89679500c0767e7a2c56ac75e5e853e77807660e842f3aae7bc855c30c534aa5

Resubmissions

28/03/2025, 06:27

250328-g7715ssxfz 10

28/03/2025, 06:21

250328-g4j5xasxdx 10

Analysis

max time kernel
120s
max time network
57s
platform
debian-9_mipsel
resource
debian9-mipsel-20240226-en
resource tags

arch:mipselimage:debian9-mipsel-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
28/03/2025, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ubuntu.sh
Size

748B
MD5

229c643e9b0c79281884b70efba08109
SHA1

442e01e0af2650eb9419d443b19ab40779171d74
SHA256

89679500c0767e7a2c56ac75e5e853e77807660e842f3aae7bc855c30c534aa5
SHA512

88742f501ddb450ad04f09b3a16418d9fe9a541792c7bf68f0db63431e2e5d2c2132e45d60f807792625facad074feb351a015f98dc690833aff14eb2e993559

Score

6^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
710	sudo

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/self/fd	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	sudo

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.qjSm2I	apt
File opened for modification	/tmp/apt-key-gpghome.U2PlPXTKa6/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.conf.DsdByu	gpgv
File opened for modification	/tmp/apt-key-gpghome.Cvk0F9VsRy/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.72E1BJ2ZiD/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.HHwGYO	apt
File opened for modification	/tmp/fileutl.message.QiavQu	apt
File opened for modification	/tmp/fileutl.message.tGifrT	apt
File opened for modification	/tmp/apt-key-gpghome.Cvk0F9VsRy/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.yhputZ	apt
File opened for modification	/tmp/apt.sig.oHssfG	gpgv
File opened for modification	/tmp/apt.data.0Lhx7X	gpgv
File opened for modification	/tmp/apt.conf.0BZnTK	gpgv
File opened for modification	/tmp/apt.sig.OkQzxs	gpgv
File opened for modification	/tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.U2PlPXTKa6/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.lcaJCY	apt
File opened for modification	/tmp/apt-key-gpghome.Cvk0F9VsRy/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.Cvk0F9VsRy/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.9Id9QV	apt
File opened for modification	/tmp/fileutl.message.2llyKM	apt
File opened for modification	/tmp/apt.data.6cEzL9	gpgv
File opened for modification	/tmp/apt.conf.kC4lxo	gpgv
File opened for modification	/tmp/fileutl.message.fPCGb4	apt
File opened for modification	/tmp/fileutl.message.3HqbEE	apt

/tmp/ubuntu.sh
/tmp/ubuntu.sh bcdedit /c set shutdown /r readonly /f force /t 2
1⤵
PID:707
- /usr/bin/sudo
  sudo apt update
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:710
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    - Reads runtime system information
    PID:722
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty2GU-0000Be-O3
      4⤵
      Reads CPU attributes
      PID:737
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    - Reads runtime system information
    PID:725
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty2GU-0000Bh-Qb
      4⤵
      Reads CPU attributes
      PID:736
- - /usr/bin/apt
    apt update
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:728
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:734
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:740
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:742
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      Reads runtime system information
      PID:747
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:750
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      PID:752
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:753
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.OkQzxs /tmp/apt.data.6cEzL9
        5⤵
        Writes file to tmp directory
        
        PID:755
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:757
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:758
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:759
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:760
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:761
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:762
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:763
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:764
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:765
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:766
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:767
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:768
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:773
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:774
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:775
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.U2PlPXTKa6
        6⤵
        
        PID:776
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.U2PlPXTKa6
        6⤵
        
        PID:777
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg
        6⤵
        
        PID:778
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:779
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        Reads runtime system information
        
        PID:780
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:781
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:782
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        
        PID:783
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:788
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:790
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:792
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:795
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:797
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:800
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:802
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:804
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:806
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:809
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg /tmp/apt-key-gpghome.U2PlPXTKa6/pubring.orig.gpg
        6⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:810
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:814
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:817
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.U2PlPXTKa6 --keyring /tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.OkQzxs /tmp/apt.data.6cEzL9
        6⤵
        Reads runtime system information
        
        PID:819
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:822
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:823
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.U2PlPXTKa6
        6⤵
        
        PID:825
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Writes file to tmp directory
        
        PID:828
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:831
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:832
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:834
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:836
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        Reads runtime system information
        
        PID:838
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:840
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:842
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:844
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:846
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:848
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:850
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:852
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:855
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:857
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:858
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.Cvk0F9VsRy
        6⤵
        
        PID:860
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.Cvk0F9VsRy
        6⤵
        
        PID:861
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.Cvk0F9VsRy/pubring.gpg
        6⤵
        
        PID:863
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.Cvk0F9VsRy/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:864
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:865
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:867
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:869
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        Reads runtime system information
        
        PID:870
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:874
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:876
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:880
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:883
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:885
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:887
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:889
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:892
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:894
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:897
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.Cvk0F9VsRy/pubring.gpg /tmp/apt-key-gpghome.Cvk0F9VsRy/pubring.orig.gpg
        6⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:899
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:903
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:907
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.Cvk0F9VsRy --keyring /tmp/apt-key-gpghome.Cvk0F9VsRy/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        6⤵
        Reads runtime system information
        
        PID:909
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:912
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Reads runtime system information
        
        PID:913
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.Cvk0F9VsRy
        6⤵
        
        PID:914
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly --keyring /usr/share/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.oHssfG /tmp/apt.data.0Lhx7X
        5⤵
        Writes file to tmp directory
        
        PID:919
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:921
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:923
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:924
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:925
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        Reads runtime system information
        
        PID:926
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:928
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:929
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:930
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:932
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:933
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:934
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.72E1BJ2ZiD
        6⤵
        
        PID:935
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:939
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:942
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.72E1BJ2ZiD --keyring /usr/share/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.oHssfG /tmp/apt.data.0Lhx7X
        6⤵
        Reads runtime system information
        
        PID:944
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:945
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Reads runtime system information
        
        PID:946
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.72E1BJ2ZiD
        6⤵
        
        PID:947
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:948
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:979

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/apt-key-gpghome.72E1BJ2ZiD/gpg.1.sh

Filesize
73B

MD5
b67eec294a99b2826e6380e50400efb9

SHA1
f692aed05a7300e93f312a2efa0da820d13bb78a

SHA256
cc159dd92a3828c99c3884da5eff5f5e44abcbd90d1f2d04dca6f2ae11ae88e2

SHA512
c11ab997476310ebb1b4980cf8ce85a221d995d869e34fda5f1cd08d7892bd582a19caec4ae7d6246dd651df369bbcef3008108bb8d4c0b5d381730795070b4f

Download Submit
/tmp/apt-key-gpghome.Cvk0F9VsRy/gpg.1.sh

Filesize
82B

MD5
5160b41bee923618f288bd303c12abc1

SHA1
04cee66fb42846d3a6edd3fdb0c3866eddb995b8

SHA256
b7200da5d577761618301ebd0368a85712fde88172dbbaf43afe9fe5c714aa48

SHA512
905596de0f1c5a8a51072674a9112f3f8a509509eb66c2408631214cf7ccf45dd02dcb1b625f18d41faefc645c886820156cd397dfd19f44a5cd9ab658d30d25

Download Submit
/tmp/apt-key-gpghome.U2PlPXTKa6/gpg.1.sh

Filesize
82B

MD5
0825b41ccd1292404cc45359e8fff21e

SHA1
4a224f4e3e18f88665d3197a708bbd851026723b

SHA256
2a8d7476551d791a6bbf4c4de7ff81a33cc135c891e6cbbf38149e40f544ba5a

SHA512
817cc19f2434252a2ef385f456b72a3c562bd4230d03b274324f1b694e1e6321e1280648912cc508e54ef290b52abbf40f5693f56f4f048efb90ae62458a2302

Download Submit
/tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg

Filesize
7KB

MD5
b53e6ca4ed295fc38621315853f623d0

SHA1
45a416f014809735ec88854a3540c8e9e89eb102

SHA256
6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93

SHA512
30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac

Download Submit
/tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg

Filesize
15KB

MD5
2713b38b3d7345961d8b80f4463483b8

SHA1
e6ec76aaebfea6a82f7984b57e07522a20365201

SHA256
389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248

SHA512
ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978

Download Submit
/tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg

Filesize
18KB

MD5
760d3ab91f417958475b9a6342a5b92e

SHA1
137a06aea4b5c9e9ca11f0f5f1225da1c275c334

SHA256
42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f

SHA512
6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6

Download Submit
/tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg

Filesize
23KB

MD5
d63fbab9dfb826d53f7b3aaea45dbfb5

SHA1
59841d8e5423f788292af76d4350a948f4e25f53

SHA256
de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca

SHA512
20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198

Download Submit
/tmp/apt-key-gpghome.U2PlPXTKa6/pubring.gpg

Filesize
47KB

MD5
a4dc094481f22304cab5550218e6e4de

SHA1
f5886a324c0c026d0168656f23d1d898a0e43bd6

SHA256
eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391

SHA512
0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68

Download Submit
/tmp/apt.conf.0BZnTK

Filesize
7KB

MD5
40a9dddd59f6d08c39373b54ca62d98e

SHA1
802f6fecfc1c5165104f9c2d83268db781a70085

SHA256
113e0e95b0c4ac707b0b4fe05a6b54c4d4e2c4bb3b0798a103865342fa2d622d

SHA512
d5993e2066d49461beb3168b639b153c2d4a64ba6772d8660c076108c7476bf643666ee8fcfa116a019e3402dc7ec03f7db908c5c587231a1d686c2f48273335

Download Submit
/tmp/apt.data.6cEzL9

Filesize
56KB

MD5
fd96c8ce5d0ef18d63bbe9ae17bb2659

SHA1
76b284743d95d3546df9d85c09712c830a30f614

SHA256
ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3

SHA512
2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2

Download Submit
/tmp/apt.sig.OkQzxs

Filesize
1KB

MD5
70274ce622b0cc437ef7f0caddc9d232

SHA1
124513a3ad2eb5aafa9be0920681e3bb8625979b

SHA256
4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230

SHA512
fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8

Download Submit
/var/mail/user

Filesize
847B

MD5
9d8b1b4041994fed1555c75723878252

SHA1
2059e8aceb91327226043e0d5760306868109c70

SHA256
950e351e8fe8094950e22f4b127c747362e779635cf5b1ffc9e962172db5f6c5

SHA512
ddf5b13f3362098fdeb5722aa5d4a13a7185f9fca4845b3688279e2006431bdbed13da3746ee6de6f4a9416a719fe36611140b2cff366e817106de0599cbd442

Download Submit
/var/mail/user

Filesize
1KB

MD5
fd9ebcf8f990493bf40a04fbcaf4dd79

SHA1
419de2aab9faf7dcae66bb3e0914ea522affb04b

SHA256
52cfe5cf8299b495ce6e0066bf09732fd61697d43196087c3377f0fa4d6100ed

SHA512
e8ae17176b46e819605f30f8f41250cbc1d3e3f2c03c4877f668cd1b877c43880696befb648fb54592fce10ba8aadaf9d294a3e37beb5eaa9d76720506aaa7b7

Download Submit
/var/spool/exim4/input/1ty2GU-0000Be-O3-D

Filesize
130B

MD5
5723b3a9abbde95b0eb95738f0cb4214

SHA1
442f5016d4b831bfda9e4707e2bd18166c04482f

SHA256
49ca733830b7cc525052a23434b52ac90e7b9eb45003b18e1e0a4cce8b7096b7

SHA512
7c12ae00645b660d41668a936efb75804a9f8fa9a88236716f4ab55c5cd6c87dec495ad98e334ec927db19179b4124219aa56fbdb98cdec9d96a4b0d1f37c747

Download Submit
/var/spool/exim4/input/1ty2GU-0000Bh-Qb-D

Filesize
147B

MD5
81af4abdaa4342d941e321570d771b2b

SHA1
427c1c5e91d046bbb03dcc5649f4593ce780dab7

SHA256
8ab90cf0ac8f9b10893b1af96e70921a1c356c8dd0249fd3ca65c4a8c17f96e5

SHA512
3c3940d6b15d4f0bf72034ba6e895a0cf89396ab906271bf7553b7a3d4098cb17cfb43cfc7c694ead3fa6b73e2a460867428a0c24f6c616f8386e44f11d01538

Download Submit
/var/spool/exim4/input/1ty2GU-0000Bh-Qb-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/hdr.722

Filesize
918B

MD5
c7ccc4e0c86d0a99a342058f38799e8f

SHA1
9d8a6234e3caa3b0d66d6b06e6b73592d6704cfd

SHA256
e09b57c4b142faba97535de2e0c1fa43e9c28db4032943840894d793732562c1

SHA512
fba4a8ab472835464d10ce49f6b7f9601a6723c90febc50e712dd0d3af6910de7da7509d731b445eeb2ebf892c3f1dfa42d883cef6dc490b17c2a476195dc165

Download Submit
/var/spool/exim4/msglog/1ty2GU-0000Be-O3

Filesize
288B

MD5
44b64e4e67b57b67645055ea38eff62d

SHA1
8847d2c713f4f823b3777e195bc1e396048053b7

SHA256
8bf788f9eb642d3c7106cfc05876936fffd8259f774286d0783f7eb34473c86e

SHA512
23bfc6a099f96e65ce8547c90a758c6ae25bbd550147e66378d81e4f30f111834d1ccbb2c1e5f48121b2c35a5221845e42f624f384607b339f7798446f81d108

Download Submit
/var/spool/exim4/msglog/1ty2GU-0000Be-O3

Filesize
89B

MD5
2b492107feb4e9a3fdb0ce5d23fe823e

SHA1
5331e7f7f6445f6969c7ef91508f13b06e27e428

SHA256
7c32680213d4df19baec416c4970011fad977cc3b293cebfac55a734acfc77dc

SHA512
db247c5657c2ba02997e7ba5d3a0a952f07df74a1a28f3a382de669939f3b91363b553af8cceed10c38152392a1c44346cc90ec535a0cfd455f90716da7f4d45

Download Submit
/var/spool/exim4/msglog/1ty2GU-0000Bh-Qb

Filesize
288B

MD5
254a3deb67f424e28b81d476a52df85b

SHA1
5af8ada1afcae1d5b839b0472c93cf5c8dbcd60c

SHA256
68c9ab6ecdb4d95b22efc86726dcc0078d702130e85e9c8afa41556ae1985c67

SHA512
2a82b499dc3a973b716acd8f02bf1851e81522716aa399de0c30555e6e825cb72ff2c1881a7f504d888f053914b1751a2bb44d51449cca780640567883ae5b00

Download Submit
/var/spool/exim4/msglog/1ty2GU-0000Bh-Qb

Filesize
89B

MD5
2dcacbabfa79e0b8291a3d601e22f386

SHA1
02f5b44d59d6bd439e33d6c2a655c41bb132af4e

SHA256
50279636a85016956077316de6f0ba6f8df92824f33df0eb670842c818dacff8

SHA512
d18a322bb7d95aadcc2502686616a8d55dde8019d8e0479b36f9fd6c55d71ee93d4b1f139aa359ea2fac0ca80820794a2555b5f242c264384d16f6c40308521d

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads