Technical Information
Malicious functions:
Launches itself as a daemon
Launches processes:
- /usr/bin/dpkg --assert-protected-field
- dpkg-deb --control /var/cache/apt/archives/msr-tools_1.3-3+b1_amd64.deb /var/lib/dpkg/tmp.ci
- /usr/bin/perl -w /usr/sbin/dpkg-preconfigure --apt
- dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/msr-tools_1.3-3+b1_amd64.deb
- tar -x -f - --warning=no-timestamp
- perl -e {40707764203d2067657470776e616d28226d616e22293b202429203d202428203d20247077645b335d3b20243e203d20243c203d20247077645b325d3b0a0920202020206578656320222f7573722f62696e2f6d616e6462222c204041524756} -- -pq
- /bin/sh -c /usr/sbin/dpkg-preconfigure --apt || true
- whiptail --version >/dev/null 2>&1
- apt-extracttemplates /var/cache/apt/archives/msr-tools_1.3-3+b1_amd64.deb
- rm -rf -- /var/lib/dpkg/tmp.ci
- /usr/bin/dpkg --status-fd 20 --no-triggers --unpack --auto-deconfigure --force-remove-protected /var/cache/apt/archives/msr-tools_1.3-3+b1_amd64.deb
- whiptail --version
- /bin/sh /var/lib/dpkg/info/man-db.postinst triggered /usr/share/man
- /usr/bin/dpkg --assert-multi-arch
- stty -a 2>/dev/null
- /usr/bin/mandb -pq
- /usr/bin/python3.9 /usr/bin/python3 /usr/bin/apt-listchanges --apt
- /usr/bin/dpkg --status-fd 20 --configure --pending
- dpkg-deb --fsys-tarfile /var/cache/apt/archives/msr-tools_1.3-3+b1_amd64.deb
- /bin/sh -c /usr/bin/apt-listchanges --apt || test $? -lt 10
- apt --reinstall install msr-tools
- /usr/lib/apt/methods/http
- /usr/bin/dpkg --print-foreign-architectures
- locale charmap
- stty -a
Kills the following processes:
- http
Performs operations with the file system:
Modifies file access rights:
- /var/cache/apt/archives/partial
- /var/lib/apt/lists/auxfiles
- /var/cache/apt/archives/partial/msr-tools_1.3-3+b1_amd64.deb
- /var/lib/apt/extended_states.nCTabV
- /var/lib/apt/extended_states
- /var/log/apt/term.log
- /var/log/apt/history.log
- /var/lib/dpkg/tmp.ci/control
- /var/lib/dpkg/tmp.ci/md5sums
- /usr/sbin/rdmsr.dpkg-new
- /usr/sbin/wrmsr.dpkg-new
- /usr/share/doc/msr-tools.dpkg-new
- /usr/share/doc/msr-tools/changelog.Debian.amd64.gz.dpkg-new
- /usr/share/doc/msr-tools/changelog.Debian.gz.dpkg-new
- /usr/share/doc/msr-tools/copyright.dpkg-new
- /usr/share/man/man1/rdmsr.1.gz.dpkg-new
- /usr/share/man/man1/wrmsr.1.gz.dpkg-new
- /var/lib/dpkg/info/msr-tools.list-new
- /var/lib/dpkg/status-new
- /var/cache/man/CACHEDIR.TAG
- /var/cache/man/751
Modifies file owner:
- /var/cache/apt/archives/partial
- /var/lib/apt/lists/auxfiles
- /var/cache/apt/archives/partial/msr-tools_1.3-3+b1_amd64.deb
- /var/log/apt/term.log
- /var/lib/dpkg/tmp.ci/control
- /var/lib/dpkg/tmp.ci/md5sums
- /var/lib/dpkg/tmp.ci
- /usr/sbin/rdmsr.dpkg-new
- /usr/sbin/wrmsr.dpkg-new
- /usr/share/doc/msr-tools.dpkg-new
- /usr/share/doc/msr-tools/changelog.Debian.amd64.gz.dpkg-new
- /usr/share/doc/msr-tools/changelog.Debian.gz.dpkg-new
- /usr/share/doc/msr-tools/copyright.dpkg-new
- /usr/share/man/man1/rdmsr.1.gz.dpkg-new
- /usr/share/man/man1/wrmsr.1.gz.dpkg-new
Creates folders:
- /var/lib/dpkg/tmp.ci
- /usr/share/doc/msr-tools.dpkg-new
Deletes folders:
- /var/lib/dpkg/tmp.ci/md5sums
- /var/lib/dpkg/tmp.ci/control
- /var/lib/dpkg/tmp.ci
Creates symlinks:
- /var/lib/dpkg/status-old
Creates or modifies files:
- /tmp/#130836 (deleted)
- /tmp/#130829 (deleted)
- /var/lib/dpkg/lock-frontend
- /var/lib/dpkg/lock
- /var/cache/apt/archives/lock
- /var/cache/apt/archives/partial/.apt-acquire-privs-test.XrRgnU
- /var/cache/apt/archives/partial/msr-tools_1.3-3+b1_amd64.deb
- /var/log/apt/eipp.log.xz
- /var/lib/apt/extended_states.nCTabV
- /var/log/apt/term.log
- /var/log/apt/history.log
- /var/lib/dpkg/updates/tmp.i
- /var/lib/dpkg/triggers/Lock
- /var/log/dpkg.log
- /var/lib/dpkg/tmp.ci/control
- /var/lib/dpkg/tmp.ci/md5sums
- /dev/pts/1
- /usr/sbin/rdmsr.dpkg-new
- /usr/sbin/wrmsr.dpkg-new
- /usr/share/doc/msr-tools.dpkg-new
- /usr/share/doc/msr-tools/changelog.Debian.amd64.gz.dpkg-new
- /usr/share/doc/msr-tools/changelog.Debian.gz.dpkg-new
- /usr/share/doc/msr-tools/copyright.dpkg-new
- /usr/share/man/man1/rdmsr.1.gz.dpkg-new
- /usr/share/man/man1/wrmsr.1.gz.dpkg-new
- /var/lib/dpkg/info/msr-tools.list-new
- /var/lib/dpkg/status-new
- /var/cache/man/751
Deletes files:
- /var/cache/apt/archives/partial/.apt-acquire-privs-test.XrRgnU
- /var/log/apt/eipp.log.xz
- /var/lib/dpkg/tmp.ci/control
- /var/lib/dpkg/status-old
- /var/lib/dpkg/updates/0000
- /var/lib/dpkg/updates/0001
- /var/lib/dpkg/updates/0002
- /var/lib/dpkg/updates/0003
- /var/lib/dpkg/updates/tmp.i
Locks files:
- /var/cache/debconf/config.dat
- /var/cache/debconf/passwords.dat
- /var/cache/debconf/templates.dat
- /var/cache/man/751
Changes time of creation/access/modification of files:
- /var/cache/apt/archives/partial/msr-tools_1.3-3+b1_amd64.deb
- /var/lib/dpkg/tmp.ci/control
- /var/lib/dpkg/tmp.ci/md5sums
- /var/lib/dpkg/tmp.ci
- /usr/sbin/rdmsr.dpkg-new
- /usr/sbin/wrmsr.dpkg-new
- /usr/share/doc/msr-tools.dpkg-new
- /usr/share/doc/msr-tools/changelog.Debian.amd64.gz.dpkg-new
- /usr/share/doc/msr-tools/changelog.Debian.gz.dpkg-new
- /usr/share/doc/msr-tools/copyright.dpkg-new
- /usr/share/man/man1/rdmsr.1.gz.dpkg-new
- /usr/share/man/man1/wrmsr.1.gz.dpkg-new
- /var/cache/man/751
Network activity:
Establishes connection:
- 8.#.8.8:53
- [2#####e42:3a::644]:80
- (e##val)
- 15#.##1.246.132:80
DNS ASK:
- _h###.##cp.deb.debian.org
- de####.#ap.fastlydns.net
Sends data to the following servers:
- 15#.##1.246.132:80
Receives data from the following servers:
- 15#.##1.246.132:80
Other:
Collects CPU information
Collects information about network activity
