7eb9061a98aae4434e452954ba73a636b80185ea3f19d2089ae01b765a8f8d3f

Analysis

max time kernel
138s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.sh
Size 5KB
Sample260709-ph549aas3n
SHA256 7eb9061a98aae4434e452954ba73a636b80185ea3f19d2089ae01b765a8f8d3f
MD5 f7ecbf9d6fc5348620f6d60d832f419d
SHA1 71744bf89dd93dc4db2217095703353a13161cca
SHA512 47a23c683f71da140a7daeb8237769d22f063753505f0fff568c7277d80c7ed15714ece3b4a02248f147085d44e3ee6de3ecab6d21bcb44528019e8ba1fc0ce6
SSDEEP 96:MqNVkVPoeLFrjfVcj/pxrsJGVsO5Ff7la139TlF1SrHJIe8KGwjemfMTs/WEpYwu:9YDLFU/nrqS7g139TP1SrHJrGwjZMwpu
TLSH
T1C5C1216B7C4955733B1CC3FC5E871010F606012F58689968F4AF51A43F863ADA26FBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
680	sudo

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	https
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpg
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgv

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/self/auxv	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/self/auxv	https
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/auxv	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/auxv	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/auxv	gpg-connect-agent
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/fd	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.Eba55q	apt
File opened for modification	/tmp/fileutl.message.jT7IRU	apt
File opened for modification	/tmp/fileutl.message.o9mprh	apt
File opened for modification	/tmp/fileutl.message.XtwaWL	apt
File opened for modification	/tmp/fileutl.message.Qho2m5	apt
File opened for modification	/tmp/apt.data.wuE6QG	gpgv
File opened for modification	/tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg	touch
File opened for modification	/tmp/apt.conf.2ISWtG	gpgv
File opened for modification	/tmp/apt-key-gpghome.4MV2ndTg0X/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.ldhY2uOHpM/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.conf.F2UZIF	gpgv
File opened for modification	/tmp/apt.sig.wSIMna	gpgv
File opened for modification	/tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.4MV2ndTg0X/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.ldhY2uOHpM/pubring.gpg	touch
File opened for modification	/tmp/fileutl.message.6UZRRu	apt
File opened for modification	/tmp/apt.data.DKrQ3E	gpgv
File opened for modification	/tmp/apt-key-gpghome.ldhY2uOHpM/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.w7h9IE	apt
File opened for modification	/tmp/fileutl.message.mJcEwY	apt
File opened for modification	/tmp/fileutl.message.Zr9LYt	apt
File opened for modification	/tmp/apt-key-gpghome.feHdPNy46z/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.tpbw1f	apt
File opened for modification	/tmp/fileutl.message.oA3H5E	apt
File opened for modification	/tmp/fileutl.message.LRQloT	apt
File opened for modification	/tmp/fileutl.message.fe7BNi	apt
File opened for modification	/tmp/apt.sig.iqBgMb	gpgv
File opened for modification	/tmp/fileutl.message.lQWXeo	apt
File opened for modification	/tmp/apt.conf.n5Rkga	gpgv
File opened for modification	/tmp/apt-key-gpghome.ldhY2uOHpM/pubring.gpg	apt-key

/tmp/install.sh
/tmp/install.sh
1⤵
PID:643

/usr/local/sbin/bash
bash /tmp/install.sh
1⤵
PID:643

/usr/local/bin/bash
bash /tmp/install.sh
1⤵
PID:643

/usr/sbin/bash
bash /tmp/install.sh
1⤵
PID:643

/usr/bin/bash
bash /tmp/install.sh
1⤵
PID:643

/sbin/bash
bash /tmp/install.sh
1⤵
PID:643

/bin/bash
bash /tmp/install.sh
1⤵
PID:643
- /usr/bin/tr
  tr -d v
  2⤵
  PID:660
- /usr/bin/cut
  cut -d. -f1
  2⤵
  PID:661
- /usr/bin/node
  node -v
  2⤵
  PID:659
- /usr/bin/node
  node -v
  2⤵
  PID:675
- /bin/uname
  uname -s
  2⤵
  PID:678
- /usr/bin/sudo
  sudo -E bash -
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:680
- - /bin/bash
    bash -
    3⤵
    PID:681
  - - /bin/date
      date "+%Y-%m-%d %H:%M:%S"
      4⤵
      PID:683
  - - /usr/bin/apt
      apt update -y
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:684
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:685
    - - /usr/lib/apt/methods/http
        
        /usr/lib/apt/methods/http
        5⤵
        
        PID:690
    - - /usr/lib/apt/methods/https
        
        /usr/lib/apt/methods/https
        5⤵
        
        PID:692
    - - /usr/lib/apt/methods/https
        
        /usr/lib/apt/methods/https
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:696
    - - /usr/lib/apt/methods/http
        
        /usr/lib/apt/methods/http
        5⤵
        
        PID:701
    - - /usr/lib/apt/methods/gpgv
        
        /usr/lib/apt/methods/gpgv
        5⤵
        
        PID:736
    - - /usr/lib/apt/methods/gpgv
        
        /usr/lib/apt/methods/gpgv
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:737
      - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.iqBgMb /tmp/apt.data.wuE6QG
        6⤵
        Writes file to tmp directory
        
        PID:739
        
        /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        7⤵
        Reads runtime system information
        
        PID:741
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:742
        
        /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        7⤵
        
        PID:743
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:744
        
        /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        7⤵
        Reads runtime system information
        
        PID:745
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:746
        
        /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        7⤵
        Reads runtime system information
        
        PID:747
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        
        PID:748
        
        /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        7⤵
        Reads runtime system information
        
        PID:750
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        
        PID:751
        
        /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        7⤵
        
        PID:752
        
        /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.feHdPNy46z
        7⤵
        
        PID:753
        
        /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        7⤵
        Reads runtime system information
        
        PID:759
        
        /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        7⤵
        Reads runtime system information
        
        PID:762
        
        /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.feHdPNy46z --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.iqBgMb /tmp/apt.data.wuE6QG
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:765
        
        /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:769
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        8⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:770
        
        /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.feHdPNy46z
        7⤵
        
        PID:773
      - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.wSIMna /tmp/apt.data.DKrQ3E
        6⤵
        Writes file to tmp directory
        
        PID:822
        
        /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        7⤵
        Reads runtime system information
        
        PID:824
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:825
        
        /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        7⤵
        
        PID:826
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        
        PID:827
        
        /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        7⤵
        Reads runtime system information
        
        PID:828
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:829
        
        /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        7⤵
        Reads runtime system information
        
        PID:830
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        
        PID:831
        
        /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        7⤵
        Reads runtime system information
        
        PID:832
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        
        PID:833
        
        /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        7⤵
        
        PID:834
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        
        PID:835
        
        /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        7⤵
        
        PID:837
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        
        PID:838
        
        /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        7⤵
        
        PID:839
        
        /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.4MV2ndTg0X
        7⤵
        
        PID:840
        
        /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.4MV2ndTg0X
        7⤵
        
        PID:841
        
        /bin/rm
        
        rm -f /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg
        7⤵
        
        PID:842
        
        /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg
        7⤵
        Writes file to tmp directory
        
        PID:843
        
        /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        7⤵
        Reads runtime system information
        
        PID:844
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:845
        
        /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        7⤵
        
        PID:846
        
        /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        7⤵
        
        PID:847
        
        /usr/bin/sort
        
        sort
        7⤵
        
        PID:850
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        7⤵
        
        PID:852
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        7⤵
        
        PID:854
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        7⤵
        
        PID:856
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        7⤵
        
        PID:858
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        7⤵
        
        PID:860
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        7⤵
        
        PID:862
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        7⤵
        
        PID:864
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        7⤵
        
        PID:866
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        7⤵
        
        PID:868
        
        /bin/cp
        
        cp -a /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.orig.gpg
        7⤵
        Writes file to tmp directory
        
        PID:869
        
        /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        7⤵
        Reads runtime system information
        
        PID:872
        
        /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        7⤵
        Reads runtime system information
        
        PID:875
        
        /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.4MV2ndTg0X --keyring /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.wSIMna /tmp/apt.data.DKrQ3E
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:876
        
        /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:877
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        8⤵
        Checks CPU configuration
        
        PID:878
        
        /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.4MV2ndTg0X
        7⤵
        
        PID:879
      - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        6⤵
        Writes file to tmp directory
        
        PID:881
        
        /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        7⤵
        Reads runtime system information
        
        PID:883
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:884
        
        /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        7⤵
        
        PID:885
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:886
        
        /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        7⤵
        
        PID:887
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:888
        
        /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        7⤵
        Reads runtime system information
        
        PID:889
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        
        PID:890
        
        /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        7⤵
        
        PID:891
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:892
        
        /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        7⤵
        Reads runtime system information
        
        PID:893
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:894
        
        /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        7⤵
        Reads runtime system information
        
        PID:896
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:897
        
        /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        7⤵
        
        PID:898
        
        /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.ldhY2uOHpM
        7⤵
        
        PID:899
        
        /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.ldhY2uOHpM
        7⤵
        
        PID:900
        
        /bin/rm
        
        rm -f /tmp/apt-key-gpghome.ldhY2uOHpM/pubring.gpg
        7⤵
        
        PID:901
        
        /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.ldhY2uOHpM/pubring.gpg
        7⤵
        Writes file to tmp directory
        
        PID:902
        
        /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        7⤵
        Reads runtime system information
        
        PID:903
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        8⤵
        Reads runtime system information
        
        PID:904
        
        /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        7⤵
        
        PID:905
        
        /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        7⤵
        Reads runtime system information
        
        PID:906
        
        /usr/bin/sort
        
        sort
        7⤵
        
        PID:909
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        7⤵
        
        PID:911
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        7⤵
        
        PID:913
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        7⤵
        
        PID:915
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        7⤵
        
        PID:917
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        7⤵
        
        PID:919
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        7⤵
        
        PID:921
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        7⤵
        
        PID:923
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        7⤵
        
        PID:925
        
        /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        7⤵
        
        PID:927
        
        /bin/cp
        
        cp -a /tmp/apt-key-gpghome.ldhY2uOHpM/pubring.gpg /tmp/apt-key-gpghome.ldhY2uOHpM/pubring.orig.gpg
        7⤵
        Writes file to tmp directory
        
        PID:929
        
        /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        7⤵
        Reads runtime system information
        
        PID:932
        
        /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        7⤵
        
        PID:935
        
        /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.ldhY2uOHpM --keyring /tmp/apt-key-gpghome.ldhY2uOHpM/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:936
        
        /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        7⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:938
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        8⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:939
        
        /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.ldhY2uOHpM
        7⤵
        
        PID:940
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:941
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:942
  - - /usr/bin/apt
      apt install -y apt-transport-https ca-certificates curl gnupg
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:943
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:944
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:945
  - - /bin/mkdir
      mkdir -p /usr/share/keyrings
      4⤵
      PID:946
  - - /bin/rm
      rm -f /usr/share/keyrings/nodesource.gpg
      4⤵
      PID:947
  - - /bin/rm
      rm -f /etc/apt/sources.list.d/nodesource.list
      4⤵
      PID:948
  - - /bin/rm
      rm -f /etc/apt/sources.list.d/nodesource.sources
      4⤵
      PID:951
  - - /usr/bin/curl
      curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key
      4⤵
      Checks CPU configuration
      Reads runtime system information
      PID:952
  - - /usr/bin/gpg
      gpg --dearmor -o /usr/share/keyrings/nodesource.gpg
      4⤵
      Checks CPU configuration
      PID:953
  - - /bin/chmod
      chmod 644 /usr/share/keyrings/nodesource.gpg
      4⤵
      PID:956
  - - /usr/bin/dpkg
      dpkg --print-architecture
      4⤵
      PID:957
  - - /bin/date
      date "+%Y-%m-%d %H:%M:%S"
      4⤵
      PID:958
- /usr/bin/curl
  curl -fsSL https://deb.nodesource.com/setup_22.x
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:679

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gpg.1.sh

Path /tmp/apt-key-gpghome.4MV2ndTg0X/gpg.1.sh
Size 82B
SHA256 019ccb5af0d3002ac56122b36a88ce33fa7ae19c774b59805e7c851a8a979d33
MD5 265d05e243ad8f9ba687cd42de931639
SHA1 f138242a9443b3019fe4c643b4b5159da16d3cd5
SHA512 4684cbdaa36e317116eb8929085aca90cd39fe742b59966a17f6c9d3aebf623a2c22bb77b86e0017256641126300f62e806022876453c44daaf25c62f3748e57
TLSH
T1B3A01297280305311518C450047003F0785B05E010E10014ED80406526203461631090
MD5 SHA1 SHA512 TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg
Size 7KB
SHA256 6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93
MD5 b53e6ca4ed295fc38621315853f623d0
SHA1 45a416f014809735ec88854a3540c8e9e89eb102
SHA512 30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac
SSDEEP 192:EKgnTWoCNdK1jKp1uUnMV/RFGxUqe8UFTHkfDBuw:EgjNdyjK7uUM1RFGxX2THkftn
TLSH
T154F1CF565B639F17AE63F83DE43904B8B7629EF6CD7A57C0F2A0318A8BC5654F024001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg
Size 15KB
SHA256 389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248
MD5 2713b38b3d7345961d8b80f4463483b8
SHA1 e6ec76aaebfea6a82f7984b57e07522a20365201
SHA512 ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsj:EgDymRZxXkHCtjTk5udNj
TLSH
T14D72D0A797137F5B2A3BF43C607665BCBA269DF9C9B88ED0F300318B0949144E23C525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg
Size 18KB
SHA256 42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f
MD5 760d3ab91f417958475b9a6342a5b92e
SHA1 137a06aea4b5c9e9ca11f0f5f1225da1c275c334
SHA512 6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxG4:EgDymRZxXkHCtjTk5udNvvCxG4
TLSH
T15C82D0A69B137F5B193BF47D707656B8BD278CF9C5F88E91E340348B0A4A114E13C52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg
Size 23KB
SHA256 de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca
MD5 d63fbab9dfb826d53f7b3aaea45dbfb5
SHA1 59841d8e5423f788292af76d4350a948f4e25f53
SHA512 20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxGiPx/xZaURhky:EgDymRZxXkHCtjTk5udNvvCxGiPxyy
TLSH
T1A7B2D0A693236F4BAD77F47EB46AE178ED139CF8C5E51FC2E280718B094A2849138516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.4MV2ndTg0X/pubring.gpg
Size 47KB
SHA256 eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391
MD5 a4dc094481f22304cab5550218e6e4de
SHA1 f5886a324c0c026d0168656f23d1d898a0e43bd6
SHA512 0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68
SSDEEP 768:EgDymRZxXkHCtjTk5udNvvCxGiPxyiKAHeDC68TAVRNpyTgiv6Mfp2swONe:BFT0HEjbSGiPxhp+DP8TAV1rO12swn
TLSH
T1F323E1E5EB625B9FA923EC3B745B6238AD139DFCC4D52DD1D14571470F49208A028CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.feHdPNy46z/gpg.1.sh
Size 71B
SHA256 11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d
MD5 4a502d34c9274bf20ac5781ec24f97d5
SHA1 524c16347caa1e4e4c89fe3a397248a4059be41c
SHA512 93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf
TLSH
T115A022F38083223F003C80200A302320A28F02E030F0C02CC38A800230203822AB0088
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.ldhY2uOHpM/gpg.1.sh
Size 82B
SHA256 8250689c0684f9d43c2f833f9cf3d33aadb79f8ac1fef6de12a9fe268110a55a
MD5 4e84f2bfd8cf7495214e15c53e8c8284
SHA1 05711ea8071dc9a70a5251b28059872cd54e683c
SHA512 14762527c14b9e8baaf90901594145b22eb6825c4e2969e204c93a931e27fc8a2e07702f43f614cf0922efd90c58ab8d7e37986fd05486f140de08d87d28e2e0
TLSH
T191A01215104310211528C84405B403B0E80B065010E10005E1C0403622203991672060
MD5 SHA1 SHA512 TLSH

Submit Download

apt.conf.2ISWtG

Path /tmp/apt.conf.2ISWtG
Size 8KB
SHA256 ebe0d5c1091976cadb00709dac4f91c8dc0edccb4d10756b6d31a1e555edd35a
MD5 28cfe3a4cc4253b86a4654af78dacf99
SHA1 aecd3a9c40801a02076fa0d6bfa28d8d227e0dd9
SHA512 e4c9bffa2b3d8d23491dbdc9ed410a02f1f35695d3165847b2e450baa88ea19035c933456f8d0b4634239972972af05629591ff794dd92e94f8a5e01cccc81e7
SSDEEP 12:hE+WeZ+Z++esZ+n8RKRDxnvEAEctcuHXb:hGfgsa8EXnntTL
TLSH
T18302EC3081E98E33DE2599B4FB8B495527C2E190FD07E7A9905B100143991AD6E6CBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.data.wuE6QG

Path /tmp/apt.data.wuE6QG
Size 11KB
SHA256 29bd4ef1f6975d6977e8003f62fca96245e3a30abf451711032fb9fee0c2c1a9
MD5 aa63a6250cbd7311d5f6006f0b5d0c54
SHA1 07fd8fd8569e99b869afd7d51877e2dcabe02f5a
SHA512 6f633d88ab204542e72fdc2a824c0a78c06f27afc453307a0ebb9923ed4fd2099bc12a9f6aaf263965a90cf9fdfa42c66e7d3357f8e78620caf2a9691f9c388c
SSDEEP 192:oQc0bMcsXPNbHlD/RdDDjXP1WlDHbxShjDLm3/maJwqGZl9DAYPu:oNbHlApmmgq
TLSH
T19832745C06A41D3BDE4FCF3FBB763441AD2EF4502A8448E5729CD9A707AA306A9D344E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.sig.iqBgMb

Path /tmp/apt.sig.iqBgMb
Size 488B
SHA256 901236f44867e14fe79e8ef9df0af57571fdfeca89f2bb69958cf0681d5e8d4f
MD5 aa8f34721a96e4788beb441717efb4a2
SHA1 7b8747c770b29953691ea0ee863490e68eb20dbb
SHA512 c9dae908cb7a7140279462a1038358dd69a4122ef4a578b50c1af1b5da6d51abd001cf09241a49e695c7a65e6be68d306f75184262d7498fab25e991fe7c91cd
TLSH
T1F9F00ED27FB418B0876ED0481C970BA0DAB20CB9B1331DF5A661095B3D4B0330E0EC64
MD5 SHA1 SHA512 TLSH

Submit Download

nodesource.gpg

Path /usr/share/keyrings/nodesource.gpg
Size 1KB
SHA256 7a96b125f721c99e07d3f45b279adbd6884ec4f3f06750f6b54df40cfae36836
MD5 6aea1cf1b473410593a4ab95602a9a9f
SHA1 ac312240fe84843ef7680d9962e126b20e9dee94
SHA512 73cc7d55bc2034fe4f0eab0fd7d4891cc8cb009e0b8cdd383e9a0cc3b859e7f6431fc730e05b5efc5aa32b89997929649c975a1394227b330f5f6706b0bfcf4c
TLSH
T1F7210AE2206515BC33EDFB90D6142068811CDF744C706AB851B59886F5C323AE2B1803
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads