Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.6657

Added to the Dr.Web virus database: 2024-03-03

Virus description added:

Technical Information

Malicious functions:
Launches processes:
  • cut -d = -f 2
  • cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
  • gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.U2Vt7NgewM --no-auto-check-trustdb --trust-model always --batch --import
  • sed s/\x22//g
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
  • cat /etc/os-release
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
  • apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
  • readlink -f /etc/apt/trusted.gpg.d/
  • cut -d . -f1
  • apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
  • id -u
  • /usr/bin/mawk awk {print tolower($0)}
  • cp -a /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.orig.gpg
  • cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
  • cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
  • touch /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg
  • sh /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.0.sh --batch --import
  • grep -e ^ID=
  • <0x77>
  • sudo apt-key add -
  • sed -e s#\x27#\x27\x22\x27\x22\x27#g
  • /usr/bin/dpkg --print-foreign-architectures
  • rm -f /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg
  • touch /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg
  • apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
  • cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
  • sort
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
  • apt-config shell GPG_EXE Apt::Key::gpgcommand
  • cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
  • cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
  • chmod 700 /tmp/apt-key-gpghome.U2Vt7NgewM
  • grep -e ^VERSION_ID
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
  • wget -qO - https://pkg.licensehosts.com/deb1/debian/11/public-key.file
  • find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 ( -name *.gpg -o -name *.asc )
  • <SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
  • apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
  • gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.U2Vt7NgewM --quiet --check-trustdb --keyring /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
  • gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.U2Vt7NgewM --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg --quiet --batch --import -
  • readlink -f /tmp/apt-key-gpghome.U2Vt7NgewM
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
  • sh /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.1.sh --quiet --batch --import -
  • apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
  • mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
  • cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
  • /bin/sh /usr/bin/apt-key add -
  • apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
  • cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
  • cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
  • apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
  • sh /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.0.sh --keyring /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg --quiet --batch --import -
Performs operations with the file system:
Modifies file access rights:
  • /tmp/apt-key-gpghome.U2Vt7NgewM
Creates folders:
  • /tmp/apt-key-gpghome.U2Vt7NgewM
Creates symlinks:
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787022c0.debian.771x
  • /tmp/apt-key-gpghome.U2Vt7NgewM/trustdb.gpg.lock
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787044d0.debian.771x
  • /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg.lock
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287220.debian.776x
  • /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.kbx.lock
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287390.debian.776x
Creates or modifies files:
  • /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.0.sh
  • /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg
  • /tmp/apt-key-gpghome.U2Vt7NgewM/gpgoutput.log
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787022c0.debian.771
  • /tmp/apt-key-gpghome.U2Vt7NgewM/trustdb.gpg
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787044d0.debian.771
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287220.debian.776
  • /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.kbx
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287390.debian.776
  • /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg
  • /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.orig.gpg
  • /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.1.sh
Deletes files:
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787022c0.debian.771x
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787044d0.debian.771x
  • /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg.lock
  • /tmp/apt-key-gpghome.U2Vt7NgewM/trustdb.gpg.lock
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787044d0.debian.771
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787022c0.debian.771
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287220.debian.776x
  • /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.kbx.lock
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287220.debian.776
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287390.debian.776x
  • /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287390.debian.776
Changes time of creation/access/modification of files:
  • /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg
  • /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg
  • /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.orig.gpg
Network activity:
Establishes connection:
  • 8.#.8.8:53
DNS ASK:
  • pk#.###ensehosts.com

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number