53ecd575059057202ce3f3998f8733bf11eac878adfe48ec10235f39043bd843

Analysis

max time kernel
91s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
31/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/supplicant-post-start-watchdog.sh
Size 1KB
Sample260731-pm2bvstvbv
SHA256 53ecd575059057202ce3f3998f8733bf11eac878adfe48ec10235f39043bd843
MD5 db7a78e95e45030842f186cbf4e7a210
SHA1 dcb632507e3b261035d98e2841cc52ed276a1359
SHA512 44825107840a0875a9b2d7289ed1132a263bd05232a64a54e3d56aa4e5cd56846ac21b6e001533857f71da7798a72a57ff2233b2bc5000b7d9defe5e1bf0b1b9
TLSH
T161414388E986927C2E0AD07DEA1E9A62D547853F4B183423705C38583FECE09B1FD792
MD5 SHA1 SHA512 TLSH

Score

6^/10

credential_access discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 1 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/464/maps	grep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/35/stat	pidof
File opened for reading	/proc/542/stat	pidof
File opened for reading	/proc/1039/stat	pidof
File opened for reading	/proc/1380/stat	pidof
File opened for reading	/proc/5/stat	pidof
File opened for reading	/proc/20/stat	pidof
File opened for reading	/proc/27/stat	pidof
File opened for reading	/proc/89/cmdline	pidof
File opened for reading	/proc/417/stat	pidof
File opened for reading	/proc/647/cmdline	pidof
File opened for reading	/proc/899/cmdline	pidof
File opened for reading	/proc/1014/stat	pidof
File opened for reading	/proc/168/cmdline	pidof
File opened for reading	/proc/317/cmdline	pidof
File opened for reading	/proc/506/cmdline	pidof
File opened for reading	/proc/928/cmdline	pidof
File opened for reading	/proc/1090/stat	pidof
File opened for reading	/proc/1158/stat	pidof
File opened for reading	/proc/1455/cmdline	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/14/cmdline	pidof
File opened for reading	/proc/990/stat	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1023/cmdline	pidof
File opened for reading	/proc/1068/stat	pidof
File opened for reading	/proc/1500/cmdline	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/7/stat	pidof
File opened for reading	/proc/9/stat	pidof
File opened for reading	/proc/971/stat	pidof
File opened for reading	/proc/1087/cmdline	pidof
File opened for reading	/proc/1266/stat	pidof
File opened for reading	/proc/81/cmdline	pidof
File opened for reading	/proc/162/cmdline	pidof
File opened for reading	/proc/204/stat	pidof
File opened for reading	/proc/424/cmdline	pidof
File opened for reading	/proc/1484/stat	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/16/cmdline	pidof
File opened for reading	/proc/169/stat	pidof
File opened for reading	/proc/175/cmdline	pidof
File opened for reading	/proc/966/stat	pidof
File opened for reading	/proc/1097/cmdline	pidof
File opened for reading	/proc/1302/cmdline	pidof
File opened for reading	/proc/86/cmdline	pidof
File opened for reading	/proc/173/cmdline	pidof
File opened for reading	/proc/1044/cmdline	pidof
File opened for reading	/proc/1067/cmdline	pidof
File opened for reading	/proc/1233/cmdline	pidof
File opened for reading	/proc/661/stat	pidof
File opened for reading	/proc/667/cmdline	pidof
File opened for reading	/proc/723/stat	pidof
File opened for reading	/proc/1018/cmdline	pidof
File opened for reading	/proc/1197/stat	pidof
File opened for reading	/proc/174/cmdline	pidof
File opened for reading	/proc/455/cmdline	pidof
File opened for reading	/proc/6/cmdline	pidof
File opened for reading	/proc/18/stat	pidof
File opened for reading	/proc/19/stat	pidof
File opened for reading	/proc/164/cmdline	pidof
File opened for reading	/proc/1500/stat	pidof
File opened for reading	/proc/34/cmdline	pidof
File opened for reading	/proc/203/cmdline	pidof

/tmp/Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/supplicant-post-start-watchdog.sh
"/tmp/Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/supplicant-post-start-watchdog.sh"
1⤵
PID:1488
- /bin/sleep
  sleep 45
  2⤵
  PID:1489
- /bin/pidof
  pidof wpa_supplicant
  2⤵
  - Reads runtime system information
  PID:1501
- /bin/grep
  grep -q libmoonlight_obss_filter.so /proc/464/maps
  2⤵
  - Reads process memory
  PID:1502
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1505
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1504
- /bin/rm
  rm -f /mnt/UDISK/trimui-tools/moonlight-obss-fix/state/filter-attempt-in-progress /mnt/UDISK/trimui-tools/moonlight-obss-fix/state/filter-enabled
  2⤵
  PID:1506
- /bin/grep
  grep -q "^wpa_state=COMPLETED\$"
  2⤵
  PID:1508
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1507
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1509
- /usr/sbin/moonlight-obss-fix/wpa_supplicant
  /usr/sbin/moonlight-obss-fix/wpa_supplicant
  2⤵
  PID:1510
- /bin/date
  date "+%s"
  2⤵
  PID:1511
- /bin/date
  date "+%s"
  2⤵
  PID:1512
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1515
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1514
- /bin/sleep
  sleep 2
  2⤵
  PID:1516
- /bin/date
  date "+%s"
  2⤵
  PID:1517
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1520
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1519
- /bin/sleep
  sleep 2
  2⤵
  PID:1521
- /bin/date
  date "+%s"
  2⤵
  PID:1522
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1525
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1524
- /bin/sleep
  sleep 2
  2⤵
  PID:1526
- /bin/date
  date "+%s"
  2⤵
  PID:1527
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1530
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1529
- /bin/sleep
  sleep 2
  2⤵
  PID:1531
- /bin/date
  date "+%s"
  2⤵
  PID:1532
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1535
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1534
- /bin/sleep
  sleep 2
  2⤵
  PID:1536
- /bin/date
  date "+%s"
  2⤵
  PID:1537
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:1540
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1539
- /bin/sleep
  sleep 2
  2⤵
  PID:1541
- /bin/date
  date "+%s"
  2⤵
  PID:1542
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1545
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1544
- /bin/sleep
  sleep 2
  2⤵
  PID:1546
- /bin/date
  date "+%s"
  2⤵
  PID:1547
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:1550
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1549
- /bin/sleep
  sleep 2
  2⤵
  PID:1551
- /bin/date
  date "+%s"
  2⤵
  PID:1552
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:1555
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1554
- /bin/sleep
  sleep 2
  2⤵
  PID:1556
- /bin/date
  date "+%s"
  2⤵
  PID:1557
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1560
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1559
- /bin/sleep
  sleep 2
  2⤵
  PID:1561
- /bin/date
  date "+%s"
  2⤵
  PID:1562
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1565
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1564
- /bin/sleep
  sleep 2
  2⤵
  PID:1566
- /bin/date
  date "+%s"
  2⤵
  PID:1567
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1570
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1569
- /bin/sleep
  sleep 2
  2⤵
  PID:1571
- /bin/date
  date "+%s"
  2⤵
  PID:1572
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:1575
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1574
- /bin/sleep
  sleep 2
  2⤵
  PID:1576
- /bin/date
  date "+%s"
  2⤵
  PID:1577
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1580
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1579
- /bin/sleep
  sleep 2
  2⤵
  PID:1581
- /bin/date
  date "+%s"
  2⤵
  PID:1582
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1585
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1584
- /bin/sleep
  sleep 2
  2⤵
  PID:1586
- /bin/date
  date "+%s"
  2⤵
  PID:1587
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:1590
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1589
- /bin/sleep
  sleep 2
  2⤵
  PID:1591
- /bin/date
  date "+%s"
  2⤵
  PID:1592
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1595
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1594
- /bin/sleep
  sleep 2
  2⤵
  PID:1596
- /bin/date
  date "+%s"
  2⤵
  PID:1597
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1600
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1599
- /bin/sleep
  sleep 2
  2⤵
  PID:1601
- /bin/date
  date "+%s"
  2⤵
  PID:1602
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1605
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1604
- /bin/sleep
  sleep 2
  2⤵
  PID:1606
- /bin/date
  date "+%s"
  2⤵
  PID:1607
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1610
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1609
- /bin/sleep
  sleep 2
  2⤵
  PID:1611
- /bin/date
  date "+%s"
  2⤵
  PID:1612
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1615
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1614
- /bin/sleep
  sleep 2
  2⤵
  PID:1616
- /bin/date
  date "+%s"
  2⤵
  PID:1617
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1620
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1619
- /bin/sleep
  sleep 2
  2⤵
  PID:1621
- /bin/date
  date "+%s"
  2⤵
  PID:1622
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:1625
- /sbin/wpa_cli
  wpa_cli -p /etc/wifi/sockets -i wlan0 status
  2⤵
  PID:1624
- /bin/sleep
  sleep 2
  2⤵
  PID:1626
- /bin/date
  date "+%s"
  2⤵
  PID:1627
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads