ded89e8f521b4ea0e434b548a3a8e49db2d940bd88e47e67e31c259fb1905585

Analysis

max time kernel
123s
max time network
67s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/10/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swupgrade.sh
Size 16KB
Sample261020-p242asbe76
SHA256 ded89e8f521b4ea0e434b548a3a8e49db2d940bd88e47e67e31c259fb1905585
MD5 512b5964ea644bfa52d269b1e42d1956
SHA1 a9d90889edebaf4af9b1dff25940f9275885229a
SHA512 12554047df8c839a9c3d411235de0fe0ba67bdf527103dd918d937036afa858ea7fa32dd3a861089ee2946cb713d528a40c2d7b06ccd0107101ce9a3694444c3
SSDEEP 192:9CQUE3oAD09c/Mg39lPLLBtUQDAH8eIpOQOxLNMZQpGQu5v58:HT4xa9lP/BmQDQ8OvaQvuRe
TLSH
T19272A6C9744DE7BC1BC970F3B44A1034B57B40862E17BB08B12FA9789F557C469A8E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 10 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
755	sudo
765	sudo
1005	sudo
1012	sudo
743	sudo
752	sudo
758	sudo
761	sudo
727	sudo
747	sudo

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/sys/crypto/fips_enabled	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/stat	sudo

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.KDAh7e	apt
File opened for modification	/tmp/apt.sig.60X1Mr	gpgv
File opened for modification	/tmp/apt.data.lz5DrF	gpgv
File opened for modification	/tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg	touch
File opened for modification	/tmp/apt.conf.KJdPNX	gpgv
File opened for modification	/tmp/fileutl.message.9CMZGF	apt
File opened for modification	/tmp/fileutl.message.Ymp595	apt
File opened for modification	/tmp/apt.conf.oGJO5e	gpgv
File opened for modification	/tmp/apt.sig.8cFYwN	gpgv
File opened for modification	/tmp/apt-key-gpghome.rFkODnsGOT/pubring.gpg	touch
File opened for modification	/tmp/fileutl.message.g7uWE3	apt
File opened for modification	/tmp/fileutl.message.1teQC3	apt
File opened for modification	/tmp/apt.conf.PJZjTh	gpgv
File opened for modification	/tmp/apt-key-gpghome.TlfI0gmlzp/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.OTzacjKtqR/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.LOJED9	apt
File opened for modification	/tmp/fileutl.message.3N9vHz	apt
File opened for modification	/tmp/apt-key-gpghome.rFkODnsGOT/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.Idh8dx	apt
File opened for modification	/tmp/fileutl.message.nH2Gfd	apt
File opened for modification	/tmp/apt-key-gpghome.rFkODnsGOT/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.oKZf4m	apt
File opened for modification	/tmp/fileutl.message.OIyST5	apt
File opened for modification	/tmp/apt-key-gpghome.rFkODnsGOT/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.lI647K	apt
File opened for modification	/tmp/fileutl.message.0psSyf	apt
File opened for modification	/tmp/fileutl.message.uukQXG	apt
File opened for modification	/tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.TlfI0gmlzp/pubring.orig.gpg	cp
File opened for modification	/tmp/apt.data.2yE1gD	gpgv

/tmp/swupgrade.sh
/tmp/swupgrade.sh
1⤵
PID:714
- /bin/date
  date
  2⤵
  PID:721
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:725
- /usr/bin/sudo
  sudo systemctl stop cron
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:727
- - /bin/systemctl
    systemctl stop cron
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:734
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:740
- /usr/bin/cut
  cut -d. -f1 /etc/debian_version
  2⤵
  PID:742
- /usr/bin/sudo
  sudo rm -f /etc/apt/sources.list.d/google-chrome.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:743
- - /bin/rm
    rm -f /etc/apt/sources.list.d/google-chrome.list
    3⤵
    PID:746
- /usr/bin/sudo
  sudo sed -i "s|http://ftp.ch.debian.org/debian/|http://archive.debian.org/debian/|g" /etc/apt/sources.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:747
- - /bin/sed
    sed -i "s|http://ftp.ch.debian.org/debian/|http://archive.debian.org/debian/|g" /etc/apt/sources.list
    3⤵
    - Reads runtime system information
    PID:751
- /usr/bin/sudo
  sudo sed -i "s|http://security.debian.org/debian-security|http://archive.debian.org/debian-security|g" /etc/apt/sources.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:752
- - /bin/sed
    sed -i "s|http://security.debian.org/debian-security|http://archive.debian.org/debian-security|g" /etc/apt/sources.list
    3⤵
    PID:754
- /usr/bin/sudo
  sudo sed -i "s|^deb\\(.*\\)stretch-\\(backports\\|updates\\).*|# &|" /etc/apt/sources.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:755
- - /bin/sed
    sed -i "s|^deb\\(.*\\)stretch-\\(backports\\|updates\\).*|# &|" /etc/apt/sources.list
    3⤵
    - Reads runtime system information
    PID:757
- /usr/bin/sudo
  sudo sed -i "s|^deb-src\\(.*\\)stretch-\\(backports\\|updates\\).*|# &|" /etc/apt/sources.list
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:758
- - /bin/sed
    sed -i "s|^deb-src\\(.*\\)stretch-\\(backports\\|updates\\).*|# &|" /etc/apt/sources.list
    3⤵
    PID:759
- /usr/bin/sudo
  sudo tee /etc/apt/apt.conf.d/99no-check-valid-until
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:761
- - /usr/bin/tee
    tee /etc/apt/apt.conf.d/99no-check-valid-until
    3⤵
    PID:762
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:764
- /usr/bin/sudo
  sudo apt update
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:765
- - /usr/bin/apt
    apt update
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:767
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:768
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:769
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:770
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:771
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:772
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      PID:773
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      Writes file to tmp directory
      PID:775
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.60X1Mr /tmp/apt.data.lz5DrF
        5⤵
        Writes file to tmp directory
        
        PID:777
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:779
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:780
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:781
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:782
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:783
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:784
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:785
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:786
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        Reads runtime system information
        
        PID:787
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:788
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:789
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:790
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:792
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:793
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:794
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.TlfI0gmlzp
        6⤵
        
        PID:795
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.TlfI0gmlzp
        6⤵
        
        PID:796
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg
        6⤵
        
        PID:797
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:798
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:799
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:800
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:801
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        
        PID:802
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:805
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:807
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:809
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:811
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:813
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:815
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:817
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:819
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:821
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:823
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.orig.gpg
        6⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:824
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:827
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:830
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.TlfI0gmlzp --keyring /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.60X1Mr /tmp/apt.data.lz5DrF
        6⤵
        Reads runtime system information
        
        PID:831
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:832
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:833
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.TlfI0gmlzp
        6⤵
        
        PID:834
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Writes file to tmp directory
        
        PID:836
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:838
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:839
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:840
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:841
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        Reads runtime system information
        
        PID:842
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:843
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:844
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:845
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:846
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:847
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        
        PID:848
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:849
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:851
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:852
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:853
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.rFkODnsGOT
        6⤵
        
        PID:854
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.rFkODnsGOT
        6⤵
        
        PID:855
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.rFkODnsGOT/pubring.gpg
        6⤵
        
        PID:856
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.rFkODnsGOT/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:857
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        Reads runtime system information
        
        PID:858
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:859
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:860
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        Reads runtime system information
        
        PID:861
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:864
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:866
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:871
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:873
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:875
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:877
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:879
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:881
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:883
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:885
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.rFkODnsGOT/pubring.gpg /tmp/apt-key-gpghome.rFkODnsGOT/pubring.orig.gpg
        6⤵
        Writes file to tmp directory
        
        PID:886
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:889
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:892
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.rFkODnsGOT --keyring /tmp/apt-key-gpghome.rFkODnsGOT/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        6⤵
        Reads runtime system information
        
        PID:893
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:894
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Reads runtime system information
        
        PID:895
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.rFkODnsGOT
        6⤵
        
        PID:896
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.8cFYwN /tmp/apt.data.2yE1gD
        5⤵
        Writes file to tmp directory
        
        PID:898
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        Reads runtime system information
        
        PID:900
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:901
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        Reads runtime system information
        
        PID:902
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:903
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        Reads runtime system information
        
        PID:904
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:905
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:906
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:907
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:909
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:910
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:911
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.OTzacjKtqR
        6⤵
        
        PID:912
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:916
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:919
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.OTzacjKtqR --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.8cFYwN /tmp/apt.data.2yE1gD
        6⤵
        
        PID:921
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        
        PID:922
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:923
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.OTzacjKtqR
        6⤵
        
        PID:924
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:926
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:996
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:766
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:1006
- /usr/bin/sudo
  sudo apt -y upgrade
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1005
- - /usr/bin/apt
    apt -y upgrade
    3⤵
    - Writes file to tmp directory
    PID:1007
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1008
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1009
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:1011
- /usr/bin/tee
  tee -a /home/snowtv/vnotes_2.0
  2⤵
  PID:1013
- /usr/bin/sudo
  sudo apt -y install jq autossh
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

99no-check-valid-until

Path /etc/apt/apt.conf.d/99no-check-valid-until
Size 36B
SHA256 92dd8add3f0093b490c4d4c57f6a2bc7afc1a7519b078b8034db2df5add7f458
MD5 66734cb974e1e3b01faf9feccdbabf96
SHA1 3e0b86a333fdeded8afc15f833e604df7521eff5
SHA512 12832aed717f85298883ccb037933655e3dda62916f6eab0ca80b98650192e66cf1e59eabb55ab76e52c237635f9005f8695a40e06bb602943c78bf0a6fb1e81
MD5 SHA1 SHA512

Submit Download

sedJ1Er50

Path /etc/apt/sedJ1Er50
Size 296B
SHA256 26680c0b7758ab07e871f9bc13cb5ac3f8e486ceb227007345432ea1ad6113ab
MD5 4293fe06fec8af0c1ae737eead165125
SHA1 fdf6a9b78630d9f7baebf5d3b6874a6e8215043c
SHA512 519f05d1edfe58ac750e03fcd09dd56e8fdf326c2ea4bf82dd511287288d116e7fafc1799f0b6415b99a1fb4e505374c8a04e7ea46e3d77015bcc7931e6cd179
TLSH
T1DDE042FD974B63C5ED42C64A7BA1D800C2274AD129C0E1D09EB04A328F44D1A7A211C8
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.OTzacjKtqR/gpg.1.sh
Size 71B
SHA256 11f70f1f445376846199cd886a909f58a5eca110d2539720b1b938410836514d
MD5 4a502d34c9274bf20ac5781ec24f97d5
SHA1 524c16347caa1e4e4c89fe3a397248a4059be41c
SHA512 93ef1e10a3d08717b72b129dced28bd24adf1f94b86631b53ab15b5156b0c1b692962ce29c53f3ce9ef08b42a12db213927f1b1bca4a3f534de8f3ea7441a1bf
TLSH
T115A022F38083223F003C80200A302320A28F02E030F0C02CC38A800230203822AB0088
MD5 SHA1 SHA512 TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.TlfI0gmlzp/gpg.1.sh
Size 82B
SHA256 891aed4fdc3e72951120faf2ccdc9db481fbbe8b6879dd5ba914e714f851774e
MD5 78681b8f8cfe75a54963e78ca6ae33fd
SHA1 3e0610b98660cb4d1d7ad8a0057c09398910df12
SHA512 105d5c777628d31550360b73727dc5efb1487d0651b25a4bfc7659e1016a74ca270e89015896f233d42ee1943e3205948d8838b42a0d6fd4d9f68cfd897e42a5
TLSH
T1E8A01122200300222E28E88088B00BA0AE0F02A020FA802AF280C03A222038B2A320A0
MD5 SHA1 SHA512 TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg
Size 7KB
SHA256 6246307cc0130f6bd52510a477960f7c7be431b25979d7e20a88dc2fac58ac93
MD5 b53e6ca4ed295fc38621315853f623d0
SHA1 45a416f014809735ec88854a3540c8e9e89eb102
SHA512 30b5d2571840c2319a4af3907afda8ab00cf2879c83aaee1048ca972c0d3ddbf7995a167a31b19c45195b636ab46e73b0534459c6ee79c557fac8bfc01d857ac
SSDEEP 192:EKgnTWoCNdK1jKp1uUnMV/RFGxUqe8UFTHkfDBuw:EgjNdyjK7uUM1RFGxX2THkftn
TLSH
T154F1CF565B639F17AE63F83DE43904B8B7629EF6CD7A57C0F2A0318A8BC5654F024001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg
Size 15KB
SHA256 389d00b5cbd2f69f32065448000a0607aec056e39af958f62e89c4c7e6228248
MD5 2713b38b3d7345961d8b80f4463483b8
SHA1 e6ec76aaebfea6a82f7984b57e07522a20365201
SHA512 ecee7b3045f49f7fa7443a8658602817bb2c8d2d07ae930536e3f2daaa5854903bf339af6c2fd4b02f8627f050ce360d2feddcf40569b58d304cfc459f418978
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsj:EgDymRZxXkHCtjTk5udNj
TLSH
T14D72D0A797137F5B2A3BF43C607665BCBA269DF9C9B88ED0F300318B0949144E23C525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg
Size 18KB
SHA256 42b348802c4290af6f9f30f984513f22fdd342ac3561ccb82957561a6b7c291f
MD5 760d3ab91f417958475b9a6342a5b92e
SHA1 137a06aea4b5c9e9ca11f0f5f1225da1c275c334
SHA512 6cefcfae1c95c94b66b46d9242e62ddf7d7c65bd8d9bc9dc4e4c6230443ba33668ed160e1882f48a0b5daf59a46ccca09240ebe666017f059bd55e02fb1f2db6
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxG4:EgDymRZxXkHCtjTk5udNvvCxG4
TLSH
T15C82D0A69B137F5B193BF47D707656B8BD278CF9C5F88E91E340348B0A4A114E13C52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg
Size 23KB
SHA256 de329f1f48b751a7527f8ce3150452a4282ce69990e9318ab82d5b46b9f751ca
MD5 d63fbab9dfb826d53f7b3aaea45dbfb5
SHA1 59841d8e5423f788292af76d4350a948f4e25f53
SHA512 20118f98c87eb60f0abafd5b4c2ffb4b1faf92777ee7402b98c0f5dc42d492c83f94d6903bdeee006187ac344a57afeaa84b54a973b483ff13e49773071d8198
SSDEEP 384:EgjNdyjK7uUM1RFGxX2THkfteXWTSCkM9IZuGHyCjnsKZbxwvCxGiPx/xZaURhky:EgDymRZxXkHCtjTk5udNvvCxGiPxyy
TLSH
T1A7B2D0A693236F4BAD77F47EB46AE178ED139CF8C5E51FC2E280718B094A2849138516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pubring.gpg

Path /tmp/apt-key-gpghome.TlfI0gmlzp/pubring.gpg
Size 47KB
SHA256 eef8c4d7d518a986e4f1cfeec729b55369b863ed6b62a23cbe9d88aa56de5391
MD5 a4dc094481f22304cab5550218e6e4de
SHA1 f5886a324c0c026d0168656f23d1d898a0e43bd6
SHA512 0f040c957db3d500ba18315db33cca6eb18f9c80d952710f839833a73dd89b72e2e01178084c17348e312a427a6b9150937199b4912e71dfd1a7e2dd43723f68
SSDEEP 768:EgDymRZxXkHCtjTk5udNvvCxGiPxyiKAHeDC68TAVRNpyTgiv6Mfp2swONe:BFT0HEjbSGiPxhp+DP8TAV1rO12swn
TLSH
T1F323E1E5EB625B9FA923EC3B745B6238AD139DFCC4D52DD1D14571470F49208A028CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gpg.1.sh

Path /tmp/apt-key-gpghome.rFkODnsGOT/gpg.1.sh
Size 82B
SHA256 64fbaa6b0aa77091c72d11227469d1ef48ade72171be433510624854773043cc
MD5 4ac32b5853c0b7db7b27f2b0dd82bf09
SHA1 6b82b523a2ce1751f888d5dc2306d0dcf5bb1921
SHA512 c3402db71562f135dcfdeedc189bcd2405c208db8ca13318ae4de6f654f8a1c756e5c6471927028c445fea45ebfd6d301c7ba6eca839d0d3344b3c87af4683f2
TLSH
T1D0A02411100310331D1CC54047F137F07C0F015011F14104F5C0C435373035517711D0
MD5 SHA1 SHA512 TLSH

Submit Download

apt.conf.PJZjTh

Path /tmp/apt.conf.PJZjTh
Size 7KB
SHA256 0228c8d2f3e7064ab08774d469ebf89ba4588b8a6e9894d9738b3ec8452bbc96
MD5 4fd4049df5808d84d7131233944375f2
SHA1 8e37f7262c004d4702b5d021ee21747a9d0f0afd
SHA512 aac8092ccf9b457a016ecb334c641f23a0b3814dd7da5445a17214854993b054cbb6c52664517679e7dd64597ebf2ba4648886710c1dc9455f0cb662307d3286
SSDEEP 192:YsG+fDLRBVAQhWibAn4aHzZzQznz+zHzl2S:YVe2ibAn4ar2S
TLSH
T1CBF10D65B4D5E2A006E74EB8B9D7C9008BB4E4D8EF010A6ED70B09A861F0C5E57DEDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.data.lz5DrF

Path /tmp/apt.data.lz5DrF
Size 56KB
SHA256 ffc8a7a283b61633aac383ddf8f863df3f39ef241a07a4127f51a2495ef674b3
MD5 fd96c8ce5d0ef18d63bbe9ae17bb2659
SHA1 76b284743d95d3546df9d85c09712c830a30f614
SHA512 2486acdfc102f8f8498d8db2f205915115444dd118507369044202dc9a97109b4c738a2faf16c1f5ce5e4452ae0af17ae4691ac3bf5e7c5e2db271c0f40a4cb2
SSDEEP 384:Nxz5CUX7PwDBnm8nm8gzxjKwjKmuIQBHlKQd7mMqp9Hp9H2861BL1BjaemWOaw09:Nx5WIQCQyXlrLqbGC/
TLSH
T18C43431827A8277EAE248FEF6FF37561BC2CF121644602D1314DADE403E6317E6A745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

apt.sig.60X1Mr

Path /tmp/apt.sig.60X1Mr
Size 1KB
SHA256 4055d2ccc7c4be062ed390944548206ece5ed7613eae114b9e53ef15f3905230
MD5 70274ce622b0cc437ef7f0caddc9d232
SHA1 124513a3ad2eb5aafa9be0920681e3bb8625979b
SHA512 fed0054da258bb4a99e8adac359322d9ecc67caeee872309ea7d9863db6a1ec2a55497100e31538f42b43b9efc997e779e3774c8a0c6b0206254d7252d8699c8
TLSH
T1DA31C8C0F86079C16396CDCA731C92695EBA90C334C459305BF216125A682221D5F4B8
MD5 SHA1 SHA512 TLSH

Submit Download

pkgcache.bin.F8LRUR

Path /var/cache/apt/pkgcache.bin.F8LRUR
Size 24.4MB
SHA256 be222b47ebd85f52e1c29b72bcc2deee505a3be60b3c84f5bd07ac3908c24547
MD5 4c063c574ad04f3456daf14faf1d7e36
SHA1 9f4af6002857d480680b4831dd56c0951cf5e56d
SHA512 9e1972bf31cc42037e11cb322f9ba238cf0a7a05dd6f99fb31f716b778422dbbc3553892ef2bbb2c264d23f225f284380d653e57dfcc66b8661575de3e328a72
SSDEEP 196608:bGyMiz7MDGE3hGWqVTYpF0t5+z/L+OkukxZ3z:qyMMMB3hDYTYaO5kx5
TLSH
T1BB474A28D9A55F3AD8F2007675620A6277BA88894F82DB03D577E1B13C0BFD41F927D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srcpkgcache.bin.wW5twe

Path /var/cache/apt/srcpkgcache.bin.wW5twe
Size 248B
SHA256 f99ace1c6ecabad131e4f798e0663c3e1e6b6acac07ce2214a3ebdc5653bfe86
MD5 793fe30d0edd5d14398de39026d426d8
SHA1 bf356e57fc084be077dbca831d9d82a1f8892e2d
SHA512 815e31bd662b5fe3bf3460e5e8f531030f867f52240cb144912cb1a7a6858c575d104ea456dc5a80882677cf20d9d9c5301653c2c73c860339b72db836633643
TLSH
T170D0803970543F48FC85D73459546577139DCB1B0C6153485F5342397D006D3C71798A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads