Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Linux.Siggen.6658

Added to the Dr.Web virus database: 2024-03-03

Virus description added:

Technical Information

Malicious functions:
Launches processes:
  • cut -d = -f 2
  • cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
  • sed s/\x22//g
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
  • cat /etc/os-release
  • gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --quiet --check-trustdb --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
  • apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
  • readlink -f /etc/apt/trusted.gpg.d/
  • cp -a /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
  • cut -d . -f1
  • apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
  • <SAMPLE_FULL_PATH> -c exec \x27<SAMPLE_FULL_PATH>\x27 \x22$@\x22 <SAMPLE_FULL_PATH>
  • id -u
  • /usr/bin/mawk awk {print tolower($0)}
  • sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg --quiet --batch --import -
  • cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
  • cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
  • grep -e ^ID=
  • sudo apt-key add -
  • sed -e s#\x27#\x27\x22\x27\x22\x27#g
  • readlink -f /tmp/apt-key-gpghome.M3u1Rwsa8J
  • /usr/bin/dpkg --print-foreign-architectures
  • chmod 700 /tmp/apt-key-gpghome.M3u1Rwsa8J
  • sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.1.sh --quiet --batch --import -
  • sh /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh --batch --import
  • apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
  • cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
  • sort
  • <0x9c>
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
  • apt-config shell GPG_EXE Apt::Key::gpgcommand
  • cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
  • touch /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
  • gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --no-auto-check-trustdb --trust-model always --batch --import
  • cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
  • grep -e ^VERSION_ID
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
  • wget -qO - https://pkg.licensehosts.com/deb1/debian/11/public-key.file
  • touch /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
  • find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 ( -name *.gpg -o -name *.asc )
  • apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
  • cmp --silent --bytes=1 - /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
  • apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
  • gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.M3u1Rwsa8J --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg --quiet --batch --import -
  • mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
  • rm -f /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
  • cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
  • /bin/sh /usr/bin/apt-key add -
  • apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
  • cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
  • cat /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
  • apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
Performs operations with the file system:
Modifies file access rights:
  • /tmp/apt-key-gpghome.M3u1Rwsa8J
Creates folders:
  • /tmp/apt-key-gpghome.M3u1Rwsa8J
Creates symlinks:
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799x
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg.lock
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799x
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg.lock
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808x
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx.lock
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808x
Creates or modifies files:
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.0.sh
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/gpgoutput.log
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/gpg.1.sh
Deletes files:
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799x
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799x
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg.lock
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/trustdb.gpg.lock
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d334d0.debian.799
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x000055bc84d312c0.debian.799
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808x
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.kbx.lock
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6220.debian.808
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808x
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/.#lk0x00005613d7bf6390.debian.808
Changes time of creation/access/modification of files:
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/empty.gpg
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.gpg
  • /tmp/apt-key-gpghome.M3u1Rwsa8J/pubring.orig.gpg
Network activity:
Establishes connection:
  • 8.#.8.8:53
DNS ASK:
  • pk#.###ensehosts.com

Curing recommendations


Linux

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

One month (no registration) or three months (registration and renewal discount)

Download Dr.Web

Download by serial number