1cc2cec68b7d9ac04e7340788b974f94eebe9134a08726eb161814023540adee

Analysis

max time kernel
42s
max time network
107s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/06/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
headcrab.sh
Size 27KB
Sample260628-pkfblshs2w
SHA256 1cc2cec68b7d9ac04e7340788b974f94eebe9134a08726eb161814023540adee
MD5 6e006362a8e3f127d35cda154a164d4c
SHA1 2d32b6f6df318eb0f5e767c6196d6b24c8351fc1
SHA512 0e5957a71bfd1d1901fded9ce3e8e9adffa8582014e1436724446fa8e98b5d10b60566f1be8bf770a07508408b7bacd28d1528e2c9c91b0a941996839c173475
SSDEEP 384:gronMbB/sIsQUgM2avcKpzMwObnUlLej3t:grqMyIsQUgM2avPzMwO4lLe5
TLSH
T1E2C24129773666B437198379C95BC013B62A5013000AAC6C3CEFD6587F453AD51FE6AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm defense_evasion desktop discovery evasion execution persistence privilege_escalation

Malware Config

Signatures

Desktop file executes script
Runs a potentially malicious embedded script with remote resources upon launch.
desktop evasion

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
948	chmod
956	chmod
936	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/.headcrab/dlm	949	bash
/.headcrab/dgsc	957	bash

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 3 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
923	sudo
681	sudo
683	sudo

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com
9	raw.githubusercontent.com
11	raw.githubusercontent.com
13	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
10	raw.githubusercontent.com
12	raw.githubusercontent.com
20	raw.githubusercontent.com
21	raw.githubusercontent.com
6	raw.githubusercontent.com

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	https
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpgconf

Creates .desktop file 2 TTPs 1 IoCs

Linux desktops like GNOME require .desktop files to register applications. Sometimes abused by malware for persistence.

persistence execution

User Execution

T1204

Malicious File

T1204.002

description	ioc	Process
File opened for modification	/.local/share/applications/headcrab.desktop	wget

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/289/stat	killall
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/299/stat	killall
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	https
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/105/stat	killall
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/158/stat	killall
File opened for reading	/proc/291/stat	killall
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/168/stat	killall
File opened for reading	/proc/96/stat	killall
File opened for reading	/proc/328/stat	killall
File opened for reading	/proc/644/stat	killall
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/self/auxv	gpg-connect-agent
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/340/stat	killall
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/582/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/307/stat	killall
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/928/stat	killall
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/auxv	gpg-connect-agent

Writes file to tmp directory 36 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/apt-key-gpghome.WqglGJehem/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.3DpTT7	apt-get
File opened for modification	/tmp/fileutl.message.GCGs4y	apt-get
File opened for modification	/tmp/fileutl.message.xlbZJn	apt-get
File opened for modification	/tmp/fileutl.message.2OxDQr	apt-cache
File opened for modification	/tmp/apt.conf.05UbIi	gpgv
File opened for modification	/tmp/apt-key-gpghome.w5tQIr9Kc8/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.w5tQIr9Kc8/pubring.orig.gpg	cp
File opened for modification	/tmp/SLSsteam_Download/SLSsteam-Any.7z	wget
File opened for modification	/tmp/apt.sig.eKwE2p	gpgv
File opened for modification	/tmp/apt.data.G1sPoB	gpgv
File opened for modification	/tmp/fileutl.message.V1GBkI	apt-get
File opened for modification	/tmp/fileutl.message.QGjAkc	apt-cache
File opened for modification	/tmp/fileutl.message.CGWk6c	apt-get
File opened for modification	/tmp/apt-key-gpghome.WqglGJehem/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.gpUfYd	apt-get
File opened for modification	/tmp/apt-key-gpghome.w5tQIr9Kc8/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.data.1KL9Sf	gpgv
File opened for modification	/tmp/fileutl.message.2LtoLF	apt-cache
File opened for modification	/tmp/fileutl.message.6YCoE5	apt-get
File opened for modification	/tmp/apt-key-gpghome.WqglGJehem/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.WqglGJehem/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.w5tQIr9Kc8/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.zr5MLv	apt-get
File opened for modification	/tmp/fileutl.message.W5zrSz	apt-get
File opened for modification	/tmp/fileutl.message.HH4rSO	apt-get
File opened for modification	/tmp/fileutl.message.WUWz7g	apt-cache
File opened for modification	/tmp/fileutl.message.fRJOr5	apt-get
File opened for modification	/tmp/apt.conf.BIVSYw	gpgv
File opened for modification	/tmp/apt.conf.Ji69Gw	gpgv
File opened for modification	/tmp/fileutl.message.6JXrlj	apt-get
File opened for modification	/tmp/fileutl.message.2dJUAn	apt-get
File opened for modification	/tmp/fileutl.message.spAl36	apt-get
File opened for modification	/tmp/sh-thd.JNF8wk	bash
File opened for modification	/tmp/apt.sig.UUj85S	gpgv
File opened for modification	/tmp/apt-key-gpghome.V8tEQ4ygVd/gpg.1.sh	apt-key

Software Deployment Tools 1 TTPs 4 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
924	apt-get
678	dpkg
678	dpkg-query
684	apt-get

/tmp/headcrab.sh
/tmp/headcrab.sh
1⤵
PID:644

/usr/local/sbin/bash
bash /tmp/headcrab.sh
1⤵
PID:644

/usr/local/bin/bash
bash /tmp/headcrab.sh
1⤵
PID:644

/usr/sbin/bash
bash /tmp/headcrab.sh
1⤵
PID:644

/usr/bin/bash
bash /tmp/headcrab.sh
1⤵
PID:644

/sbin/bash
bash /tmp/headcrab.sh
1⤵
PID:644

/bin/bash
bash /tmp/headcrab.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:644
- /usr/bin/realpath
  realpath /tmp/headcrab.sh
  2⤵
  PID:659
- /usr/bin/dirname
  dirname /tmp/headcrab.sh
  2⤵
  PID:655
- /usr/bin/apt-cache
  apt-cache search --names-only "^libcurl4t64\$"
  2⤵
  - Writes file to tmp directory
  PID:664
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:674
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:677
- /bin/grep
  grep -q libcurl4t64
  2⤵
  PID:666
- /usr/bin/dpkg
  dpkg -s libcurl4:i386
  2⤵
  - Reads runtime system information
  - Software Deployment Tools
  PID:678
- /usr/local/sbin/dpkg-query
  dpkg-query --status -- libcurl4:i386
  2⤵
  PID:678
- /usr/local/bin/dpkg-query
  dpkg-query --status -- libcurl4:i386
  2⤵
  PID:678
- /usr/sbin/dpkg-query
  dpkg-query --status -- libcurl4:i386
  2⤵
  PID:678
- /usr/bin/dpkg-query
  dpkg-query --status -- libcurl4:i386
  2⤵
  - Software Deployment Tools
  PID:678
- /usr/bin/dpkg
  dpkg --print-foreign-architectures
  2⤵
  PID:679
- /bin/grep
  grep -q i386
  2⤵
  PID:680
- /usr/bin/sudo
  sudo dpkg --add-architecture i386
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:681
- - /usr/bin/dpkg
    dpkg --add-architecture i386
    3⤵
    PID:682
- /usr/bin/sudo
  sudo apt-get update
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:683
- - /usr/bin/apt-get
    apt-get update
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:684
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:685
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:692
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:694
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      Checks CPU configuration
      Reads runtime system information
      PID:699
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:703
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      PID:723
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      Writes file to tmp directory
      PID:725
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.eKwE2p /tmp/apt.data.G1sPoB
        5⤵
        Writes file to tmp directory
        
        PID:739
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:742
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:744
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:745
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:746
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:747
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:748
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:749
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:750
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:751
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:752
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:753
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:754
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:756
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:757
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:758
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.WqglGJehem
        6⤵
        
        PID:759
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.WqglGJehem
        6⤵
        
        PID:760
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg
        6⤵
        
        PID:761
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:762
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:763
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:764
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:765
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        Reads runtime system information
        
        PID:766
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:769
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:771
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:773
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:775
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:777
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:779
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:781
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:783
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:785
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:787
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg /tmp/apt-key-gpghome.WqglGJehem/pubring.orig.gpg
        6⤵
        Writes file to tmp directory
        
        PID:788
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:791
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:794
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.WqglGJehem --keyring /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.eKwE2p /tmp/apt.data.G1sPoB
        6⤵
        Checks CPU configuration
        
        PID:795
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Checks CPU configuration
        
        PID:796
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Checks CPU configuration
        
        PID:797
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.WqglGJehem
        6⤵
        
        PID:798
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Writes file to tmp directory
        
        PID:800
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:802
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:803
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:804
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:805
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        Reads runtime system information
        
        PID:806
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:809
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:810
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:811
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        Reads runtime system information
        
        PID:812
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:813
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:814
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:815
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:817
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:818
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:819
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.w5tQIr9Kc8
        6⤵
        
        PID:820
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.w5tQIr9Kc8
        6⤵
        
        PID:821
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.w5tQIr9Kc8/pubring.gpg
        6⤵
        
        PID:822
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.w5tQIr9Kc8/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:823
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:824
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:825
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:826
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        
        PID:827
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:830
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:832
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:834
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:836
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:838
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:840
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:842
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:844
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:846
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:848
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.w5tQIr9Kc8/pubring.gpg /tmp/apt-key-gpghome.w5tQIr9Kc8/pubring.orig.gpg
        6⤵
        Writes file to tmp directory
        
        PID:849
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:852
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:855
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.w5tQIr9Kc8 --keyring /tmp/apt-key-gpghome.w5tQIr9Kc8/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:856
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Checks CPU configuration
        
        PID:857
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:858
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.w5tQIr9Kc8
        6⤵
        
        PID:859
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.UUj85S /tmp/apt.data.1KL9Sf
        5⤵
        Writes file to tmp directory
        
        PID:861
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:863
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:864
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:865
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:866
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:867
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:868
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:869
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:870
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:872
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:873
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:874
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.V8tEQ4ygVd
        6⤵
        
        PID:875
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:879
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:882
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.V8tEQ4ygVd --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.UUj85S /tmp/apt.data.1KL9Sf
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:884
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:885
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:886
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.V8tEQ4ygVd
        6⤵
        
