2c4c6683a17b6f4128898a7b521e3c8bb725a99ffaf1b5e32ac97c6fa7d381be

Analysis

max time kernel
131s
max time network
133s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/06/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_20.x
Size 3KB
Sample260623-pgmaracx2m
SHA256 2c4c6683a17b6f4128898a7b521e3c8bb725a99ffaf1b5e32ac97c6fa7d381be
MD5 a4a0131dbc11c4f801fb45036e71cea1
SHA1 49c5652fdb2cf2469a9d558e1ff11de00be7fd55
SHA512 9a39ded6028ccfca70b380b911052d3c5b719a74ab86c19b82d391ca41b25b6cf4bb3243f9a62e367aa91a0c39cb0b066490b4b60b5d8fbe2c80f1490f1e0572
TLSH
T15981AA33A8855BFB1524017D29DBE1916B442127423C556CF42E20283FE8FDD76BB75D
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	https
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpg
File opened for reading	/proc/cpuinfo	gpgv

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/sys/crypto/fips_enabled	gpg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/auxv	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/auxv	gpg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/self/auxv	gpg-connect-agent
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/auxv	gpgconf
File opened for reading	/proc/self/auxv	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.kxatnB	apt
File opened for modification	/tmp/fileutl.message.NfNYkL	apt
File opened for modification	/tmp/apt-key-gpghome.SbltMQVlpb/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg	touch
File opened for modification	/tmp/fileutl.message.McYJ9h	apt
File opened for modification	/tmp/apt.sig.k6jD3B	gpgv
File opened for modification	/tmp/fileutl.message.xpLCE0	apt
File opened for modification	/tmp/fileutl.message.8TvafG	apt
File opened for modification	/tmp/apt.data.Nab7Im	gpgv
File opened for modification	/tmp/apt.sig.8oyOOB	gpgv
File opened for modification	/tmp/apt-key-gpghome.DlrhxFOI0T/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.tUdn2l	apt
File opened for modification	/tmp/fileutl.message.jS5DNN	apt
File opened for modification	/tmp/fileutl.message.SwO91S	apt
File opened for modification	/tmp/fileutl.message.oAphCD	apt
File opened for modification	/tmp/apt-key-gpghome.kvjWVd9jqR/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.vONdGX	apt
File opened for modification	/tmp/apt.conf.CyxbLn	gpgv
File opened for modification	/tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.5DTYbI	apt
File opened for modification	/tmp/fileutl.message.sgPoFj	apt
File opened for modification	/tmp/apt.conf.1EUWiR	gpgv
File opened for modification	/tmp/apt-key-gpghome.kvjWVd9jqR/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.kvjWVd9jqR/pubring.gpg	apt-key
File opened for modification	/tmp/apt.data.QB3KOP	gpgv
File opened for modification	/tmp/apt-key-gpghome.DlrhxFOI0T/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.conf.apjLow	gpgv
File opened for modification	/tmp/apt-key-gpghome.kvjWVd9jqR/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.qUYFms	apt
File opened for modification	/tmp/fileutl.message.TTrJYp	apt

/tmp/setup_20.x
/tmp/setup_20.x
1⤵
PID:644
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:655
- /usr/bin/apt
  apt update -y
  2⤵
  - Writes file to tmp directory
  PID:661
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:668
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:673
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:674
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:676
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:677
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:686
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Writes file to tmp directory
    PID:688
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.k6jD3B /tmp/apt.data.Nab7Im
      4⤵
      Writes file to tmp directory
      PID:694
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:698
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:701
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:703
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:706
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:708
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:711
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:713
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:717
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:720
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:723
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:727
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.SbltMQVlpb
        5⤵
        
        PID:728
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:734
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:741
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.SbltMQVlpb --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.k6jD3B /tmp/apt.data.Nab7Im
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:743
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:748
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:750
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.SbltMQVlpb
        5⤵
        
        PID:752
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.8oyOOB /tmp/apt.data.QB3KOP
      4⤵
      Writes file to tmp directory
      PID:810
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:812
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:813
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:814
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:815
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:816
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:817
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:818
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:819
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:820
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:821
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:822
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:823
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:825
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:826
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:827
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.DlrhxFOI0T
        5⤵
        
        PID:828
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.DlrhxFOI0T
        5⤵
        
        PID:829
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg
        5⤵
        
        PID:830
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:831
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        Reads runtime system information
        
        PID:832
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:833
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:834
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:835
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:838
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:840
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:842
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:844
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:846
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:848
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:850
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:852
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:854
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:856
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:857
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:860
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:863
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.DlrhxFOI0T --keyring /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.8oyOOB /tmp/apt.data.QB3KOP
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:864
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:865
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:866
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.DlrhxFOI0T
        5⤵
        
        PID:867
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      Writes file to tmp directory
      PID:869
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:871
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:872
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:873
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:874
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:875
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:876
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:877
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:878
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:879
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:880
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        Reads runtime system information
        
        PID:881
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:882
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:884
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:885
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:886
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.kvjWVd9jqR
        5⤵
        
        PID:887
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.kvjWVd9jqR
        5⤵
        
        PID:888
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.kvjWVd9jqR/pubring.gpg
        5⤵
        
        PID:889
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.kvjWVd9jqR/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:890
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        Reads runtime system information
        
        PID:891
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:892
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:893
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:894
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:897
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:899
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:901
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:903
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:905
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:907
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:909
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:911
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:913
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:915
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.kvjWVd9jqR/pubring.gpg /tmp/apt-key-gpghome.kvjWVd9jqR/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:916
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:919
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:922
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.kvjWVd9jqR --keyring /tmp/apt-key-gpghome.kvjWVd9jqR/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:923
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:924
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:925
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.kvjWVd9jqR
        5⤵
        
        PID:926
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:927
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:930
- /usr/bin/apt
  apt install -y apt-transport-https ca-certificates curl gnupg
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:931
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:932
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:933
- /bin/mkdir
  mkdir -p /usr/share/keyrings
  2⤵
  - Reads runtime system information
  PID:934
- /bin/rm
  rm -f /usr/share/keyrings/nodesource.gpg
  2⤵
  PID:935
- /bin/rm
  rm -f /etc/apt/sources.list.d/nodesource.list
  2⤵
  PID:936
- /bin/rm
  rm -f /etc/apt/sources.list.d/nodesource.sources
  2⤵
  PID:937
- /usr/bin/curl
  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:938
- /usr/bin/gpg
  gpg --dearmor -o /usr/share/keyrings/nodesource.gpg
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:939
- /bin/chmod
  chmod 644 /usr/share/keyrings/nodesource.gpg
  2⤵
  PID:941
- /usr/bin/dpkg
  dpkg --print-architecture
  2⤵
  PID:942
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:943

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gpg.1.sh

Path /tmp/apt-key-gpghome.DlrhxFOI0T/gpg.1.sh
Size 82B
SHA256 070695835f152e491b02e24db89a59065cd654b6679abb81060e745ce4713cbf
MD5 f2a3398685f57baead3da38a0750a37c
SHA1 059c57394f98a5999ffe22ed8ab2f7e4e9a41b81
SHA512 b0ac8e5d72a6095cf6eefd23624a6afecd0637220441149f5d6659a3a6780d48f4443e358ab24e09d353f0eb932cb97bc97652fefbff9a2b322e085367d5f277
TLSH
T1E2A0122525030136291CC44004B023A0640F029010E24105F180402522207551635060
MD5 SHA1 SHA512 TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg
Size 7KB
SHA256 6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93
MD5 b53e6ca4ed295fc38621315853f623d0
SHA1 45a416f014809735ec88854a3540c8e9e89eb102
SHA512 30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac
SSDEEP 192:EKgnTWoCNdK1jKp1uUnMV/RFGxUqe8UFTHkfDBuw:EgjNdyjK7uUM1RFGxX2THkftn
TLSH
T154F1CF565B639F17AE63F83DE43904B8B7629EF6CD7A57C0F2A0318A8BC5654F024001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg
Size 15KB
SHA256 389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248
MD5 2713b38b3d7345961d8b80f4463483b8
SHA1 e6ec76aaebfea6a82f7984b57e07522a20365201
SHA512 ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsj:EgDymRZxXkHCtjTk5udNj
TLSH
T14D72D0A797137F5B2A3BF43C607665BCBA269DF9C9B88ED0F300318B0949144E23C525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg
Size 18KB
SHA256 42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f
MD5 760d3ab91f417958475b9a6342a5b92e
SHA1 137a06aea4b5c9e9ca11f0f5f1225da1c275c334
SHA512 6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxG4:EgDymRZxXkHCtjTk5udNvvCxG4
TLSH
T15C82D0A69B137F5B193BF47D707656B8BD278CF9C5F88E91E340348B0A4A114E13C52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg
Size 23KB
SHA256 de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca
MD5 d63fbab9dfb826d53f7b3aaea45dbfb5
SHA1 59841d8e5423f788292af76d4350a948f4e25f53
SHA512 20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxGiPx/xZaURhky:EgDymRZxXkHCtjTk5udNvvCxGiPxyy
TLSH
T1A7B2D0A693236F4BAD77F47EB46AE178ED139CF8C5E51FC2E280718B094A2849138516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.DlrhxFOI0T/pubring.gpg
Size 47KB
SHA256 eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391
MD5 a4dc094481f22304cab5550218e6e4de
SHA1 f5886a324c0c026d0168656f23d1d898a0e43bd6
SHA512 0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68
SSDEEP 768:EgDymRZxXkHCtjTk5udNvvCxGiPxyiKAHeDC68TAVRNpyTgiv6Mfp2swONe:BFT0HEjbSGiPxhp+DP8TAV1rO12swn
TLSH
T1F323E1E5EB625B9FA923EC3B745B6238AD139DFCC4D52DD1D14571470F49208A028CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.SbltMQVlpb/gpg.1.sh
Size 71B
SHA256 11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d
MD5 4a502d34c9274bf20ac5781ec24f97d5
SHA1 524c16347caa1e4e4c89fe3a397248a4059be41c
SHA512 93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf
TLSH
T115A022F38083223F003C80200A302320A28F02E030F0C02CC38A800230203822AB0088
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.kvjWVd9jqR/gpg.1.sh
Size 82B
SHA256 0e2f3cb5dbcf956ddc4a31762ee790e9801d12aedce1a89f52fb4cfcd097b873
MD5 a54397daaaf6e9699dcc0de369ca4465
SHA1 57de0e3ae4909075f674d32fe4bae093f5d955e5
SHA512 97eaf1e789746ef35284e6a6d67ace4def78d12a58abc556cdaaad2a6fb0d11876ee7fb404bab564c2d4a48f504fc8f28954633354026fef5229eabb855e02a8
TLSH
T1A8A01261110310222638C8444C7023E0640B01E012F20018E1944425B2303451A32050
MD5 SHA1 SHA512 TLSH

Submit Download

apt.conf.1EUWiR

Path /tmp/apt.conf.1EUWiR
Size 8KB
SHA256 ebe0d5c1091976cadb00709dac4f91c8dc0edccb4d10756b6d31a1e555edd35a
MD5 28cfe3a4cc4253b86a4654af78dacf99
SHA1 aecd3a9c40801a02076fa0d6bfa28d8d227e0dd9
SHA512 e4c9bffa2b3d8d23491dbdc9ed410a02f1f35695d3165847b2e450baa88ea19035c933456f8d0b4634239972972af05629591ff794dd92e94f8a5e01cccc81e7
SSDEEP 12:hE+WeZ+Z++esZ+n8RKRDxnvEAEctcuHXb:hGfgsa8EXnntTL
TLSH
T18302EC3081E98E33DE2599B4FB8B495527C2E190FD07E7A9905B100143991AD6E6CBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.data.Nab7Im

Path /tmp/apt.data.Nab7Im
Size 11KB
SHA256 29bd4ef1f6975d6977e8003f62fca96245e3a30abf451711032fb9fee0c2c1a9
MD5 aa63a6250cbd7311d5f6006f0b5d0c54
SHA1 07fd8fd8569e99b869afd7d51877e2dcabe02f5a
SHA512 6f633d88ab204542e72fdc2a824c0a78c06f27afc453307a0ebb9923ed4fd2099bc12a9f6aaf263965a90cf9fdfa42c66e7d3357f8e78620caf2a9691f9c388c
SSDEEP 192:oQc0bMcsXPNbHlD/RdDDjXP1WlDHbxShjDLm3/maJwqGZl9DAYPu:oNbHlApmmgq
TLSH
T19832745C06A41D3BDE4FCF3FBB763441AD2EF4502A8448E5729CD9A707AA306A9D344E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.sig.k6jD3B

Path /tmp/apt.sig.k6jD3B
Size 488B
SHA256 901236f44867e14fe79e8ef9df0af57571fdfeca89f2bb69958cf0681d5e8d4f
MD5 aa8f34721a96e4788beb441717efb4a2
SHA1 7b8747c770b29953691ea0ee863490e68eb20dbb
SHA512 c9dae908cb7a7140279462a1038358dd69a4122ef4a578b50c1af1b5da6d51abd001cf09241a49e695c7a65e6be68d306f75184262d7498fab25e991fe7c91cd
TLSH
T1F9F00ED27FB418B0876ED0481C970BA0DAB20CB9B1331DF5A661095B3D4B0330E0EC64
MD5 SHA1 SHA512 TLSH

Submit Download

nodesource.gpg

Path /usr/share/keyrings/nodesource.gpg
Size 1KB
SHA256 7a96b125f721c99e07d3f45b279adbd6884ec4f3f06750f6b54df40cfae36836
MD5 6aea1cf1b473410593a4ab95602a9a9f
SHA1 ac312240fe84843ef7680d9962e126b20e9dee94
SHA512 73cc7d55bc2034fe4f0eab0fd7d4891cc8cb009e0b8cdd383e9a0cc3b859e7f6431fc730e05b5efc5aa32b89997929649c975a1394227b330f5f6706b0bfcf4c
TLSH
T1F7210AE2206515BC33EDFB90D6142068811CDF744C706AB851B59886F5C323AE2B1803
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads