ded89e8f521b4ea0e434b548a3a8e49db2d940bd88e47e67e31c259fb1905585

Analysis

max time kernel
149s
max time network
153s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20/10/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swupgrade.sh
Size 16KB
Sample261020-p242asbe76
SHA256 ded89e8f521b4ea0e434b548a3a8e49db2d940bd88e47e67e31c259fb1905585
MD5 512b5964ea644bfa52d269b1e42d1956
SHA1 a9d90889edebaf4af9b1dff25940f9275885229a
SHA512 12554047df8c839a9c3d411235de0fe0ba67bdf527103dd918d937036afa858ea7fa32dd3a861089ee2946cb713d528a40c2d7b06ccd0107101ce9a3694444c3
SSDEEP 192:9CQUE3oAD09c/Mg39lPLLBtUQDAH8eIpOQOxLNMZQpGQu5v58:HT4xa9lP/BmQDQ8OvaQvuRe
TLSH
T19272A6C9744DE7BC1BC970F3B44A1034B57B40862E17BB08B12FA9789F557C469A8E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 10 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
759	sudo
763	sudo
728	sudo
748	sudo
751	sudo
754	sudo
1001	sudo
1008	sudo
742	sudo
756	sudo

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	sudo

Writes file to tmp directory 33 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.1txO6h	apt
File opened for modification	/tmp/apt.sig.gXQ9qZ	gpgv
File opened for modification	/tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.orig.gpg	cp
File opened for modification	/tmp/apt.conf.NOUdeY	gpgv
File opened for modification	/tmp/apt-key-gpghome.JRinsCeyud/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.A0LCSL	apt
File opened for modification	/tmp/fileutl.message.zan2vS	apt
File opened for modification	/tmp/fileutl.message.KuKlIB	apt
File opened for modification	/tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.JRinsCeyud/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.c5HHy9	apt
File opened for modification	/tmp/apt-key-gpghome.PF8HaY3EzY/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.JRinsCeyud/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.JRinsCeyud/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.EQcvMv	apt
File opened for modification	/tmp/fileutl.message.zoLIFx	apt
File opened for modification	/tmp/fileutl.message.dIIIBD	apt
File opened for modification	/tmp/fileutl.message.8KbGPj	apt
File opened for modification	/tmp/fileutl.message.6UJ0oN	apt
File opened for modification	/tmp/apt.data.WTiU6s	gpgv
File opened for modification	/tmp/fileutl.message.DzpenA	apt
File opened for modification	/tmp/fileutl.message.MOaOQK	apt
File opened for modification	/tmp/apt.conf.U2Sehz	gpgv
File opened for modification	/tmp/fileutl.message.pK73SQ	apt
File opened for modification	/tmp/fileutl.message.tLWl2F	apt
File opened for modification	/tmp/fileutl.message.GKZ9DJ	apt
File opened for modification	/tmp/fileutl.message.0NnYzI	apt
File opened for modification	/tmp/fileutl.message.9vmKOa	apt
File opened for modification	/tmp/fileutl.message.OBVBn9	apt
File opened for modification	/tmp/apt-key-gpghome.Nl1Ge1u1Ef/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.s3m9U5	apt
File opened for modification	/tmp/apt.conf.GFIFPS	gpgv

/tmp/swupgrade.sh
/tmp/swupgrade.sh
1⤵
PID:715
- /bin/date
  date
  2⤵
  PID:722
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:726
- /usr/bin/sudo
  sudo systemctl stop cron
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:728
- - /bin/systemctl
    systemctl stop cron
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:735
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:739
- /usr/bin/cut
  cut -d. -f1 /etc/debian_version
  2⤵
  PID:741
- /usr/bin/sudo
  sudo rm -f /etc/apt/sources.list.d/google-chrome.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:742
- - /bin/rm
    rm -f /etc/apt/sources.list.d/google-chrome.list
    3⤵
    PID:745
- /usr/bin/sudo
  sudo sed -i "s|http://ftp.ch.debian.org/debian/|http://archive.debian.org/debian/|g" /etc/apt/sources.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:748
- - /bin/sed
    sed -i "s|http://ftp.ch.debian.org/debian/|http://archive.debian.org/debian/|g" /etc/apt/sources.list
    3⤵
    - Reads runtime system information
    PID:750
- /usr/bin/sudo
  sudo sed -i "s|http://security.debian.org/debian-security|http://archive.debian.org/debian-security|g" /etc/apt/sources.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:751
- - /bin/sed
    sed -i "s|http://security.debian.org/debian-security|http://archive.debian.org/debian-security|g" /etc/apt/sources.list
    3⤵
    - Reads runtime system information
    PID:753
- /usr/bin/sudo
  sudo sed -i "s|^deb\\(.*\\)stretch-\\(backports\\|updates\\).*|# &|" /etc/apt/sources.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:754
- - /bin/sed
    sed -i "s|^deb\\(.*\\)stretch-\\(backports\\|updates\\).*|# &|" /etc/apt/sources.list
    3⤵
    - Reads runtime system information
    PID:755
- /usr/bin/sudo
  sudo sed -i "s|^deb-src\\(.*\\)stretch-\\(backports\\|updates\\).*|# &|" /etc/apt/sources.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:756
- - /bin/sed
    sed -i "s|^deb-src\\(.*\\)stretch-\\(backports\\|updates\\).*|# &|" /etc/apt/sources.list
    3⤵
    - Reads runtime system information
    PID:757
- /usr/bin/sudo
  sudo tee /etc/apt/apt.conf.d/99no-check-valid-until
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:759
- - /usr/bin/tee
    tee /etc/apt/apt.conf.d/99no-check-valid-until
    3⤵
    PID:760
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:762
- /usr/bin/sudo
  sudo apt update
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:763
- - /usr/bin/apt
    apt update
    3⤵
    - Writes file to tmp directory
    PID:765
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:766
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:767
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:768
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      Reads runtime system information
      PID:769
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:770
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      PID:771
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      Writes file to tmp directory
      PID:773
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.gXQ9qZ /tmp/apt.data.WTiU6s
        5⤵
        Writes file to tmp directory
        
        PID:775
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:777
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:778
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:779
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:780
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:781
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:782
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:783
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:784
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:785
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:786
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        
        PID:787
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:788
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:790
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:791
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:792
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.Nl1Ge1u1Ef
        6⤵
        
        PID:793
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.Nl1Ge1u1Ef
        6⤵
        
        PID:794
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg
        6⤵
        
        PID:795
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:796
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:797
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:798
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:799
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        Reads runtime system information
        
        PID:800
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:803
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:805
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:807
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:809
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:811
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:813
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:815
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:817
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:819
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:821
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.orig.gpg
        6⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:822
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:825
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:828
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.Nl1Ge1u1Ef --keyring /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.gXQ9qZ /tmp/apt.data.WTiU6s
        6⤵
        
        PID:829
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        
        PID:833
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:834
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.Nl1Ge1u1Ef
        6⤵
        
        PID:835
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Writes file to tmp directory
        
        PID:837
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:839
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:840
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:841
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:842
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        Reads runtime system information
        
        PID:843
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:844
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:845
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:846
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:847
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:848
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:849
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:850
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:852
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:853
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:854
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.JRinsCeyud
        6⤵
        
        PID:855
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.JRinsCeyud
        6⤵
        
        PID:856
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.JRinsCeyud/pubring.gpg
        6⤵
        
        PID:857
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.JRinsCeyud/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:858
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:859
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:860
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:861
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        Reads runtime system information
        
        PID:862
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:865
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:867
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:869
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:871
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:873
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:875
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:877
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:879
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:881
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:883
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.JRinsCeyud/pubring.gpg /tmp/apt-key-gpghome.JRinsCeyud/pubring.orig.gpg
        6⤵
        Writes file to tmp directory
        
        PID:884
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:887
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:890
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.JRinsCeyud --keyring /tmp/apt-key-gpghome.JRinsCeyud/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        6⤵
        Reads runtime system information
        
        PID:891
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:892
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Reads runtime system information
        
        PID:893
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.JRinsCeyud
        6⤵
        
        PID:894
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 "/var/lib/apt/lists/partial/deb.nodesource.com_node%5f16.x_dists_nodistro_Release.gpg" "/var/lib/apt/lists/partial/deb.nodesource.com_node%5f16.x_dists_nodistro_Release"
        5⤵
        Writes file to tmp directory
        
        PID:896
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:898
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:899
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:900
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:901
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:902
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:903
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:904
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:905
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:907
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:908
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:909
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.PF8HaY3EzY
        6⤵
        
        PID:910
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:914
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:917
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.PF8HaY3EzY --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 "/var/lib/apt/lists/partial/deb.nodesource.com_node%5f16.x_dists_nodistro_Release.gpg" "/var/lib/apt/lists/partial/deb.nodesource.com_node%5f16.x_dists_nodistro_Release"
        6⤵
        
        PID:919
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:920
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Reads runtime system information
        
        PID:921
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.PF8HaY3EzY
        6⤵
        
        PID:922
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:923
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:988
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:764
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:1002
- /usr/bin/sudo
  sudo apt -y upgrade
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1001
- - /usr/bin/apt
    apt -y upgrade
    3⤵
    - Writes file to tmp directory
    PID:1003
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1004
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1005
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:1007
- /usr/bin/sudo
  sudo apt -y install jq autossh
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1008
- - /usr/bin/apt
    apt -y install jq autossh
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1010
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1011
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1012
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1013
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1014
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:1009

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

99no-check-valid-until

Path /etc/apt/apt.conf.d/99no-check-valid-until
Size 36B
SHA256 92dd8add3f0093b490c4d4c57f6a2bc7afc1a7519b078b8034db2df5add7f458
MD5 66734cb974e1e3b01faf9feccdbabf96
SHA1 3e0b86a333fdeded8afc15f833e604df7521eff5
SHA512 12832aed717f85298883ccb037933655e3dda62916f6eab0ca80b98650192e66cf1e59eabb55ab76e52c237635f9005f8695a40e06bb602943c78bf0a6fb1e81
MD5 SHA1 SHA512

Submit Download

sedP9qDbt

Path /etc/apt/sedP9qDbt
Size 296B
SHA256 26680c0b7758ab07e871f9bc13cb5ac3f8e486ceb227007345432ea1ad6113ab
MD5 4293fe06fec8af0c1ae737eead165125
SHA1 fdf6a9b78630d9f7baebf5d3b6874a6e8215043c
SHA512 519f05d1edfe58ac750e03fcd09dd56e8fdf326c2ea4bf82dd511287288d116e7fafc1799f0b6415b99a1fb4e505374c8a04e7ea46e3d77015bcc7931e6cd179
TLSH
T1DDE042FD974B63C5ED42C64A7BA1D800C2274AD129C0E1D09EB04A328F44D1A7A211C8
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.JRinsCeyud/gpg.1.sh
Size 82B
SHA256 26233bbf39ef396b5c78fa5d88e8930e926d9c25a2a28603d7445c8e52ea736c
MD5 148d5f687870aad5341e19aa14289212
SHA1 7417d595d4638280fb3274149b1b55b2f86e5f62
SHA512 1730bab7fd8ad2680314948f112114279608f63cfe095167216e46b11f058a7d19c79f3c78c973b4909688d78105dc084915ab70cfbe8ab27dcc26002abdda13
TLSH
T159A01212100310221918D84055B003A0644B029010F11008E180612567243DA1A31050
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.Nl1Ge1u1Ef/gpg.1.sh
Size 82B
SHA256 72a6cadb65b826fbaea02b1e8d6fa54911d6eefe5510e74be0b9aa1228fc451b
MD5 fe21de101512dcce310ef2876d34fe1e
SHA1 c8ffdfd294e0de99736c16833a3ee10996fb7b03
SHA512 d2840a22261f2013b4be5a008d7ccba2c929eed686d1eef0deb1098206945a7da87199fd712deea08e0e78c32c4e948615d38ed0590ed9775718bed49d13b3bb
TLSH
T1AFA0241110C30031151CD4C0047173F0F40F015030F1130CF1C4403D33343451771170
MD5 SHA1 SHA512 TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg
Size 7KB
SHA256 6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93
MD5 b53e6ca4ed295fc38621315853f623d0
SHA1 45a416f014809735ec88854a3540c8e9e89eb102
SHA512 30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac
SSDEEP 192:EKgnTWoCNdK1jKp1uUnMV/RFGxUqe8UFTHkfDBuw:EgjNdyjK7uUM1RFGxX2THkftn
TLSH
T154F1CF565B639F17AE63F83DE43904B8B7629EF6CD7A57C0F2A0318A8BC5654F024001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg
Size 15KB
SHA256 389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248
MD5 2713b38b3d7345961d8b80f4463483b8
SHA1 e6ec76aaebfea6a82f7984b57e07522a20365201
SHA512 ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsj:EgDymRZxXkHCtjTk5udNj
TLSH
T14D72D0A797137F5B2A3BF43C607665BCBA269DF9C9B88ED0F300318B0949144E23C525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg
Size 18KB
SHA256 42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f
MD5 760d3ab91f417958475b9a6342a5b92e
SHA1 137a06aea4b5c9e9ca11f0f5f1225da1c275c334
SHA512 6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxG4:EgDymRZxXkHCtjTk5udNvvCxG4
TLSH
T15C82D0A69B137F5B193BF47D707656B8BD278CF9C5F88E91E340348B0A4A114E13C52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg
Size 23KB
SHA256 de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca
MD5 d63fbab9dfb826d53f7b3aaea45dbfb5
SHA1 59841d8e5423f788292af76d4350a948f4e25f53
SHA512 20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxGiPx/xZaURhky:EgDymRZxXkHCtjTk5udNvvCxGiPxyy
TLSH
T1A7B2D0A693236F4BAD77F47EB46AE178ED139CF8C5E51FC2E280718B094A2849138516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.Nl1Ge1u1Ef/pubring.gpg
Size 47KB
SHA256 eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391
MD5 a4dc094481f22304cab5550218e6e4de
SHA1 f5886a324c0c026d0168656f23d1d898a0e43bd6
SHA512 0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68
SSDEEP 768:EgDymRZxXkHCtjTk5udNvvCxGiPxyiKAHeDC68TAVRNpyTgiv6Mfp2swONe:BFT0HEjbSGiPxhp+DP8TAV1rO12swn
TLSH
T1F323E1E5EB625B9FA923EC3B745B6238AD139DFCC4D52DD1D14571470F49208A028CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.PF8HaY3EzY/gpg.1.sh
Size 71B
SHA256 11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d
MD5 4a502d34c9274bf20ac5781ec24f97d5
SHA1 524c16347caa1e4e4c89fe3a397248a4059be41c
SHA512 93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf
TLSH
T115A022F38083223F003C80200A302320A28F02E030F0C02CC38A800230203822AB0088
MD5 SHA1 SHA512 TLSH

Submit Download

apt.conf.U2Sehz

Path /tmp/apt.conf.U2Sehz
Size 7KB
SHA256 72aab9bddaa6aac775df070c28b451b47db4bd3be78abb01ade21cd4ffd46876
MD5 a2b5a8566bd19f103957f26a4ad2a2ce
SHA1 ba7f294315fc35d36a9c8fa21cdf86db4766054c
SHA512 68381fe8a7219ab643bd95951f9c56f0096ff371372e2e0aeb0d8eeb6279747c843f9562b063fbcf81370b50504ca7353df537f3e016bbad9426df8d37742f78
SSDEEP 192:JsG+fDLRBVAQhWibAn4aHzZzQznz+zHzl2S:JVe2ibAn4ar2S
TLSH
T148F10D65B4D5E2A006E74EB8B9D7C5008BB4E4D8EF010A6ED70B09A861F0C5E57DEDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.data.WTiU6s

Path /tmp/apt.data.WTiU6s
Size 56KB
SHA256 ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3
MD5 fd96c8ce5d0ef18d63bbe9ae17bb2659
SHA1 76b284743d95d3546df9d85c09712c830a30f614
SHA512 2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2
SSDEEP 384:Nxz5CUX7PwDBnm8nm8gzxjKwjKmuIQBHlKQd7mMqp9Hp9H2861BL1BjaemWOaw09:Nx5WIQCQyXlrLqbGC/
TLSH
T18C43431827A8277EAE248FEF6FF37561BC2CF121644602D1314DADE403E6317E6A745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.sig.gXQ9qZ

Path /tmp/apt.sig.gXQ9qZ
Size 1KB
SHA256 4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230
MD5 70274ce622b0cc437ef7f0caddc9d232
SHA1 124513a3ad2eb5aafa9be0920681e3bb8625979b
SHA512 fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8
TLSH
T1DA31C8C0F86079C16396CDCA731C92695EBA90C334C459305BF216125A682221D5F4B8
MD5 SHA1 SHA512 TLSH

Submit Download

autossh_1.4e-3_mips.deb

Path /var/cache/apt/archives/partial/autossh_1.4e-3_mips.deb
Size 32KB
SHA256 fdd2d0527df0120d11a969ab6f668e8d02eee93c1b40999ae52bdab229f450b3
MD5 508a12d808fba0401599435077d6650a
SHA1 4763690d21fbd387a874af5337795155964c3029
SHA512 b4e293b652cef36b32418daa42e9144364b754cb2e196aabd78f0e3b15f6fb41ca92752f8f8be072f8e16f170bcda54c925d846d9a5c94657f19a7cf2b8e7309
SSDEEP 768:SFTOjN/E7LWEgSo9upM3N05G3Emr283pN52aQQSw2wze:pjq7Ljg19um+GZyc2aQhwze
TLSH
T199E2F1F53F5B237F3CA1842EEB21C8FA4743A6409999E3C5F0E7047AD45A089A69C182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgcache.bin.8kIeAK

Path /var/cache/apt/pkgcache.bin.8kIeAK
Size 248B
SHA256 cbd680af103591a2478c4e0555c017eea5684d89ce4658f611494cb3982bc12d
MD5 484221c4548a02f25c2277313c5076c4
SHA1 69b0b5627c57283367ac578472a221fcf4e95ced
SHA512 8eeb928cba0efc529981867f567c18eafc80473c042828b04e8a6d6a4dd3a81afd507b9b6d9fbad780fe068a7980363debfaf4594fb8c605d89a51437945eb2e
TLSH
T18ED0801FC135F250C556C7F8455CF355F6004458D507859707716A150501957FD38511
MD5 SHA1 SHA512 TLSH

Submit Download

srcpkgcache.bin.PX9eW3

Path /var/cache/apt/srcpkgcache.bin.PX9eW3
Size 248B
SHA256 80e08a180a66aee69efcc575f134026e26569badf9efc739fc8e5d9d6f1a3af7
MD5 db8c9a3921aa119cf4f60311897d91da
SHA1 99b3e3f1dcacd8d1bb42a15b02711cae91d51644
SHA512 f9d1dc17c1a48700e69ab50cb2991bceb2d140c6d38114615833d03cca608b8e492106e7d966065145ba435077c07b435b94212e837ad6abf5693d40e6341fe7
TLSH
T11BD0C02FD031B0A0C002C7F24908F301E00008188403858302326604110115B7F38501
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads