fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01

Analysis

max time kernel
121s
max time network
83s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
01-07-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

requiremetns.sh
Size

8KB
MD5

881149037815f5f9d7cf7f44ac19ddc5
SHA1

b2a727881e910bdc50069c21e138f6ccd897aa9f
SHA256

fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01
SHA512

f4f7685745415555f60f408b3b2a7b351b9f113f53b1e6ffbc50d416fe068c9747100955e2455e67d7b98dc92fca56bcebcbca59751d7cbce60534b336aacc01
SSDEEP

192:/Fa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:/EHexC+HSAHE3YUN+TC8SbmQUfd

Score

6^/10

Malware Config

Signatures

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/neofetch.dpkg-new	dpkg

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgv
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg

Writes file to tmp directory 34 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.uMPm1Y	apt
File opened for modification	/tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg	touch
File opened for modification	/tmp/apt.conf.z8ZRjV	gpgv
File opened for modification	/tmp/apt.data.2htnb2	gpgv
File opened for modification	/tmp/fileutl.message.n0hQ8J	apt
File opened for modification	/tmp/fileutl.message.txY4WC	apt
File opened for modification	/tmp/fileutl.message.6UTQOs	apt
File opened for modification	/tmp/fileutl.message.Rs7h4l	apt
File opened for modification	/tmp/apt.sig.b4WT2m	gpgv
File opened for modification	/tmp/fileutl.message.cyflHG	apt
File opened for modification	/tmp/apt-key-gpghome.Ho948fRyGE/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.yrbIyu	apt
File opened for modification	/tmp/fileutl.message.1uxGr7	apt
File opened for modification	/tmp/apt-key-gpghome.iwDmRyjxAP/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.XzeQiNkCui/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.L2ln3d	apt
File opened for modification	/tmp/fileutl.message.Ue6PUg	apt
File opened for modification	/tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.2LUg0n	apt
File opened for modification	/tmp/apt.data.Vfu3Hs	gpgv
File opened for modification	/tmp/fileutl.message.xbAVb8	apt
File opened for modification	/tmp/apt.conf.ycgJmN	gpgv
File opened for modification	/tmp/apt.sig.ARttLp	gpgv
File opened for modification	/tmp/fileutl.message.wyX6fe	apt
File opened for modification	/tmp/apt.conf.Z9rjPg	gpgv
File opened for modification	/tmp/apt-key-gpghome.iwDmRyjxAP/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.CrMEFb	apt
File opened for modification	/tmp/fileutl.message.KsZmYc	apt
File opened for modification	/tmp/apt-key-gpghome.Ho948fRyGE/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.hkaxxB	apt
File opened for modification	/tmp/fileutl.message.NKu09r	apt
File opened for modification	/tmp/fileutl.message.A3A8Ci	apt
File opened for modification	/tmp/apt-key-gpghome.Ho948fRyGE/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.Ho948fRyGE/pubring.gpg	apt-key

/tmp/requiremetns.sh
/tmp/requiremetns.sh
1⤵
PID:705
- /usr/bin/apt
  apt update
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:708
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:717
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:724
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:727
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:731
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:735
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:738
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:740
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.b4WT2m /tmp/apt.data.Vfu3Hs
      4⤵
      Writes file to tmp directory
      PID:742
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:744
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:745
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:746
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:747
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:748
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:749
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:750
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:751
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:752
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:753
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        Reads runtime system information
        
        PID:754
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:755
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:757
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:758
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:759
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.iwDmRyjxAP
        5⤵
        
        PID:760
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.iwDmRyjxAP
        5⤵
        
        PID:761
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg
        5⤵
        
        PID:763
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:764
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        Reads runtime system information
        
        PID:765
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:768
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:769
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:770
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:773
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:775
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:777
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:780
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:783
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:785
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:787
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:789
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:791
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:794
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg /tmp/apt-key-gpghome.iwDmRyjxAP/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:796
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:799
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:802
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.iwDmRyjxAP --keyring /tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.b4WT2m /tmp/apt.data.Vfu3Hs
        5⤵
        
        PID:804
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:806
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:808
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.iwDmRyjxAP
        5⤵
        
        PID:810
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      Writes file to tmp directory
      PID:812
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:815
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:817
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:819
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:821
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:823
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:825
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:827
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:829
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:831
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:833
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:835
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:837
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:840
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:843
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:845
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.Ho948fRyGE
        5⤵
        
        PID:846
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.Ho948fRyGE
        5⤵
        
        PID:847
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.Ho948fRyGE/pubring.gpg
        5⤵
        
        PID:848
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.Ho948fRyGE/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:850
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        Reads runtime system information
        
        PID:851
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:853
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:855
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        Reads runtime system information
        
        PID:857
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:860
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:862
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:865
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:868
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:870
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:872
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:875
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:878
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:880
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:882
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.Ho948fRyGE/pubring.gpg /tmp/apt-key-gpghome.Ho948fRyGE/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:883
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:887
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:891
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.Ho948fRyGE --keyring /tmp/apt-key-gpghome.Ho948fRyGE/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Reads runtime system information
        
        PID:894
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:897
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:899
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.Ho948fRyGE
        5⤵
        
        PID:901
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.ARttLp /tmp/apt.data.2htnb2
      4⤵
      Writes file to tmp directory
      PID:904
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:907
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:909
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:911
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:912
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:914
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:915
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:916
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:917
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:919
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:920
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:921
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.XzeQiNkCui
        5⤵
        
        PID:922
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:926
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:929
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.XzeQiNkCui --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.ARttLp /tmp/apt.data.2htnb2
        5⤵
        Reads runtime system information
        
        PID:931
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:932
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        
        PID:933
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.XzeQiNkCui
        5⤵
        
        PID:934
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:938
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:969
- /usr/bin/apt
  apt install curl nano sudo neofetch -y
  2⤵
  - Deletes log files
  - Reads runtime system information
  - Writes file to tmp directory
  PID:970
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:971
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:972
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:973
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:974
- - /bin/sh
    /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
    3⤵
    PID:975
  - - /usr/sbin/dpkg-preconfigure
      /usr/sbin/dpkg-preconfigure --apt
      4⤵
      PID:976
    - - /usr/local/sbin/locale
        
        locale charmap
        5⤵
        
        PID:979
    - - /usr/local/bin/locale
        
        locale charmap
        5⤵
        
        PID:979
    - - /usr/sbin/locale
        
        locale charmap
        5⤵
        
        PID:979
    - - /usr/bin/locale
        
        locale charmap
        5⤵
        
        PID:979
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:980
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:981
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:982
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:983
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:984
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:985
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:986
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:987
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:988
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:989
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:990
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:991
- - /usr/bin/dpkg
    /usr/bin/dpkg --assert-multi-arch
    3⤵
    - Reads runtime system information
    PID:992
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 14 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:993
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:994
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:994
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:994
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:994
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/neofetch_2.0.2-1_all.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:995
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/neofetch_2.0.2-1_all.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:995
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/neofetch_2.0.2-1_all.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:995
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /var/cache/apt/archives/neofetch_2.0.2-1_all.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:995
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:998
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:998
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:998
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:998
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:998
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        Reads runtime system information
        
        PID:998
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:999
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:999
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:999
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /var/cache/apt/archives/neofetch_2.0.2-1_all.deb
      4⤵
      PID:999
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1002
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1002
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1002
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1002
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1002
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1002
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 14 --configure --pending
    3⤵
    - Reads runtime system information
    PID:1003
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1004
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1005
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1006
- /usr/bin/cut
  cut -f1 -d.
  2⤵
  PID:1009

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Indicator Removal

T1070

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/apt-key-gpghome.Ho948fRyGE/gpg.1.sh

Filesize
82B

MD5
3cb8fc44dd6d4ce5fa25ccbf89360f52

SHA1
370af57420f92dccf655cb566fb0b104cd94158e

SHA256
dbcfe3f82014d1b424b3976b1218634dc8e352a1c540695c24f103bb4d26b2ea

SHA512
3a045da4540aeab3e1cff27902aad649fff1d07fc933fc3cee01db581fa60b61a4d73f110584fa31649efee1708f460780638634163ea0f8b184ca6e90946876

Download Submit
/tmp/apt-key-gpghome.XzeQiNkCui/gpg.1.sh

Filesize
71B

MD5
4a502d34c9274bf20ac5781ec24f97d5

SHA1
524c16347caa1e4e4c89fe3a397248a4059be41c

SHA256
11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d

SHA512
93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf

Download Submit
/tmp/apt-key-gpghome.iwDmRyjxAP/gpg.1.sh

Filesize
82B

MD5
c211a8603b206d4bf2cc2d069d57c033

SHA1
68496032645f730523f95fe6a1d22a6ad5c0dcd5

SHA256
2356727f16d78bf1f71e77352166a676eb086e253d1e663b7de7aaf1768aa24a

SHA512
d1eeab5d161cf89fa34ce358f725e63793a411efddfb60b2e6e050d9c6687c3ebde3a1b62a6e95fbcc9f81c8c14749695e14a11437d33512c226a8fcff532a05

Download Submit
/tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg

Filesize
15KB

MD5
2713b38b3d7345961d8b80f4463483b8

SHA1
e6ec76aaebfea6a82f7984b57e07522a20365201

SHA256
389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248

SHA512
ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978

Download Submit
/tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg

Filesize
18KB

MD5
760d3ab91f417958475b9a6342a5b92e

SHA1
137a06aea4b5c9e9ca11f0f5f1225da1c275c334

SHA256
42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f

SHA512
6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6

Download Submit
/tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg

Filesize
23KB

MD5
d63fbab9dfb826d53f7b3aaea45dbfb5

SHA1
59841d8e5423f788292af76d4350a948f4e25f53

SHA256
de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca

SHA512
20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198

Download Submit
/tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg

Filesize
47KB

MD5
a4dc094481f22304cab5550218e6e4de

SHA1
f5886a324c0c026d0168656f23d1d898a0e43bd6

SHA256
eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391

SHA512
0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68

Download Submit
/tmp/apt-key-gpghome.iwDmRyjxAP/pubring.gpg

Filesize
7KB

MD5
b53e6ca4ed295fc38621315853f623d0

SHA1
45a416f014809735ec88854a3540c8e9e89eb102

SHA256
6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93

SHA512
30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac

Download Submit
/tmp/apt.conf.Z9rjPg

Filesize
7KB

MD5
40a9dddd59f6d08c39373b54ca62d98e

SHA1
802f6fecfc1c5165104f9c2d83268db781a70085

SHA256
113e0e95b0c4ac707b0b4fe05a6b54c4d4e2c4bb3b0798a103865342fa2d622d

SHA512
d5993e2066d49461beb3168b639b153c2d4a64ba6772d8660c076108c7476bf643666ee8fcfa116a019e3402dc7ec03f7db908c5c587231a1d686c2f48273335

Download Submit
/tmp/apt.data.Vfu3Hs

Filesize
56KB

MD5
fd96c8ce5d0ef18d63bbe9ae17bb2659

SHA1
76b284743d95d3546df9d85c09712c830a30f614

SHA256
ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3

SHA512
2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2

Download Submit
/tmp/apt.sig.b4WT2m

Filesize
1KB

MD5
70274ce622b0cc437ef7f0caddc9d232

SHA1
124513a3ad2eb5aafa9be0920681e3bb8625979b

SHA256
4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230

SHA512
fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8

Download Submit
/var/cache/apt/archives/partial/neofetch_2.0.2-1_all.deb

Filesize
53KB

MD5
b6ae659705ea04c7658465725729fac7

SHA1
5b5787cf97df6caceee74ac7e1b488391c43a8b8

SHA256
e6df78c74d5c5e0b13ebbe3bc89837e329c2fff69cc72a0be877aa573485be40

SHA512
dcab812c39cceb917b36d5ff8725f86ff3340583a6278e56753562dede2bde3672b207abebdafb5524808d22b58a4951b4ccb339b195d21b8601042697ee4f7e

Download Submit
/var/lib/dpkg/status-new

Filesize
403KB

MD5
ca301ac5cf09102dce77b50fe7bf33dc

SHA1
9fd5b07d17236c824653727d7b2dc49684943bd0

SHA256
b7f4a2e4c3b123529a32ba71064c494b735a90a181221b42785a9a74eb1922bc

SHA512
abca4bcbfa67a033b2ae246b03af9055686b9cc42eb55e96f6d277bfe56d0de1da8de73508fc995210627e14b15bd04324c5c70e3749fd21e224283be87750fc

Download Submit
/var/lib/dpkg/status-new

Filesize
403KB

MD5
2db352d363815aca65619048ce3d0d63

SHA1
d16a2c3453f4efb85b8fc193f383ee3896e25dda

SHA256
04fd17aa59f6ea5356b7f005d9fed847ae153abc55712e6b6b7aa11ab516fe83

SHA512
a68643d9ca6148fed91bddd83e3522d358ae9f4e0975f127df29f93a7c64cc29488f9a839502fd6a59097951870a4896d28475c71b06a52c2f1d2c1a0d8c94c1

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
525B

MD5
2afd76557921301f9fbe8dc2fbb36f4e

SHA1
d0de51e1817308ce7f7d4701a6f56276cce0927e

SHA256
44e52e238fba01b55b7e26ca6f5fa7d8c9735cfe02a4c402105b8a4f619874f3

SHA512
d74157fe1f72643c294426a9b7ab87b0533c8c2850597259cbe9df4bbabb48090635be1765b1103099fb24d3bb282c2ddeb16cd95766dd6565c19fcda1e29e2c

Download Submit
/var/lib/dpkg/tmp.ci/md5sums

Filesize
7KB

MD5
8dbda34131633339bff850f3017f2b14

SHA1
035946c50b93220caadd25c7af4f67404cf0ccbb

SHA256
488f45fbf631807387e65ab23a2f5e5ac75db56f6f98c2a9e186f76d69d46bab

SHA512
da7daf14a86a530c3bd974fe2caa9c4ec7e9635c1619e5cb32cce0f9547f8f0e23365ef92701bb987efc45885c500e525afb7172461a13321908670a9c9c4840

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
66145a1acd231df0129752e4e9208b61

SHA1
c9b9004d4e68c8e58fe26ffe4ff5a785a4a4aed9

SHA256
572c29735302eb84c7b38a70fb25aff67dd8caf7deb5fccacd16c098cfcb7aae

SHA512
afea8512416d39473dafcf4315ea455fe38337e7c1e76f217e40b0fcd61e224272346c5bb19417a67a919c15daa2efe0d9d197391447b804384ba9d4443f37ee

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
a66bcc7232020b52796a39f77bfa416a

SHA1
b4777a8bcdbfadd81a53e216192be5e3b42ed40f

SHA256
ec4cf243e31eae38e0481b59c7378cd74780711ac0f59d1b2638a0dcfcee8829

SHA512
52dc73bfad97c17937dac312e7f08cd9c5132c29e5662152046badaeb327bb534e317655a4ecda358a069ca084b5481152871c95e6e7378386ba5967eb2d6ee2

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
305012dda10b4f0c21f82830fd16e2e2

SHA1
effb53245d5062431139793d9b0911b59060c23f

SHA256
7f7d40326717f89d2aba893fd5a28a93fea85d474071c438ed1c06428b6153b4

SHA512
8cb818578d35137b9b1aed1a0a7f16992846484a78c60a63c3d026d31fe215a9b2a41e3b77b1d2c663c22b0665bc7c038d9da936761f88d4cad5c5d37d40ffc2

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
edae9b7299f2afc09258160786a4dada

SHA1
dd7aa0c8aa29e937efd88b9eb39811e1460b62b9

SHA256
cf7d2275d2effcc231f426e078582b9665c4a2407e267c9e25546220308dd569

SHA512
0e3341d862dde54e87b2cea0384cc79a4594f7a22a322d501fbb386559511cc8e6046bf134bc1496d04bddb80c8213dd0438368d3a5d20b82099a5a4c9cc30ff

Download Submit
/var/log/apt/eipp.log.xz

Filesize
18KB

MD5
343e26f05a08cffebd2fa423ab6be0fe

SHA1
5c72d9b01a41da8845337b813e2f61454c814458

SHA256
4dfd65ee8ce7da3a19e32e63e4769ec3247aa2674d648a9409e224d1f2ac8792

SHA512
a0b1f71e0a0d3be652f18885cc02ec1cbd5cc6f54a25e22a54e8908189858df5c72132780b871323200225a86cc806e9d4ab5e58f68a1aa11be963586dc0dbbb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads