fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01

Analysis

max time kernel
88s
max time network
71s
platform
debian-9_mips
resource
debian9-mipsbe-20240418-en
resource tags

arch:mipsimage:debian9-mipsbe-20240418-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
01-07-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

requiremetns.sh
Size

8KB
MD5

881149037815f5f9d7cf7f44ac19ddc5
SHA1

b2a727881e910bdc50069c21e138f6ccd897aa9f
SHA256

fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01
SHA512

f4f7685745415555f60f408b3b2a7b351b9f113f53b1e6ffbc50d416fe068c9747100955e2455e67d7b98dc92fca56bcebcbca59751d7cbce60534b336aacc01
SSDEEP

192:/Fa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:/EHexC+HSAHE3YUN+TC8SbmQUfd

Score

6^/10

Malware Config

Signatures

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/neofetch.dpkg-new	dpkg

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/self/fd	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf

Writes file to tmp directory 34 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/apt.conf.Tlwahw	gpgv
File opened for modification	/tmp/apt-key-gpghome.LUsqateA7j/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.sig.sx2TdR	gpgv
File opened for modification	/tmp/fileutl.message.mAFUol	apt
File opened for modification	/tmp/fileutl.message.EBWxkN	apt
File opened for modification	/tmp/fileutl.message.d7tPIV	apt
File opened for modification	/tmp/apt-key-gpghome.LUsqateA7j/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.w6eHDA	apt
File opened for modification	/tmp/apt.sig.e8mFwZ	gpgv
File opened for modification	/tmp/fileutl.message.AI2bS6	apt
File opened for modification	/tmp/fileutl.message.ygKEqi	apt
File opened for modification	/tmp/fileutl.message.LP3Vfy	apt
File opened for modification	/tmp/fileutl.message.FVKiJA	apt
File opened for modification	/tmp/fileutl.message.tBEABQ	apt
File opened for modification	/tmp/fileutl.message.lU3SuF	apt
File opened for modification	/tmp/fileutl.message.oWbuS1	apt
File opened for modification	/tmp/apt.data.YKrZTV	gpgv
File opened for modification	/tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.phlzhIvJ5W/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.phlzhIvJ5W/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.conf.IUzdwu	gpgv
File opened for modification	/tmp/fileutl.message.ayMr5I	apt
File opened for modification	/tmp/fileutl.message.ju2mOw	apt
File opened for modification	/tmp/apt.data.EWedSd	gpgv
File opened for modification	/tmp/apt-key-gpghome.Pe0k5MlVXI/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.JWge0I	apt
File opened for modification	/tmp/apt-key-gpghome.LUsqateA7j/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg	touch
File opened for modification	/tmp/fileutl.message.sebSNh	apt
File opened for modification	/tmp/apt-key-gpghome.LUsqateA7j/pubring.gpg	touch
File opened for modification	/tmp/fileutl.message.82h6zU	apt
File opened for modification	/tmp/apt.conf.8VJxh3	gpgv
File opened for modification	/tmp/fileutl.message.0VCWlC	apt
File opened for modification	/tmp/fileutl.message.FGbLSn	apt

/tmp/requiremetns.sh
/tmp/requiremetns.sh
1⤵
PID:704
- /usr/bin/apt
  apt update
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:710
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:715
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:723
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:726
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    - Reads runtime system information
    PID:730
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:734
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:737
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:738
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.e8mFwZ /tmp/apt.data.YKrZTV
      4⤵
      Writes file to tmp directory
      PID:740
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:743
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:744
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:745
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:746
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:747
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:748
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:749
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:750
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:751
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:752
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        Reads runtime system information
        
        PID:753
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:754
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:758
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:760
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:762
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.phlzhIvJ5W
        5⤵
        
        PID:763
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.phlzhIvJ5W
        5⤵
        
        PID:764
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg
        5⤵
        
        PID:765
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:767
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        Reads runtime system information
        
        PID:768
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:770
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:772
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        Reads runtime system information
        
        PID:774
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:777
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:780
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:783
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:785
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:787
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:789
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:792
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:795
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:797
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:799
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg /tmp/apt-key-gpghome.phlzhIvJ5W/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:800
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:804
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:808
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.phlzhIvJ5W --keyring /tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.e8mFwZ /tmp/apt.data.YKrZTV
        5⤵
        Reads runtime system information
        
        PID:809
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:812
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:813
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.phlzhIvJ5W
        5⤵
        
        PID:815
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      Writes file to tmp directory
      PID:818
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:821
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:822
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:823
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:825
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:827
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:829
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:831
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:834
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:836
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:838
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        Reads runtime system information
        
        PID:840
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:842
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:846
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:848
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:851
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.LUsqateA7j
        5⤵
        
        PID:853
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.LUsqateA7j
        5⤵
        
        PID:855
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.LUsqateA7j/pubring.gpg
        5⤵
        
        PID:856
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.LUsqateA7j/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:858
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:859
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:862
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:864
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        Reads runtime system information
        
        PID:865
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:869
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:872
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:875
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:877
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:879
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:881
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:884
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:886
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:888
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:890
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.LUsqateA7j/pubring.gpg /tmp/apt-key-gpghome.LUsqateA7j/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:891
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:894
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:898
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.LUsqateA7j --keyring /tmp/apt-key-gpghome.LUsqateA7j/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Reads runtime system information
        
        PID:899
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:900
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:901
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.LUsqateA7j
        5⤵
        
        PID:902
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.sx2TdR /tmp/apt.data.EWedSd
      4⤵
      Writes file to tmp directory
      PID:904
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:906
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:907
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:908
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:909
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:910
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:911
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:912
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:913
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:915
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:916
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:917
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.Pe0k5MlVXI
        5⤵
        
        PID:918
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:922
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:925
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.Pe0k5MlVXI --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.sx2TdR /tmp/apt.data.EWedSd
        5⤵
        Reads runtime system information
        
        PID:927
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:931
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:932
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.Pe0k5MlVXI
        5⤵
        
        PID:934
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:936
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:968
- /usr/bin/apt
  apt install curl nano sudo neofetch -y
  2⤵
  - Deletes log files
  - Writes file to tmp directory
  PID:969
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:970
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:971
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:972
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:973
- - /bin/sh
    /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
    3⤵
    PID:974
  - - /usr/sbin/dpkg-preconfigure
      /usr/sbin/dpkg-preconfigure --apt
      4⤵
      PID:975
    - - /usr/local/sbin/locale
        
        locale charmap
        5⤵
        
        PID:976
    - - /usr/local/bin/locale
        
        locale charmap
        5⤵
        
        PID:976
    - - /usr/sbin/locale
        
        locale charmap
        5⤵
        
        PID:976
    - - /usr/bin/locale
        
        locale charmap
        5⤵
        
        PID:976
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:977
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:978
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:979
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:980
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:981
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:982
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:983
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:984
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:985
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:986
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:987
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:988
- - /usr/bin/dpkg
    /usr/bin/dpkg --assert-multi-arch
    3⤵
    PID:989
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 14 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:990
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:991
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:991
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:991
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:991
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/neofetch_2.0.2-1_all.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:992
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/neofetch_2.0.2-1_all.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:992
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/neofetch_2.0.2-1_all.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:992
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/neofetch_2.0.2-1_all.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:992
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:995
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:995
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:995
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:995
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:995
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        Reads runtime system information
        
        PID:995
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:996
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:996
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:996
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:996
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:999
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:999
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:999
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:999
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:999
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:999
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 14 --configure --pending
    3⤵
    - Reads runtime system information
    PID:1000
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1001
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1002
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1003
- /usr/bin/cut
  cut -f1 -d.
  2⤵
  PID:1006

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Indicator Removal

T1070

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/apt-key-gpghome.LUsqateA7j/gpg.1.sh

Filesize
82B

MD5
da37a445b1d23cda582de8d39e5f35f1

SHA1
977db9a11679f0350439b23f3b9b7a4662977a41

SHA256
85c5421da3a7cf8c9f9067ad9bd5ca8b9496ae1433f1460f458ea7b74a40fdda

SHA512
c75b0311dc5e23882514af8b0832717d93fe972eaa7ff0c9ba378e8e7012ae56dd07649bc38a48766b94fb5560c41c5ea58dcc09e94754f39382e5724045d7bb

Download Submit
/tmp/apt-key-gpghome.Pe0k5MlVXI/gpg.1.sh

Filesize
71B

MD5
4a502d34c9274bf20ac5781ec24f97d5

SHA1
524c16347caa1e4e4c89fe3a397248a4059be41c

SHA256
11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d

SHA512
93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf

Download Submit
/tmp/apt-key-gpghome.phlzhIvJ5W/gpg.1.sh

Filesize
82B

MD5
f86aec59a6f42c677b6c416b393eaee6

SHA1
0046a47b95dbd9d2fe9a725b18ea51a9c80ae3e8

SHA256
ec53274d94591f9dadd47a556d64c472fe444b96cb061d774f0e92e848362068

SHA512
e15bea1f6b62a660fade7098d46529aceb7eb82189e728bbcc1ce5ed01209eb961cc76727e81d5ff0a447b6414a75e9babb29826eae1079cd0c4e1b514b0c827

Download Submit
/tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg

Filesize
15KB

MD5
2713b38b3d7345961d8b80f4463483b8

SHA1
e6ec76aaebfea6a82f7984b57e07522a20365201

SHA256
389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248

SHA512
ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978

Download Submit
/tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg

Filesize
18KB

MD5
760d3ab91f417958475b9a6342a5b92e

SHA1
137a06aea4b5c9e9ca11f0f5f1225da1c275c334

SHA256
42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f

SHA512
6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6

Download Submit
/tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg

Filesize
23KB

MD5
d63fbab9dfb826d53f7b3aaea45dbfb5

SHA1
59841d8e5423f788292af76d4350a948f4e25f53

SHA256
de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca

SHA512
20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198

Download Submit
/tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg

Filesize
47KB

MD5
a4dc094481f22304cab5550218e6e4de

SHA1
f5886a324c0c026d0168656f23d1d898a0e43bd6

SHA256
eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391

SHA512
0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68

Download Submit
/tmp/apt-key-gpghome.phlzhIvJ5W/pubring.gpg

Filesize
7KB

MD5
b53e6ca4ed295fc38621315853f623d0

SHA1
45a416f014809735ec88854a3540c8e9e89eb102

SHA256
6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93

SHA512
30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac

Download Submit
/tmp/apt.conf.8VJxh3

Filesize
7KB

MD5
3208d06221fa539c66ee1c7eab9ffe5d

SHA1
4dd2c78f109dbcf1ef9520ccaa64ac36dc6e9976

SHA256
50c4b994b3277bcefe6f4a83c785b6c33c48d402557da0321614b9d858c5837c

SHA512
d1e239fa6266928a0c0728a2632f7fa4a490740c2839f9aeafc23c5b742a02237197c98fab21d53f161d35027fb5c9fcc3b02ead6d1578d6df15352321cd40ce

Download Submit
/tmp/apt.data.YKrZTV

Filesize
56KB

MD5
fd96c8ce5d0ef18d63bbe9ae17bb2659

SHA1
76b284743d95d3546df9d85c09712c830a30f614

SHA256
ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3

SHA512
2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2

Download Submit
/tmp/apt.sig.e8mFwZ

Filesize
1KB

MD5
70274ce622b0cc437ef7f0caddc9d232

SHA1
124513a3ad2eb5aafa9be0920681e3bb8625979b

SHA256
4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230

SHA512
fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8

Download Submit
/var/cache/apt/archives/partial/neofetch_2.0.2-1_all.deb

Filesize
53KB

MD5
b6ae659705ea04c7658465725729fac7

SHA1
5b5787cf97df6caceee74ac7e1b488391c43a8b8

SHA256
e6df78c74d5c5e0b13ebbe3bc89837e329c2fff69cc72a0be877aa573485be40

SHA512
dcab812c39cceb917b36d5ff8725f86ff3340583a6278e56753562dede2bde3672b207abebdafb5524808d22b58a4951b4ccb339b195d21b8601042697ee4f7e

Download Submit
/var/lib/dpkg/status-new

Filesize
402KB

MD5
0b4a01f303222f2d1ae55df736bf3427

SHA1
eea28fdf7eafa196c1987113a1b4e3df2ee1ca12

SHA256
d240b21b73033de1c2261c44dc8e93176d7480c6398443f372c33c45b0786122

SHA512
e3e5064ab9182269155d8569beb20e7a0f8be63f6658d8170a3faf9fb125ab702bf63fc7fe017a538935109f5e04201b954a896a0924c2d94eb8692437527e2c

Download Submit
/var/lib/dpkg/status-new

Filesize
402KB

MD5
e36a59a7e4951543e7ed4c5943e18e23

SHA1
e5d8a04f67b0015d035b0f0bc7eda4d7cf9359a4

SHA256
04eaaf6ad4416b2c8cf36be8508b342f5ac9f48389b321269169986df38e0f26

SHA512
d311cdf50b6daa6f42181a71ed1434b48d9b0e33b8718bca5ca8a0d7c3d2c73b69f38b6407d29df48e10faa89bea3a355b8b6645e8f05ad88cb812898d2111ae

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
525B

MD5
2afd76557921301f9fbe8dc2fbb36f4e

SHA1
d0de51e1817308ce7f7d4701a6f56276cce0927e

SHA256
44e52e238fba01b55b7e26ca6f5fa7d8c9735cfe02a4c402105b8a4f619874f3

SHA512
d74157fe1f72643c294426a9b7ab87b0533c8c2850597259cbe9df4bbabb48090635be1765b1103099fb24d3bb282c2ddeb16cd95766dd6565c19fcda1e29e2c

Download Submit
/var/lib/dpkg/tmp.ci/md5sums

Filesize
7KB

MD5
8dbda34131633339bff850f3017f2b14

SHA1
035946c50b93220caadd25c7af4f67404cf0ccbb

SHA256
488f45fbf631807387e65ab23a2f5e5ac75db56f6f98c2a9e186f76d69d46bab

SHA512
da7daf14a86a530c3bd974fe2caa9c4ec7e9635c1619e5cb32cce0f9547f8f0e23365ef92701bb987efc45885c500e525afb7172461a13321908670a9c9c4840

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
66145a1acd231df0129752e4e9208b61

SHA1
c9b9004d4e68c8e58fe26ffe4ff5a785a4a4aed9

SHA256
572c29735302eb84c7b38a70fb25aff67dd8caf7deb5fccacd16c098cfcb7aae

SHA512
afea8512416d39473dafcf4315ea455fe38337e7c1e76f217e40b0fcd61e224272346c5bb19417a67a919c15daa2efe0d9d197391447b804384ba9d4443f37ee

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
a66bcc7232020b52796a39f77bfa416a

SHA1
b4777a8bcdbfadd81a53e216192be5e3b42ed40f

SHA256
ec4cf243e31eae38e0481b59c7378cd74780711ac0f59d1b2638a0dcfcee8829

SHA512
52dc73bfad97c17937dac312e7f08cd9c5132c29e5662152046badaeb327bb534e317655a4ecda358a069ca084b5481152871c95e6e7378386ba5967eb2d6ee2

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
305012dda10b4f0c21f82830fd16e2e2

SHA1
effb53245d5062431139793d9b0911b59060c23f

SHA256
7f7d40326717f89d2aba893fd5a28a93fea85d474071c438ed1c06428b6153b4

SHA512
8cb818578d35137b9b1aed1a0a7f16992846484a78c60a63c3d026d31fe215a9b2a41e3b77b1d2c663c22b0665bc7c038d9da936761f88d4cad5c5d37d40ffc2

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
edae9b7299f2afc09258160786a4dada

SHA1
dd7aa0c8aa29e937efd88b9eb39811e1460b62b9

SHA256
cf7d2275d2effcc231f426e078582b9665c4a2407e267c9e25546220308dd569

SHA512
0e3341d862dde54e87b2cea0384cc79a4594f7a22a322d501fbb386559511cc8e6046bf134bc1496d04bddb80c8213dd0438368d3a5d20b82099a5a4c9cc30ff

Download Submit
/var/log/apt/eipp.log.xz

Filesize
18KB

MD5
7100b12c02394a8ed09d02658bd1a543

SHA1
c2c1b60aab2b00ddf0d83baed7e1b0e662f3c116

SHA256
4f410c03908dd93f9a1995cf11fe4a245269bbada02be965101af379131f1715

SHA512
dfb5de81214e5687122ea9a929bdd1c8c1ebfcafbe8ae498452fbbc1c6c37b79a6a49a632c62d845040b43462b865939333e208fa5d20e02fa07900a3f24e1c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads