JavaScript support is required for our site to be fully operational in your browser.
Linux.Siggen.6658
Added to the Dr.Web virus database:
2024-03-03
Virus description added:
2024-03-03
Technical Information
Malicious functions:
Launches processes:
cut -d = -f 2
cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
sed s/\x22//g
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
cat /etc/os-release
gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --quiet --check-trustdb --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
readlink -f /etc/apt/trusted.gpg.d/
cp -a /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
cut -d . -f1
apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
<SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
id -u
/usr/bin/mawk awk {print tolower($0)}
sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg --quiet --batch --import -
cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
grep -e ^ID=
sudo apt-key add -
sed -e s#\x27#\x27\x22\x27\x22\x27#g
readlink -f /tmp/apt-key-gpghome.M3u1Rwsa8J
/usr/bin/dpkg --print-foreign-architectures
chmod 700 /tmp/apt-key-gpghome.M3u1Rwsa8J
sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.1.sh --quiet --batch --import -
sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh --batch --import
apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
sort
<0x9c>
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
apt-config shell GPG_EXE Apt::Key::gpgcommand
cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
touch /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --no-auto-check-trustdb --trust-model always --batch --import
cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
grep -e ^VERSION_ID
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
wget -qO - https://pkg.licensehosts.com/deb1/debian/11/public-key.file
touch /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 ( -name *.gpg -o -name *.asc )
apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg --quiet --batch --import -
mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
rm -f /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
/bin/sh /usr/bin/apt-key add -
apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
Performs operations with the file system:
Modifies file access rights:
/tmp/apt-key-gpghome.M3u1Rwsa8J
Creates folders:
/tmp/apt-key-gpghome.M3u1Rwsa8J
Creates symlinks:
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799x
/tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg.lock
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799x
/tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg.lock
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808x
/tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx.lock
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808x
Creates or modifies files:
/tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh
/tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
/tmp/apt-key-gpghome.M3u1Rwsa8J/gpgoutput.log
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799
/tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808
/tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808
/tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
/tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
/tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.1.sh
Deletes files:
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799x
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799x
/tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg.lock
/tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg.lock
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808x
/tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx.lock
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808x
/tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808
Changes time of creation/access/modification of files:
/tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
/tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
/tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
Network activity:
Establishes connection:
DNS ASK:
Curing recommendations
Linux
Free trial
One month (no registration) or three months (registration and renewal discount)
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK