Overview
overview
6Static
static
1Apps/Syste...all.sh
ubuntu-18.04-amd64
3Apps/Syste...all.sh
debian-9-armhf
3Apps/Syste...all.sh
debian-9-mips
Apps/Syste...all.sh
debian-9-mipsel
Apps/Syste...tus.sh
ubuntu-18.04-amd64
3Apps/Syste...tus.sh
debian-9-armhf
3Apps/Syste...tus.sh
debian-9-mips
Apps/Syste...tus.sh
debian-9-mipsel
Apps/Syste...all.sh
ubuntu-18.04-amd64
3Apps/Syste...all.sh
debian-9-armhf
3Apps/Syste...all.sh
debian-9-mips
Apps/Syste...all.sh
debian-9-mipsel
Apps/Syste...on.svg
windows10-2004-x64
3Apps/Syste...on.svg
windows11-ltsc_2024-x64
4Apps/Syste...all.sh
ubuntu-18.04-amd64
3Apps/Syste...all.sh
debian-9-armhf
3Apps/Syste...all.sh
debian-9-mips
Apps/Syste...all.sh
debian-9-mipsel
Apps/Syste...ter.so
ubuntu-18.04-amd64
Apps/Syste...ter.so
debian-9-armhf
Apps/Syste...ter.so
debian-9-mips
Apps/Syste...ter.so
debian-9-mipsel
Apps/Syste...per.sh
ubuntu-18.04-amd64
1Apps/Syste...per.sh
debian-9-armhf
1Apps/Syste...per.sh
debian-9-mips
Apps/Syste...per.sh
debian-9-mipsel
Apps/Syste...tus.sh
ubuntu-18.04-amd64
6Apps/Syste...tus.sh
debian-9-armhf
6Apps/Syste...tus.sh
debian-9-mips
Apps/Syste...tus.sh
debian-9-mipsel
Apps/Syste...dog.sh
ubuntu-18.04-amd64
6Apps/Syste...dog.sh
debian-9-armhf
6Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
31/07/2026, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Install.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Install.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral3
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Install.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral4
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Install.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Status.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Status.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral7
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Status.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral8
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Status.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Uninstall.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Uninstall.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral11
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Uninstall.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral12
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/Uninstall.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral13
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/icon.svg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/icon.svg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/install.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/install.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/install.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/install.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/libmoonlight_obss_filter.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/libmoonlight_obss_filter.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/libmoonlight_obss_filter.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/libmoonlight_obss_filter.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/moonlight-launcher-wrapper.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/moonlight-launcher-wrapper.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/moonlight-launcher-wrapper.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/moonlight-launcher-wrapper.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/status.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/status.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral29
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/status.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral30
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/status.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral31
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/supplicant-post-start-watchdog.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral32
Sample
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/supplicant-post-start-watchdog.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
General
- Target Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/status.sh
- Size 1KB
- Sample260731-pm2bvstvbv
- SHA256 ef71e4947bad1d3c8c68d959ce7a928a4fad01de488c16ad3fa393408eff725e
- MD5 6506a3e703b6619f483d2ca6d6b98b6d
- SHA1 082fb2d4a0780916eff2483a38e7621feab0fe1a
- SHA512 a911dbc0ab9b22f940d16af4aeecd4ab3d6ca13515f732db98ece96e59967a6c0df8200dfa1c7b7218f85c21937dc05f6d91050ee591cef6afe9bc66dcf29e35
- TLSH T19441444AB8C199B4215C997DF496B418658C501F8350BE34B41F24517F8E65EB0FD3D9
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 1 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/484/maps grep -
description ioc Process File opened for reading /proc/1309/cmdline pidof File opened for reading /proc/2/stat pidof File opened for reading /proc/17/cmdline pidof File opened for reading /proc/19/cmdline pidof File opened for reading /proc/650/cmdline pidof File opened for reading /proc/719/cmdline pidof File opened for reading /proc/1460/cmdline pidof File opened for reading /proc/330/stat pidof File opened for reading /proc/892/cmdline pidof File opened for reading /proc/980/stat pidof File opened for reading /proc/1028/cmdline pidof File opened for reading /proc/83/cmdline pidof File opened for reading /proc/159/stat pidof File opened for reading /proc/270/cmdline pidof File opened for reading /proc/176/cmdline pidof File opened for reading /proc/203/stat pidof File opened for reading /proc/204/stat pidof File opened for reading /proc/1037/stat pidof File opened for reading /proc/10/cmdline pidof File opened for reading /proc/79/stat pidof File opened for reading /proc/86/cmdline pidof File opened for reading /proc/173/cmdline pidof File opened for reading /proc/404/cmdline pidof File opened for reading /proc/651/stat pidof File opened for reading /proc/1012/cmdline pidof File opened for reading /proc/1080/cmdline pidof File opened for reading /proc/169/cmdline pidof File opened for reading /proc/170/stat pidof File opened for reading /proc/1016/stat pidof File opened for reading /proc/1045/cmdline pidof File opened for reading /proc/1061/cmdline pidof File opened for reading /proc/1236/cmdline pidof File opened for reading /proc/1293/cmdline pidof File opened for reading /proc/1466/cmdline pidof File opened for reading /proc/9/cmdline pidof File opened for reading /proc/24/cmdline pidof File opened for reading /proc/159/cmdline pidof File opened for reading /proc/430/cmdline pidof File opened for reading /proc/952/stat pidof File opened for reading /proc/989/cmdline pidof File opened for reading /proc/1083/stat pidof File opened for reading /proc/1178/stat pidof File opened for reading /proc/30/stat pidof File opened for reading /proc/32/cmdline pidof File opened for reading /proc/254/stat pidof File opened for reading /proc/1033/stat pidof File opened for reading /proc/1059/stat pidof File opened for reading /proc/1277/cmdline pidof File opened for reading /proc/1290/cmdline pidof File opened for reading /proc/1460/stat pidof File opened for reading /proc/8/stat pidof File opened for reading /proc/178/cmdline pidof File opened for reading /proc/465/cmdline pidof File opened for reading /proc/485/stat pidof File opened for reading /proc/914/stat pidof File opened for reading /proc/4/cmdline pidof File opened for reading /proc/404/stat pidof File opened for reading /proc/565/stat pidof File opened for reading /proc/962/cmdline pidof File opened for reading /proc/1055/cmdline pidof File opened for reading /proc/1071/cmdline pidof File opened for reading /proc/1078/stat pidof File opened for reading /proc/969/cmdline pidof File opened for reading /proc/989/stat pidof
Processes
-
/tmp/Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/status.sh"/tmp/Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/status.sh"1⤵PID:1468
-
/bin/grepgrep -q "^TRIMUI_MOONLIGHT_OBSS_FIX_WRAPPER=1\$" /usr/sbin/wpa_supplicant2⤵PID:1470
-
-
/bin/pidofpidof wpa_supplicant2⤵
- Reads runtime system information
PID:1473
-
-
/bin/grepgrep -q libmoonlight_obss_filter.so /proc/484/maps2⤵
- Reads process memory
PID:1475
-
-
/bin/sedsed -n "s/^wpa_state=//p"2⤵PID:1478
-
-
/sbin/wpa_cliwpa_cli -p /etc/wifi/sockets -i wlan0 status2⤵PID:1477
-
-
/bin/grepgrep -q "^TRIMUI_MOONLIGHT_OBSS_LAUNCHER_WRAPPER=1\$" /usr/trimui/apps/moonlight/launch.sh2⤵PID:1479
-
-
/bin/grepgrep -q "^TRIMUI_MOONLIGHT_OBSS_LAUNCHER_WRAPPER=1\$" "/mnt/SDCARD/Data/ports/Moonlight New.sh"2⤵PID:1481
-