c89729063aef253c8b20ee42cfebdd98dc76158fbc94275a5545bea477660408

Analysis

max time kernel
12s
max time network
25s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21/08/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedWing-Panel-main/install-linux.sh
Size 12KB
Sample260821-dg65da1gla
SHA256 c89729063aef253c8b20ee42cfebdd98dc76158fbc94275a5545bea477660408
MD5 80eb50beaab76144a3c7fd1b388bd49c
SHA1 72213457a9f54454de974fdd41b23dd3a8e00d1e
SHA512 91fde411d176f8e00536cb4db9122c36abbb724a584f1307d1066d8521749f562ba8d9e1fc958ddacdace93ca120767d1d820411d2287ebec427ad98aac8e46c
SSDEEP 192:1lxslOlUZRiWfF19MAtd2e3O5PTf95ymuaGcvodIf+f+wFoZ:CVh2eqf95yGGcvoddfwZ
TLSH
T12E523FB9A45477743508C41D86B1E8483B8331EF3A39512AB0FDB09A3FFC59C97699B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

antivm discovery execution

Malware Config

Signatures

Checks CPU configuration 1 TTPs 10 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpgconf
File opened for reading	/proc/cpuinfo	https
File opened for reading	/proc/cpuinfo	gpgv
File opened for reading	/proc/cpuinfo	gpg-connect-agent
File opened for reading	/proc/cpuinfo	gpgconf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/auxv	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/auxv	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/auxv	gpgconf
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/auxv	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/self/auxv	https
File opened for reading	/proc/self/fd	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/self/auxv	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
916	apt-get

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/apt.conf.ErBsy5	gpgv
File opened for modification	/tmp/apt-key-gpghome.jFSnmBEpWR/pubring.gpg	touch
File opened for modification	/tmp/apt.conf.ekJw7a	gpgv
File opened for modification	/tmp/apt.data.4GTZab	gpgv
File opened for modification	/tmp/fileutl.message.0YTwF6	apt-get
File opened for modification	/tmp/fileutl.message.APvE2Y	apt-get
File opened for modification	/tmp/fileutl.message.4KWsPZ	apt-get
File opened for modification	/tmp/fileutl.message.70x7W3	apt-get
File opened for modification	/tmp/fileutl.message.4php5Z	apt-get
File opened for modification	/tmp/apt.sig.AHY8l4	gpgv
File opened for modification	/tmp/fileutl.message.tzTPmf	apt-get
File opened for modification	/tmp/fileutl.message.Bzj7tU	apt-get
File opened for modification	/tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.5sYxWS	apt-get
File opened for modification	/tmp/apt.data.cBhm22	gpgv
File opened for modification	/tmp/apt-key-gpghome.5uQfsr6NTM/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.jFSnmBEpWR/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.jFSnmBEpWR/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.GaYKk1	apt-get
File opened for modification	/tmp/fileutl.message.iQG7mS	apt-get
File opened for modification	/tmp/apt-key-gpghome.jFSnmBEpWR/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.pADJE0	apt-get
File opened for modification	/tmp/apt.conf.bIxPsa	gpgv
File opened for modification	/tmp/fileutl.message.ny6xBJ	apt-get
File opened for modification	/tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg	touch
File opened for modification	/tmp/apt.sig.oZ2fab	gpgv
File opened for modification	/tmp/apt-key-gpghome.HBPruIeaZV/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.5uQfsr6NTM/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.49NDW4	apt-get
File opened for modification	/tmp/fileutl.message.YknH79	apt-get

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
754	apt-get
916	apt-get

/tmp/RedWing-Panel-main/install-linux.sh
/tmp/RedWing-Panel-main/install-linux.sh
1⤵
PID:750
- /usr/bin/dirname
  dirname /tmp/RedWing-Panel-main/install-linux.sh
  2⤵
  PID:753
- /usr/bin/apt-get
  apt-get update -qq
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:754
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:755
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:756
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:760
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:761
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:762
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:764
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:765
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.AHY8l4 /tmp/apt.data.cBhm22
      4⤵
      Writes file to tmp directory
      PID:767
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:769
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:770
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:771
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:772
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:773
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:774
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:775
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:776
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:777
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:778
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:779
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:780
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:782
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:783
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:784
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.5uQfsr6NTM
        5⤵
        
        PID:785
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.5uQfsr6NTM
        5⤵
        
        PID:786
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg
        5⤵
        
        PID:787
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:788
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:789
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:790
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:791
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        Reads runtime system information
        
        PID:792
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:795
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:797
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:799
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:801
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:803
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:805
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:807
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:809
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:811
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:813
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:814
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:817
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:820
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.5uQfsr6NTM --keyring /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.AHY8l4 /tmp/apt.data.cBhm22
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:821
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:822
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        
        PID:823
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.5uQfsr6NTM
        5⤵
        
        PID:824
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      Writes file to tmp directory
      PID:826
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:828
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:829
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:830
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:831
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:832
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:833
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:834
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:835
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        Reads runtime system information
        
        PID:836
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:837
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:838
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:840
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:842
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:843
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:845
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.jFSnmBEpWR
        5⤵
        
        PID:846
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.jFSnmBEpWR
        5⤵
        
        PID:847
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.jFSnmBEpWR/pubring.gpg
        5⤵
        
        PID:848
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.jFSnmBEpWR/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:849
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:850
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:851
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:852
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:853
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:856
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:858
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:860
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:862
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:864
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:866
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:868
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:870
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:872
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:874
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.jFSnmBEpWR/pubring.gpg /tmp/apt-key-gpghome.jFSnmBEpWR/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:875
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:878
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:881
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.jFSnmBEpWR --keyring /tmp/apt-key-gpghome.jFSnmBEpWR/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:882
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:883
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:884
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.jFSnmBEpWR
        5⤵
        
        PID:885
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.oZ2fab /tmp/apt.data.4GTZab
      4⤵
      Writes file to tmp directory
      PID:887
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        Reads runtime system information
        
        PID:889
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:890
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:891
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:892
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:893
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:894
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:895
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:896
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:898
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:899
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:900
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.HBPruIeaZV
        5⤵
        
        PID:901
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:905
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:908
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.HBPruIeaZV --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.oZ2fab /tmp/apt.data.4GTZab
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:910
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:911
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Checks CPU configuration
        Reads runtime system information
        
        PID:912
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.HBPruIeaZV
        5⤵
        
        PID:913
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:914
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:915
- /usr/bin/apt-get
  apt-get install -y -qq openjdk-17-jre-headless curl unzip
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:916
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:917
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:918

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gpg.1.sh

Path /tmp/apt-key-gpghome.5uQfsr6NTM/gpg.1.sh
Size 82B
SHA256 4743d36a8f4ef6ccf689e3dc38352a43976b28a924039fa099a62216e863f1f8
MD5 2c44813ba78a75f275d1b737343f61da
SHA1 f2fb4a67254d78390cae1b2f0d85aa13c7e278bb
SHA512 c1250322624d50aa89fdaf5209a9e94d81990bd908ca5fd03be0a66ac81593923458a36f40d695aa472ebd26a4f261941d5b13f21b38ffb9f3d3e28213222331
TLSH
T12EA01211290304222A68C4540C7403B0781B055011E24008E1D04429626038A1A35051
MD5 SHA1 SHA512 TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg
Size 15KB
SHA256 389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248
MD5 2713b38b3d7345961d8b80f4463483b8
SHA1 e6ec76aaebfea6a82f7984b57e07522a20365201
SHA512 ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsj:EgDymRZxXkHCtjTk5udNj
TLSH
T14D72D0A797137F5B2A3BF43C607665BCBA269DF9C9B88ED0F300318B0949144E23C525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg
Size 18KB
SHA256 42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f
MD5 760d3ab91f417958475b9a6342a5b92e
SHA1 137a06aea4b5c9e9ca11f0f5f1225da1c275c334
SHA512 6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxG4:EgDymRZxXkHCtjTk5udNvvCxG4
TLSH
T15C82D0A69B137F5B193BF47D707656B8BD278CF9C5F88E91E340348B0A4A114E13C52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg
Size 23KB
SHA256 de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca
MD5 d63fbab9dfb826d53f7b3aaea45dbfb5
SHA1 59841d8e5423f788292af76d4350a948f4e25f53
SHA512 20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxGiPx/xZaURhky:EgDymRZxXkHCtjTk5udNvvCxGiPxyy
TLSH
T1A7B2D0A693236F4BAD77F47EB46AE178ED139CF8C5E51FC2E280718B094A2849138516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg
Size 47KB
SHA256 eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391
MD5 a4dc094481f22304cab5550218e6e4de
SHA1 f5886a324c0c026d0168656f23d1d898a0e43bd6
SHA512 0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68
SSDEEP 768:EgDymRZxXkHCtjTk5udNvvCxGiPxyiKAHeDC68TAVRNpyTgiv6Mfp2swONe:BFT0HEjbSGiPxhp+DP8TAV1rO12swn
TLSH
T1F323E1E5EB625B9FA923EC3B745B6238AD139DFCC4D52DD1D14571470F49208A028CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.5uQfsr6NTM/pubring.gpg
Size 7KB
SHA256 6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93
MD5 b53e6ca4ed295fc38621315853f623d0
SHA1 45a416f014809735ec88854a3540c8e9e89eb102
SHA512 30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac
SSDEEP 192:EKgnTWoCNdK1jKp1uUnMV/RFGxUqe8UFTHkfDBuw:EgjNdyjK7uUM1RFGxX2THkftn
TLSH
T154F1CF565B639F17AE63F83DE43904B8B7629EF6CD7A57C0F2A0318A8BC5654F024001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.HBPruIeaZV/gpg.1.sh
Size 71B
SHA256 11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d
MD5 4a502d34c9274bf20ac5781ec24f97d5
SHA1 524c16347caa1e4e4c89fe3a397248a4059be41c
SHA512 93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf
TLSH
T115A022F38083223F003C80200A302320A28F02E030F0C02CC38A800230203822AB0088
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.jFSnmBEpWR/gpg.1.sh
Size 82B
SHA256 b388f9687e6a2e4495696bea5a083f742b42a1034fb89326419889a5c2d7d064
MD5 5ca1bdffd459d4c3215f88219b1ecaf8
SHA1 7533ec197e2897e7bbcc73e5ae1c30a2cdfbf651
SHA512 ee7160c76a0f98036170e92317573291d5b552a824a1a18fae95f0e3faf6fdaab8b79021dccf7d82f6ff5cb4ae2046dcd0819aa567f9882bc040da7e3ace7621
TLSH
T1F6A01215120310211A1CC844187007B0640B029010F90008F78448353A213851771050
MD5 SHA1 SHA512 TLSH

Submit Download

apt.conf.ErBsy5

Path /tmp/apt.conf.ErBsy5
Size 8KB
SHA256 6b5d57b09c275e1d71ff858b8bfe7ba412d0ca2962a1aba379ced7ecf1163373
MD5 cfb2750a940a3a9852dcde6553096a8d
SHA1 1927a01aace77fa825807543983c24d5eecd3db8
SHA512 c6f420c177baeb53acd28f03abb44534e1397f4e7bf7828345d7a9e4bd16adaed8d58fbdedc5b72b745bd67848729e0bec58c868c02ecc49230f4fb3d934741b
SSDEEP 3:cpbffi8RkQQm5:CFRkQz
TLSH
T10302020110A54B55D0B044B168048034388186514A7845698D6565944350570192579D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.data.cBhm22

Path /tmp/apt.data.cBhm22
Size 56KB
SHA256 ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3
MD5 fd96c8ce5d0ef18d63bbe9ae17bb2659
SHA1 76b284743d95d3546df9d85c09712c830a30f614
SHA512 2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2
SSDEEP 384:Nxz5CUX7PwDBnm8nm8gzxjKwjKmuIQBHlKQd7mMqp9Hp9H2861BL1BjaemWOaw09:Nx5WIQCQyXlrLqbGC/
TLSH
T18C43431827A8277EAE248FEF6FF37561BC2CF121644602D1314DADE403E6317E6A745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.sig.AHY8l4

Path /tmp/apt.sig.AHY8l4
Size 1KB
SHA256 4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230
MD5 70274ce622b0cc437ef7f0caddc9d232
SHA1 124513a3ad2eb5aafa9be0920681e3bb8625979b
SHA512 fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8
TLSH
T1DA31C8C0F86079C16396CDCA731C92695EBA90C334C459305BF216125A682221D5F4B8
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads