Technical Information
Malicious functions:
Launches processes:
- cut -d = -f 2
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
- gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.U2Vt7NgewM --no-auto-check-trustdb --trust-model always --batch --import
- sed s/\x22//g
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
- cat /etc/os-release
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
- apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
- readlink -f /etc/apt/trusted.gpg.d/
- cut -d . -f1
- apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
- id -u
- /usr/bin/mawk awk {print tolower($0)}
- cp -a /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.orig.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
- touch /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg
- sh /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.0.sh --batch --import
- grep -e ^ID=
- <0x77>
- sudo apt-key add -
- sed -e s#\x27#\x27\x22\x27\x22\x27#g
- /usr/bin/dpkg --print-foreign-architectures
- rm -f /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg
- touch /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg
- apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
- sort
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
- apt-config shell GPG_EXE Apt::Key::gpgcommand
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
- chmod 700 /tmp/apt-key-gpghome.U2Vt7NgewM
- grep -e ^VERSION_ID
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
- wget -qO - https://pkg.licensehosts.com/deb1/debian/11/public-key.file
- find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 ( -name *.gpg -o -name *.asc )
- <SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
- apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
- gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.U2Vt7NgewM --quiet --check-trustdb --keyring /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
- gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.U2Vt7NgewM --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg --quiet --batch --import -
- readlink -f /tmp/apt-key-gpghome.U2Vt7NgewM
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
- sh /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.1.sh --quiet --batch --import -
- apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
- mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
- /bin/sh /usr/bin/apt-key add -
- apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
- apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
- sh /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.0.sh --keyring /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg --quiet --batch --import -
Performs operations with the file system:
Modifies file access rights:
- /tmp/apt-key-gpghome.U2Vt7NgewM
Creates folders:
- /tmp/apt-key-gpghome.U2Vt7NgewM
Creates symlinks:
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787022c0.debian.771x
- /tmp/apt-key-gpghome.U2Vt7NgewM/trustdb.gpg.lock
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787044d0.debian.771x
- /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg.lock
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287220.debian.776x
- /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.kbx.lock
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287390.debian.776x
Creates or modifies files:
- /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.0.sh
- /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg
- /tmp/apt-key-gpghome.U2Vt7NgewM/gpgoutput.log
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787022c0.debian.771
- /tmp/apt-key-gpghome.U2Vt7NgewM/trustdb.gpg
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787044d0.debian.771
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287220.debian.776
- /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.kbx
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287390.debian.776
- /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg
- /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.orig.gpg
- /tmp/apt-key-gpghome.U2Vt7NgewM/gpg.1.sh
Deletes files:
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787022c0.debian.771x
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787044d0.debian.771x
- /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg.lock
- /tmp/apt-key-gpghome.U2Vt7NgewM/trustdb.gpg.lock
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787044d0.debian.771
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x00005629787022c0.debian.771
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287220.debian.776x
- /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.kbx.lock
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287220.debian.776
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287390.debian.776x
- /tmp/apt-key-gpghome.U2Vt7NgewM/.#lk0x0000562c66287390.debian.776
Changes time of creation/access/modification of files:
- /tmp/apt-key-gpghome.U2Vt7NgewM/empty.gpg
- /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.gpg
- /tmp/apt-key-gpghome.U2Vt7NgewM/pubring.orig.gpg
Network activity:
Establishes connection:
- 8.#.8.8:53
DNS ASK:
- pk#.###ensehosts.com