        PID:887
  - - /usr/lib/apt/methods/store
      /usr/lib/apt/methods/store
      4⤵
      PID:807
  - - /usr/lib/apt/methods/store
      /usr/lib/apt/methods/store
      4⤵
      PID:808
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:921
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:922
- /usr/bin/sudo
  sudo apt-get install -y libcurl4:i386
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:923
- - /usr/bin/apt-get
    apt-get install -y libcurl4:i386
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:924
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:925
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:926
- /bin/mkdir
  mkdir -p /.local/share/applications
  2⤵
  PID:929
- /bin/mkdir
  mkdir -p /.local/share/icons/hicolor/48x48/apps
  2⤵
  PID:930
- /usr/bin/wget
  wget -O headcrab.png https://raw.githubusercontent.com/Deadboy666/h3adcr-b-modul3s/refs/heads/main/headcrab.png
  2⤵
  PID:931
- /usr/bin/wget
  wget -O headcrab.desktop https://raw.githubusercontent.com/Deadboy666/h3adcr-b-modul3s/refs/heads/main/headcrab.desktop
  2⤵
  - Creates .desktop file
  PID:935
- /bin/chmod
  chmod +x headcrab.desktop
  2⤵
  - File and Directory Permissions Modification
  PID:936
- /usr/bin/killall
  killall steam
  2⤵
  - Reads runtime system information
  PID:938
- /bin/grep
  grep "\"version\"" steam_client_publicbeta_ubuntu12.manifest
  2⤵
  PID:941
- /usr/bin/awk
  awk "-F\"" "{print \$4}"
  2⤵
  - Reads runtime system information
  PID:942
- /bin/rm
  rm "package/*"
  2⤵
  PID:943
- /usr/bin/wget
  wget https://raw.githubusercontent.com/Deadboy666/h3adcr-b-modul3s/refs/heads/main/sources.txt
  2⤵
  PID:944
- /usr/bin/wget
  wget https://raw.githubusercontent.com/Deadboy666/SteamTracking/refs/heads/headcrab/ClientManifest/steam_client_ubuntu12
  2⤵
  PID:945
- /bin/mkdir
  mkdir -p /.headcrab
  2⤵
  PID:946
- /usr/bin/wget
  wget https://github.com/Deadboy666/h3adcr-b-modul3s/raw/refs/heads/main/dlm
  2⤵
  PID:947
- /bin/chmod
  chmod +x dlm
  2⤵
  - File and Directory Permissions Modification
  PID:948
- /.headcrab/dlm
  /.headcrab/dlm --input-file sources.txt --max-concurrent 16
  2⤵
  PID:949
- /usr/bin/killall
  killall dgsc
  2⤵
  - Reads runtime system information
  PID:951
- /bin/cat
  cat
  2⤵
  PID:953
- /bin/mkdir
  mkdir -p /.headcrab
  2⤵
  PID:954
- /usr/bin/wget
  wget https://github.com/Deadboy666/h3adcr-b-modul3s/raw/refs/heads/main/dgsc
  2⤵
  PID:955
- /bin/chmod
  chmod +x dgsc
  2⤵
  - File and Directory Permissions Modification
  PID:956
- /bin/sleep
  sleep 1s
  2⤵
  PID:958
- /.headcrab/dgsc
  /.headcrab/dgsc --port 1666 --silent
  2⤵
  PID:957
- /bin/mkdir
  mkdir -p /root/.config/SLSsteam/tools/netsock
  2⤵
  PID:960
- /usr/bin/curl
  curl -sSL --connect-timeout 15 --max-time 30 -o /dev/null -w "%{url_effective}" yesyes0649/steamnetsock-patch/releases/latest
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:962
- /usr/bin/wget
  wget -O netsock.so https://github.com/yesyes0649/steamnetsock-patch/releases/download/latest/fix.so
  2⤵
  PID:964
- /bin/mkdir
  mkdir -p /tmp/SLSsteam_Download
  2⤵
  - Reads runtime system information
  PID:967
- /usr/bin/curl
  curl -sSL --connect-timeout 15 --max-time 30 -o /dev/null -w "%{url_effective}" https://github.com/AceSLS/SLSsteam/releases/latest
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:969
- /usr/bin/wget
  wget -O SLSsteam-Any.7z https://github.com/AceSLS/SLSsteam/releases/download/20260624075231/SLSsteam-Any.7z
  2⤵
  - Writes file to tmp directory
  PID:971

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

User Execution

T1204

Malicious File

T1204.002

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dgsc

Path /.headcrab/dgsc
Size 3.0MB
SHA256 08951d8e998d97dc4a35cb9376c888b98fa5dfb3dbf03d2fc96299403fd00422
MD5 4405f394f61941f288861acc96523744
SHA1 d16cc9b4a5273f36f273a38ebbc7d69b516a76f2
SHA512 363c38055fec77a87b04e8b06d8924265ec7bc03149a512a6e4f7c8c0453a6e7f74786915c545cb6c0fb7e1d8dfe819e08a86db82148f10ff8c9ad40295bdda5
SSDEEP 49152:GiyNMPKmS6smRjo0tZuNhfM50m/o7KJ0RoX0aXCKX/qZ0eZ0XJKcX/XAqvLKlHYU:LyhcF0i4HY8
TLSH
T1A2E58D03F9B1686DDFAEC5384A4EEA32773074184246AFA73BE096303E469165F1DBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlm

Path /.headcrab/dlm
Size 6.8MB
SHA256 972ebab8c12c0c47ef7d39f981e08a333a2f11fae6956ab3b9366539179c7714
MD5 048a97db8abe34c7d11405ea3e36703e
SHA1 3cedf40c1f35a310c2e0c5575f6f800843a43b74
SHA512 8baa7d9cae41ee3aedc8282c13796e4895b1910f4abea142a7358eadb531445b8ac73d1840ab9eca3f68c80ad7ada03a40b83157a80e48124e313aa9a00360a9
SSDEEP 98304:TWF+NQ+G1TmHIx9zyWoWAHUmIZjm0m7mhmkUjHl9f/Ls:MUQvr+Y/EQ0
TLSH
T154669E56F8BA04E9DCAECC74435EA133FA30744D433426E7AB945BA01E16F905F7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

headcrab.desktop

Path /.local/share/applications/headcrab.desktop
Size 281B
SHA256 38822d14a5080b66a3b254fb35ed0e293263b28a28cf7d88fd180826df56f2dd
MD5 b477ac9e3b0becc5e4e30d12474f56e5
SHA1 e03435fe7393a2414781bf946e9b875fbd9141c4
SHA512 8c618802eac10c9c1450bb96535ee77c391ace86f63ca827e03eae5fc9915a7d39b0bcb892324e3b9f5241ac4f71c16364329da95f18311310ae76fb01cdbb72
TLSH
T1A7D02BD215075539436532D5E100E8DCD5BACA2C64E2E575A144960F93D315EC24F654
MD5 SHA1 SHA512 TLSH

Submit Download

sources.txt

Path /.local/share/applications/sources.txt
Size 5KB
SHA256 eefa3a50c3941121086690569f9852b3ef94a51120f9d7540e5cea1a8117f4c2
MD5 4b45debb4afe7b525277e5ae79d93b28
SHA1 288fe9ce4baa56571ad3fc082efec603008e7849
SHA512 6625ab018492fd7b4e7b60cb2fb138acbe0bba02f51eaf7f70d4ab2e98273897a1222df351babf2af2c9a4f4b5c01538728d825f95e47d83fe543e1a7020d121
SSDEEP 48:ClQ9hhyUsSg1ehAb5CcwYTFPH/0JIfDOoa/Act3/vnSSAdHq8sUUc7:QKhhyVSV6b5CcnFPH/0uDW/B8SAdOpG
TLSH
T1E4C147DF2260C5769FEF618DA049B41FED7E24938CE77885D2EA07D525012B12B8F1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_client_ubuntu12

Path /.local/share/applications/steam_client_ubuntu12
Size 9KB
SHA256 0b3b898699c3b9f429df1e92a54e8c2b2f96bd862069c94720c6ae8017829906
MD5 4f42ba2f41c1c560aaacb673ac881f23
SHA1 f7553b6b54651a0094c0aaf532fc8c881abaa762
SHA512 c9ee82ffb1d5194a7a5cb3026703f598dc7f8587673923cd07d99e5997fe7c76474c40a44f7b270aa689c3195d2e4467372eda597dc6f5ae138a3ff0603e022e
SSDEEP 192:JL67+6uQAY5t0B8BWMBFgP3Wg79flcYTg:167+6uQRNsMBFgeg7hVg
TLSH
T1AD12B6533632F862765AEB8E820DE9160F8D711780123453EE7EC39E94D6E7039E7689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

headcrab.png

Path /.local/share/icons/hicolor/48x48/apps/headcrab.png
Size 1.6MB
SHA256 a5ca93560c07f37707aa95bd7ad396d5d715c8bd56de84ef162a6438636020c1
MD5 32cc02f5d9d524dd423ea12150958662
SHA1 ea0d2892a1a8ec79622664c146c5dbfdab9b520f
SHA512 1cbb64994fb2662a6117e76e56284f195295db791db963a8e12dac69e10bc011b194085d8d3adaaece9bb53ec889e8680db12f15798ce826acd53a1052b9ea32
SSDEEP 24576:ax+ucvxBrDlNv4e8wMPZgXzgzktzg7kir3aK3M/vuf6sG052IDDlzktCM:aouqjzZ+CXyGK8/vuNG052ukCM
TLSH
T16F753398CC972B016A4AE33C5BDEBAC55D1C7E5D941CFDEE5177C39803986A20384ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netsock.so

Path /root/.config/SLSsteam/tools/netsock/netsock.so
Size 16KB
SHA256 0c9d0fd5e5f7aa90a67f6afaa2959bdd0f2ee87505909c3e31bdd899e080cf52
MD5 4ed405287a723f2e890e58beb0053894
SHA1 54f5d52dbec003d35754a02ece03a337711ca193
SHA512 9405b75c40fff547a701dc4d4786b4f1318663260e926f51f66104d47812fa5a2beac34a6356de86ecc20c4c6a3af36f5505fbc761039411801bd9bad5bea3df
SSDEEP 96:R4kwMBWBoq9dnvWImozWwGYpKjhGJWaIRUIrRm/hzLz2pZvLtAry9w7/DgfBD/z/:R98/+2zWupG+IhRWhzP2pZefof1zXei
TLSH
T13F72644BA3A2CE7FC0E882744157667472B6A470E73213332614A5BA2DD275C1F3AF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.wget-hsts

Path /root/.wget-hsts
Size 180B
SHA256 76aa088bb2bfac8c661937402843c748fdef7598341bd486d287d119083c8f8c
MD5 fdbfa01e57400b1539145cb394b93f5b
SHA1 5f692cf2ad59e3968da17231ac4430574a048b66
SHA512 9887a4c3c8e2753ebdab4ed431945122e6490b6780966bfb5e6c113786bd8c53af37dcb29e954dd04464a6d38da39fda8f3d75d6fdd549aa3b8cb20563b7e3a2
TLSH
T150C0C033F104D300028100F0F08031FD12D4F2341354CC8A4C16C3282359201FCC0E3C
MD5 SHA1 SHA512 TLSH

Submit Download

.wget-hsts

Path /root/.wget-hsts
Size 215B
SHA256 436e443b5ec508f94a03eedbd1a1103f29e2012d17347779ad67ab38ffa5b07c
MD5 91f3c156ccdba7f5235cda75a9aa2c1d
SHA1 1061d23fb9082771cde40b7d9c71f08953a6a185
SHA512 387b73780a103f8583baf80c2258c0c56e41d94e4abfdb1b46055bd3cd7f5cb1888ebdd5104bfcf01030391b9064d4f754d289f198cafa68a75978f5b29f8a34
TLSH
T108D02323F118D21106C105E0E1E172BD57D4F1355754CCD94C16D2286359501BCC8D7C
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.V8tEQ4ygVd/gpg.1.sh
Size 71B
SHA256 11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d
MD5 4a502d34c9274bf20ac5781ec24f97d5
SHA1 524c16347caa1e4e4c89fe3a397248a4059be41c
SHA512 93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf
TLSH
T115A022F38083223F003C80200A302320A28F02E030F0C02CC38A800230203822AB0088
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.WqglGJehem/gpg.1.sh
Size 82B
SHA256 04bd4f2c3b27c39d0e7da3a8ed1268f9d97e49bee0ce104b33afdc5af6cb79d0
MD5 af2dbe1d07f23e21eda58ba2f6b6739a
SHA1 0d2fc797d4ddeefbe7f73bbd29363cca6c417403
SHA512 77e845e64bf3530ec282ce0d85e8b8564fbad9788dc55235fb7c5aaa3770ef1d0dabf01f4ce42bf4f8917f61aaa5b43ba5a8fb31b42bf43181e4e8ac0bd10328
TLSH
T160A01211144300271918C444197007A0690F016014E18004F1C440272221349177A050
MD5 SHA1 SHA512 TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg
Size 7KB
SHA256 6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93
MD5 b53e6ca4ed295fc38621315853f623d0
SHA1 45a416f014809735ec88854a3540c8e9e89eb102
SHA512 30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac
SSDEEP 192:EKgnTWoCNdK1jKp1uUnMV/RFGxUqe8UFTHkfDBuw:EgjNdyjK7uUM1RFGxX2THkftn
TLSH
T154F1CF565B639F17AE63F83DE43904B8B7629EF6CD7A57C0F2A0318A8BC5654F024001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg
Size 15KB
SHA256 389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248
MD5 2713b38b3d7345961d8b80f4463483b8
SHA1 e6ec76aaebfea6a82f7984b57e07522a20365201
SHA512 ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsj:EgDymRZxXkHCtjTk5udNj
TLSH
T14D72D0A797137F5B2A3BF43C607665BCBA269DF9C9B88ED0F300318B0949144E23C525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg
Size 18KB
SHA256 42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f
MD5 760d3ab91f417958475b9a6342a5b92e
SHA1 137a06aea4b5c9e9ca11f0f5f1225da1c275c334
SHA512 6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxG4:EgDymRZxXkHCtjTk5udNvvCxG4
TLSH
T15C82D0A69B137F5B193BF47D707656B8BD278CF9C5F88E91E340348B0A4A114E13C52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg
Size 23KB
SHA256 de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca
MD5 d63fbab9dfb826d53f7b3aaea45dbfb5
SHA1 59841d8e5423f788292af76d4350a948f4e25f53
SHA512 20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxGiPx/xZaURhky:EgDymRZxXkHCtjTk5udNvvCxGiPxyy
TLSH
T1A7B2D0A693236F4BAD77F47EB46AE178ED139CF8C5E51FC2E280718B094A2849138516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.WqglGJehem/pubring.gpg
Size 47KB
SHA256 eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391
MD5 a4dc094481f22304cab5550218e6e4de
SHA1 f5886a324c0c026d0168656f23d1d898a0e43bd6
SHA512 0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68
SSDEEP 768:EgDymRZxXkHCtjTk5udNvvCxGiPxyiKAHeDC68TAVRNpyTgiv6Mfp2swONe:BFT0HEjbSGiPxhp+DP8TAV1rO12swn
TLSH
T1F323E1E5EB625B9FA923EC3B745B6238AD139DFCC4D52DD1D14571470F49208A028CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.w5tQIr9Kc8/gpg.1.sh
Size 82B
SHA256 f8913ca9ffbba6a7f8c49773988ae36f82ea1ddee88f2f53e13b0996aecbb7a9
MD5 c3735252aac930d8e9cc604949a2fd19
SHA1 ba5e4d5f556e7450a5a6cc838efda856db7ec501
SHA512 8d25e0e2d06f7002895b432468dfd1eeeb5da73a1553fbecdf579d65535c593fc6f936d1bb77ef2992ba9980cc7a5a36df45bef41ecb01d3db54e6851920697e
TLSH
T1A5A01251100301212938C4C054B21BB0681B029111E55005F1805025263034A1A31050
MD5 SHA1 SHA512 TLSH

Submit Download

apt.conf.05UbIi

Path /tmp/apt.conf.05UbIi
Size 7KB
SHA256 90e3fdf5ac93158e52b6d54b9fe6c350d70ff0c73849ad574b1c60af241475de
MD5 be9240ad6f7a7cc6cbcbb0752f46964e
SHA1 246a82ca753045780456d899060929b872612049
SHA512 c1bd90754b5d01bc4a98aa343453d4adcee770e7d5eac827e7ee07e9bc08aa21d21304dd11c0197409fd8d158a0d91911dfbece5263c2ca5ac62dd6d857a9647
SSDEEP 192:kbrhNklBVAQhJibAn4aHzZzQznz+zHzl2J:kJNUibAn4ar2J
TLSH
T146F10325B4C5F5A509D78EB8B8A7C90087B4E4D8EF004A6EDB0E16A871F0C5F579EDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.data.G1sPoB

Path /tmp/apt.data.G1sPoB
Size 56KB
SHA256 ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3
MD5 fd96c8ce5d0ef18d63bbe9ae17bb2659
SHA1 76b284743d95d3546df9d85c09712c830a30f614
SHA512 2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2
SSDEEP 384:Nxz5CUX7PwDBnm8nm8gzxjKwjKmuIQBHlKQd7mMqp9Hp9H2861BL1BjaemWOaw09:Nx5WIQCQyXlrLqbGC/
TLSH
T18C43431827A8277EAE248FEF6FF37561BC2CF121644602D1314DADE403E6317E6A745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.sig.eKwE2p

Path /tmp/apt.sig.eKwE2p
Size 1KB
SHA256 4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230
MD5 70274ce622b0cc437ef7f0caddc9d232
SHA1 124513a3ad2eb5aafa9be0920681e3bb8625979b
SHA512 fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8
TLSH
T1DA31C8C0F86079C16396CDCA731C92695EBA90C334C459305BF216125A682221D5F4B8
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.JNF8wk

Path /tmp/sh-thd.JNF8wk
Size 66B
SHA256 a6a52e8d972ab9e102f1f0740370f30c228e614f296ccfad848c0b25a020ee8d
MD5 b5f05dbb17a2d6c4f20fcc207843f02a
SHA1 f087142f3c686a60b11722e20d847789a3f1fb34
SHA512 aef6e3fdcf34c8f70c29ebd412d96ea4156f6f1ccfa84836663231ad1db85207cf07b65fa5ff2997b2dcd107edebf6375be0ed7ac176d52d84acfa9d613d1b69
TLSH
T1B2A0020E05E570B9DE24AA3F635C5EC542175C398A59183C0FD5206E5E8BA8433DFA91
MD5 SHA1 SHA512 TLSH

Submit Download

archive.debian.org_debian-security_dists_stretch_updates_main_binary-i386_Packages.xz

Path /var/lib/apt/lists/partial/archive.debian.org_debian-security_dists_stretch_updates_main_binary-i386_Packages.xz
Size 763KB
SHA256 80272b17aa82747040ae65e57e546cd0e5b6317614085c8c1042a1363485e46d
MD5 666699106e9b8abfa332637b582b5780
SHA1 9bfad287a5d11ae3920df36e103fe2d1dd66a66a
SHA512 05485ae740a2ef88e159f9038112c70c657fc0a1314e19b78995642428636586232531fc50b0a18b72ec613f62a8e1843369c4ddd56ecad289c9b27a3f540df3
SSDEEP 12288:4IofCwTEh71zOYlEB9QvbgFRCnH4cOHA+jTFUp1AyPziEPlqlrLm9hWOvmiY+AV4:ip4hVc9abURA4zirAy7v0rLlAAVCRFr9
TLSH
T19DF433B5EEF2B9B93B81D407EE44537F6B541AD20088BCC18D9AC579BC416AD28CC7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

archive.debian.org_debian_dists_stretch_main_binary-i386_Packages.xz

Path /var/lib/apt/lists/partial/archive.debian.org_debian_dists_stretch_main_binary-i386_Packages.xz
Size 6.7MB
SHA256 7c546e99ddb4c2e55a631cf0d153e4030e66428f24220f9e5c8235e554b3f700
MD5 b7f602c6f52680f0fef35725b1d61c8c
SHA1 fe2efbec0a926c526076cc3054a1a5abce676d75
SHA512 406abe2b64b274e40795f437897ef45af786cb61ca5a51b889169f0aa74890b9857f903549308226ef8e912e605b0474f0e1e871972c7de1c4191e72e613ee2e
SSDEEP 98304:9TedsoLe84Q+M8R780BINQsNa8AWOUeQh6sNvLycT2VeY5MAq8ilKQ:9ydxe84skINQca+t1FvLb2VeUMAqbcQ
TLSH
T19E6633314BDC30B4C066FBE479BC207AA4B5576C9D9D10957494F2DAD4BEEB07C883A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arch-new

Path /var/lib/dpkg/arch-new
Size 11B
SHA256 87a9abe7a59a5d86b13fcf378d39c5bf1d70a25325a0df2eecf6bb46a43cfb93
MD5 49cb560a9d6f6367a00311cc7f002a98
SHA1 bd8321bfa929df98f5949f8de4ac7a9a273a9123
SHA512 c37fd8d0c84062998336f6933b8c4fc5ed493b210236ca38a2c8a548806ae13806bc39717b23d9ef0bc872bf2a290d4f4db8c77e41c1003fe3828ae2b34d84d3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads