Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/crontab
Malicious functions:
Launches processes:
- whoami
- apt-get install update-notifier -y
- /usr/lib/apt/methods/http
- /usr/bin/dpkg --print-foreign-architectures
- ps ax
- apt-get update
Kills the following processes:
- http
Performs operations with the file system:
Modifies file access rights:
- /var/lib/apt/lists/partial
- /var/lib/apt/lists/auxfiles
- /var/cache/apt/srcpkgcache.bin.lR3Qiy
- /var/cache/apt/pkgcache.bin.mEWL3u
Modifies file owner:
- /var/lib/apt/lists/partial
- /var/lib/apt/lists/auxfiles
Creates or modifies files:
- /tmp/#130830 (deleted)
- /var/lib/apt/lists/lock
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.u0Zs6v
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.mNzCbw
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.jsxpax
- /var/cache/apt/srcpkgcache.bin.lR3Qiy
- /var/cache/apt/pkgcache.bin.mEWL3u
Deletes files:
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.u0Zs6v
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.mNzCbw
- /var/lib/apt/lists/partial/.apt-acquire-privs-test.jsxpax
- /var/cache/apt/pkgcache.bin
- /var/cache/apt/srcpkgcache.bin
Network activity:
Establishes connection:
- <LOCAL_DNS_SERVER>
DNS ASK:
- _h###.###p.security.debian.org
- _h###.##cp.deb.debian.org
- se####ty.debian.org
- de#.#ebian.org
Other:
Collects OS information
Collects CPU information
Collects RAM information