d12fea4d1339ebecb09d8cc36920d9f5e5e7e9fffbe092b1e1cd09255cc16825

Analysis

max time kernel
82s
max time network
29s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02/06/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
msfinstall
Size 6KB
Sample260602-ajdn3ahv3x
SHA256 d12fea4d1339ebecb09d8cc36920d9f5e5e7e9fffbe092b1e1cd09255cc16825
MD5 4b75407abefa3c9fa96300cec14a9fa5
SHA1 8b7d69c9ca523c214a1fd9f47fe6bb1af5929f6a
SHA512 83b407f1e1eac2afa7831f139f7e8a350cf14ddd3be532ee67f39da431afa2996a80d3c4ea6270ef4719624952e6ef4fa68f8eae1d2ad96c5ffa84e499f0e965
SSDEEP 96:PYkKed3frc2NRXhID11FXvtx5xrTGeZCx7ANRJCdNKI73hK1RbKCS49bQG5SkC5M:PO8rDXhIDLFXvtdL7dCPKOK1RbK49b99
TLSH
T149C11B2F75311C64253942F1A2CA1300BA1294272B54B930A49E857E5FFDAE167FB3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/self/fd	gpgv
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.AhiaYh	apt-get
File opened for modification	/tmp/apt.conf.n4H3EZ	gpgv
File opened for modification	/tmp/apt.conf.lM0OC4	gpgv
File opened for modification	/tmp/apt-key-gpghome.cnyJuGIuxB/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.sig.mQSTvm	gpgv
File opened for modification	/tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg	touch
File opened for modification	/tmp/apt.sig.WSEiOk	gpgv
File opened for modification	/tmp/apt-key-gpghome.E2R9jMwNfD/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.E2R9jMwNfD/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.pQu7HKGItI/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.E2R9jMwNfD/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.bYwRrj	apt-get
File opened for modification	/tmp/apt.conf.Mh0SOf	gpgv
File opened for modification	/tmp/apt-key-gpghome.xNT6jNxlVw/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.YzLocn	apt-get
File opened for modification	/tmp/fileutl.message.3a5GDw	apt-get
File opened for modification	/tmp/apt.conf.K87cad	gpgv
File opened for modification	/tmp/apt-key-gpghome.pQu7HKGItI/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.4UO3mm	apt-get
File opened for modification	/tmp/fileutl.message.nPoFly	apt-get
File opened for modification	/tmp/fileutl.message.Rt8nOO	apt-get
File opened for modification	/tmp/fileutl.message.QqqdGc	apt-get
File opened for modification	/tmp/fileutl.message.9mR6mC	apt-get
File opened for modification	/tmp/fileutl.message.eZ8d9o	apt-get
File opened for modification	/tmp/apt.data.VNFOT0	gpgv
File opened for modification	/tmp/apt.data.uGhJOp	gpgv
File opened for modification	/tmp/fileutl.message.kAS7L2	apt-get
File opened for modification	/tmp/fileutl.message.YcoI02	apt-get
File opened for modification	/tmp/apt.sig.SLj3H2	gpgv
File opened for modification	/tmp/apt.data.URgBcu	gpgv
File opened for modification	/tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.E2R9jMwNfD/pubring.gpg	touch
File opened for modification	/tmp/fileutl.message.QHXc8E	apt-get
File opened for modification	/tmp/fileutl.message.IM0uRB	apt-get
File opened for modification	/tmp/fileutl.message.yWMdLU	apt-get
File opened for modification	/tmp/fileutl.message.ZP5aPK	apt-get

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
738	apt-get

/tmp/msfinstall
/tmp/msfinstall
1⤵
PID:714
- /usr/bin/id
  id -u
  2⤵
  PID:716
- /bin/grep
  grep Darwin
  2⤵
  PID:721
- /bin/uname
  uname -sv
  2⤵
  PID:719
- /usr/bin/gpg
  gpg --dearmor -o /usr/share/keyrings/metasploit-framework.gpg
  2⤵
  - Reads runtime system information
  PID:728
- /bin/cat
  cat
  2⤵
  PID:729
- /bin/mkdir
  mkdir -p /etc/apt/preferences.d/
  2⤵
  - Reads runtime system information
  PID:733
- /bin/cat
  cat
  2⤵
  PID:736
- /usr/bin/apt-get
  apt-get update
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:738
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:743
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:746
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:748
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:752
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:754
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:755
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:758
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:759
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.mQSTvm /tmp/apt.data.URgBcu
      4⤵
      Writes file to tmp directory
      PID:761
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:763
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:764
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:765
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:766
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:767
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:768
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:769
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:770
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:771
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:772
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        Reads runtime system information
        
        PID:773
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:774
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:776
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:777
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:778
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.pQu7HKGItI
        5⤵
        
        PID:779
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.pQu7HKGItI
        5⤵
        
        PID:780
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg
        5⤵
        
        PID:781
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:782
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        Reads runtime system information
        
        PID:783
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:784
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:785
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        Reads runtime system information
        
        PID:786
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:789
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:791
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:793
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:795
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:797
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:799
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:801
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:803
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:805
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:807
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg /tmp/apt-key-gpghome.pQu7HKGItI/pubring.orig.gpg
        5⤵
        Writes file to tmp directory
        
        PID:808
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:811
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:814
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.pQu7HKGItI --keyring /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.mQSTvm /tmp/apt.data.URgBcu
        5⤵
        
        PID:815
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:816
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:817
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.pQu7HKGItI
        5⤵
        
        PID:818
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      Writes file to tmp directory
      PID:820
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:822
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:823
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:824
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:825
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:826
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:827
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:828
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:829
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:830
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:831
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        Reads runtime system information
        
        PID:832
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:833
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:835
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:836
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:837
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.E2R9jMwNfD
        5⤵
        
        PID:838
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.E2R9jMwNfD
        5⤵
        
        PID:839
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.E2R9jMwNfD/pubring.gpg
        5⤵
        
        PID:840
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.E2R9jMwNfD/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:841
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        Reads runtime system information
        
        PID:842
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:843
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:844
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        Reads runtime system information
        
        PID:845
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:848
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:850
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:852
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:854
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:856
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:858
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:860
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:862
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:864
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:866
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.E2R9jMwNfD/pubring.gpg /tmp/apt-key-gpghome.E2R9jMwNfD/pubring.orig.gpg
        5⤵
        Writes file to tmp directory
        
        PID:867
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:870
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:873
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.E2R9jMwNfD --keyring /tmp/apt-key-gpghome.E2R9jMwNfD/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Reads runtime system information
        
        PID:874
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:875
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:876
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.E2R9jMwNfD
        5⤵
        
        PID:877
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /usr/share/keyrings/metasploit-framework.gpg verify --status-fd 3 /tmp/apt.sig.SLj3H2 /tmp/apt.data.VNFOT0
      4⤵
      Writes file to tmp directory
      PID:879
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:881
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:882
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:883
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:884
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:885
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:886
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:887
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:888
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:890
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:894
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:895
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.cnyJuGIuxB
        5⤵
        
        PID:896
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:900
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:903
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.cnyJuGIuxB --keyring /usr/share/keyrings/metasploit-framework.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.SLj3H2 /tmp/apt.data.VNFOT0
        5⤵
        Reads runtime system information
        
        PID:905
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        
        PID:906
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:907
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.cnyJuGIuxB
        5⤵
        
        PID:908
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.WSEiOk /tmp/apt.data.uGhJOp
      4⤵
      Writes file to tmp directory
      PID:910
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:912
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:913
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:914
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:915
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:916
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:917
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:918
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:919
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:921
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:922
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:923
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.xNT6jNxlVw
        5⤵
        
        PID:924
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:928
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:931
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.xNT6jNxlVw --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.WSEiOk /tmp/apt.data.uGhJOp
        5⤵
        
        PID:933
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:934
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:935
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.xNT6jNxlVw
        5⤵
        
        PID:936
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:937
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:996
- /usr/bin/apt-get
  apt-get install -y --allow-downgrades metasploit-framework
  2⤵
  - Writes file to tmp directory
  PID:999
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1001
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1006

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pin-metasploit.pref

Path /etc/apt/preferences.d/pin-metasploit.pref
Size 77B
SHA256 f444065a65dff3d0ac8e82e1d85fdad4b6a35607bb1c0a9baf44f3883a1fa80a
MD5 84eced9fbdb5cd50c9c61a667192bb24
SHA1 48fa24642cd32aeae8394ad50a6c4a97faec49fc
SHA512 94d7595e59a80d5e4c5b5a1d98176c871a52bccb9fd07382e7f1eb2df70b4fdb440ffadbe2c3b7ede28ff2cdf00d7ca8e2f83edda79e15ce57bc8f5e4bf372fb
TLSH
T14EA0121950304D440031401143AC0205841920015000D0A06C6458BE5E3478171212A9
MD5 SHA1 SHA512 TLSH

Submit Download

metasploit-framework.list

Path /etc/apt/sources.list.d/metasploit-framework.list
Size 144B
SHA256 486d75ff5606896028edd5edbe3d2148e22553f098d6827eca71d7ccc37ae1ae
MD5 b5613926767d62dc42d73c309ed6a2b7
SHA1 7fa632c7c7281c1c8668c32f9a9a752a59ac82cf
SHA512 ca6c05f9fd6db82f2d8723c4fb6bda7cd97db7ae65b134e04369d3c49a72bb5cbfd96e2101f85160cbe0f16ef38240038a0dbdbb49398f8bc90e025c2e30843c
TLSH
T1E5C08C9F313858881835189072CC0200CA8629A03440E0B8E038102F88788B260213C7
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.E2R9jMwNfD/gpg.1.sh
Size 82B
SHA256 53998c7a0eaaa274753266745820cdc7c5f414adf789244be432dc3709d902fe
MD5 e4d5bb277b701137d032d3a12ce697ed
SHA1 dfcc4710b57373c90f95831da6883acf9ee9a948
SHA512 b1003349aad9917b3f1b11ad62292eb111ff0b28ac9636b296a77cfe9ad978d1a008a3261bbd5e9fd482624d338a83d9c557ce0786af552eba62d0bbf3c2851f
TLSH
T172A0121511030032261DD440147007A0680B025015E21004E180502666253893731250
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.cnyJuGIuxB/gpg.1.sh
Size 83B
SHA256 a30491507f452535e492661e91a8aa9323e6810dfaaa51e5cbb5e281a1af4d16
MD5 372fbcbf1d489c7815d0b296d74f9fc5
SHA1 e3c5ce76b6cfe5f94b4603caaceb15b2288f221d
SHA512 bd5c31241fb14b34838c394f399a6b256c1d6afe56904929b9be13d30c5b0942e538c0d59d8a7450e22662004a65d99ee8ed2e94fbc3f07437a83107662d1726
TLSH
T1C6A012BB2443907A0934945478740320C78D01D03090D011C180000E54206A62532682
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.pQu7HKGItI/gpg.1.sh
Size 82B
SHA256 95fd6776176fbc59bb296ce1b3682e0590052bcf68c38fc036bd8c667ad57540
MD5 3eb97fcd84c89974097287eb5db1e180
SHA1 766994c9046158ae0d7e28d288ad47b09241dcde
SHA512 9c551e7b03b7da98b8ae97f3cca8d1e7ae10a39e7b5244426a32d9a3d383378e62d7d7cd51696a37b52dde0b62cd7e18f7aa75aef70936acd8d57cfe60db20be
TLSH
T1D7A02431700330333D5CD440447017F0740F015010F10004F5C0443D333434517750D0
MD5 SHA1 SHA512 TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg
Size 7KB
SHA256 6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93
MD5 b53e6ca4ed295fc38621315853f623d0
SHA1 45a416f014809735ec88854a3540c8e9e89eb102
SHA512 30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac
SSDEEP 192:EKgnTWoCNdK1jKp1uUnMV/RFGxUqe8UFTHkfDBuw:EgjNdyjK7uUM1RFGxX2THkftn
TLSH
T154F1CF565B639F17AE63F83DE43904B8B7629EF6CD7A57C0F2A0318A8BC5654F024001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg
Size 15KB
SHA256 389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248
MD5 2713b38b3d7345961d8b80f4463483b8
SHA1 e6ec76aaebfea6a82f7984b57e07522a20365201
SHA512 ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsj:EgDymRZxXkHCtjTk5udNj
TLSH
T14D72D0A797137F5B2A3BF43C607665BCBA269DF9C9B88ED0F300318B0949144E23C525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg
Size 18KB
SHA256 42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f
MD5 760d3ab91f417958475b9a6342a5b92e
SHA1 137a06aea4b5c9e9ca11f0f5f1225da1c275c334
SHA512 6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxG4:EgDymRZxXkHCtjTk5udNvvCxG4
TLSH
T15C82D0A69B137F5B193BF47D707656B8BD278CF9C5F88E91E340348B0A4A114E13C52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg
Size 23KB
SHA256 de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca
MD5 d63fbab9dfb826d53f7b3aaea45dbfb5
SHA1 59841d8e5423f788292af76d4350a948f4e25f53
SHA512 20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxGiPx/xZaURhky:EgDymRZxXkHCtjTk5udNvvCxGiPxyy
TLSH
T1A7B2D0A693236F4BAD77F47EB46AE178ED139CF8C5E51FC2E280718B094A2849138516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.pQu7HKGItI/pubring.gpg
Size 47KB
SHA256 eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391
MD5 a4dc094481f22304cab5550218e6e4de
SHA1 f5886a324c0c026d0168656f23d1d898a0e43bd6
SHA512 0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68
SSDEEP 768:EgDymRZxXkHCtjTk5udNvvCxGiPxyiKAHeDC68TAVRNpyTgiv6Mfp2swONe:BFT0HEjbSGiPxhp+DP8TAV1rO12swn
TLSH
T1F323E1E5EB625B9FA923EC3B745B6238AD139DFCC4D52DD1D14571470F49208A028CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.xNT6jNxlVw/gpg.1.sh
Size 71B
SHA256 11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d
MD5 4a502d34c9274bf20ac5781ec24f97d5
SHA1 524c16347caa1e4e4c89fe3a397248a4059be41c
SHA512 93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf
TLSH
T115A022F38083223F003C80200A302320A28F02E030F0C02CC38A800230203822AB0088
MD5 SHA1 SHA512 TLSH

Submit Download

apt.conf.K87cad

Path /tmp/apt.conf.K87cad
Size 7KB
SHA256 2c3934c0743ca9fbaa038abb2d1816b9bcbda9bc18f5c890c4b4ffdca8bb2adb
MD5 4d16224f0b149db335c54c99eea688ce
SHA1 7fe7f6a17648f530c97eb7c07cda04a297dff708
SHA512 2234bdcd0df1356df6ddda3b759cc48c8d48f26c80b4f17bc859f84d5883adc7e2671b705cb3a8090988c0a0b4cc1055b7e7e3400002ba1cffc7dba8060d7a38
SSDEEP 96:JsG+lEma8vBOoXBcqAQx0WoKibAnUbSbVhzZzQznz+zIGzxe8GSG88Eu:JsG+lBVAQhJibAn4aHzZzQznz+zHzl2J
TLSH
T18AE11065B4D5E2A016E74EB8B997C8008BB4E4D8EF004A6ED70B05A871F0C5E57DEDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.data.URgBcu

Path /tmp/apt.data.URgBcu
Size 56KB
SHA256 ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3
MD5 fd96c8ce5d0ef18d63bbe9ae17bb2659
SHA1 76b284743d95d3546df9d85c09712c830a30f614
SHA512 2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2
SSDEEP 384:Nxz5CUX7PwDBnm8nm8gzxjKwjKmuIQBHlKQd7mMqp9Hp9H2861BL1BjaemWOaw09:Nx5WIQCQyXlrLqbGC/
TLSH
T18C43431827A8277EAE248FEF6FF37561BC2CF121644602D1314DADE403E6317E6A745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.sig.mQSTvm

Path /tmp/apt.sig.mQSTvm
Size 1KB
SHA256 4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230
MD5 70274ce622b0cc437ef7f0caddc9d232
SHA1 124513a3ad2eb5aafa9be0920681e3bb8625979b
SHA512 fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8
TLSH
T1DA31C8C0F86079C16396CDCA731C92695EBA90C334C459305BF216125A682221D5F4B8
MD5 SHA1 SHA512 TLSH

Submit Download

metasploit-framework.gpg

Path /usr/share/keyrings/metasploit-framework.gpg
Size 2KB
SHA256 8f72c2591308e57654aedd69ac19faeabbe3f136fa41727e881d4a2d6a816691
MD5 3a98759654cd4385e7323dfdfe109f2c
SHA1 b62a6008eb89cf272486b4bf50d1bff1b451ec4d
SHA512 9d0e54d5df7cf38de427ef01a7cdf03c72049da94b91e70f79c562a188fb3b2a22610a7b586aff9ae9264d2c17097686f80734c8a26de9895a425dfaf7dad323
TLSH
T1F6412998958675A0EC76FEC42695717AC42CCCD24011EEAAA3F3B04C9887D5171B172F
MD5 SHA1 SHA512 TLSH

Submit Download

srcpkgcache.bin.rpDBSf

Path /var/cache/apt/srcpkgcache.bin.rpDBSf
Size 248B
SHA256 35a86254fb54b43833f063524ae2d9bf025862f9e7f73d2f5620d3901c01e6dc
MD5 f62873c9c8508d3f62628f1b17890ebd
SHA1 14992323b454848273898aeb794e4331efc353e0
SHA512 a7cc5ef51319418a89af6951008f275562908b714571e358bcf91dfff7fbd1649436d979da582ecb448a267769d3f7da9b2b7231ffa6e4f803da63acbcdc74f3
TLSH
T12BD0801B6135F1E1C551D7F5464CD70695000954C953D49306729754155151B7D28505
MD5 SHA1 SHA512 TLSH

Submit Download

downloads.metasploit.com_data_releases_metasploit-framework_apt_dists_lucid_InRelease

Path /var/lib/apt/lists/partial/downloads.metasploit.com_data_releases_metasploit-framework_apt_dists_lucid_InRelease
Size 3KB
SHA256 23e379078da9f18b40c40fe29c8bc554ce696c4675ed0a3a66cfccdef25c51ff
MD5 31eda2ffd421652ae3c0b183beb375b4
SHA1 9f6d4a37a94619b1a4c7748dd88cecc4d3c2f831
SHA512 d32e62cc9cf8b4cc1d48d5cee16a1d8faeabe790bf6ba605387b85659dec9d3aa62bcfba86bc1e5d171bbb87d7df4b35ef7dffca3ec81f241b43f83915060e01
TLSH
T136811C4C4AA45F369D24CFBFFB333874ED2CE4B13EE544D421859AA35166A8B344714D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads