f:da00:3:db06:4200:93a1]:443
[2##########78f:6000:3:db06:4200:93a1]:443
[2##########78f:f800:3:db06:4200:93a1]:443
[2##########78f:4a00:3:db06:4200:93a1]:443
[2##########78f:3e00:3:db06:4200:93a1]:443
[2##########78f:9800:3:db06:4200:93a1]:443
3.###.206.102:443
3.###.206.5:443
3.###.206.39:443
3.###.206.93:443

DNS ASK:

_h###.###p.security.debian.org
_h####.##cp.download.docker.com
_h###.##cp.deb.debian.org
de####.#ap.fastlydns.net
do####ad.docker.com

Посылает данные следующим серверам:

8.#.8.8:53
10#.##.3.235:443
18#.##4.99.34:4444
15#.##1.246.132:80
3.###.206.102:443

Получает данные от следующих серверов:

8.#.8.8:53
10#.##.3.235:443
18#.##4.99.34:4444
3.###.206.102:443
15#.##1.246.132:80

Прочее:

Собирает информацию об ОС

Собирает информацию о CPU

Собирает информацию об оперативной памяти

Собирает информацию о сетевой активности

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению