53ecd575059057202ce3f3998f8733bf11eac878adfe48ec10235f39043bd843

Analysis

max time kernel
90s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/supplicant-post-start-watchdog.sh
Size 1KB
Sample260731-pm2bvstvbv
SHA256 53ecd575059057202ce3f3998f8733bf11eac878adfe48ec10235f39043bd843
MD5 db7a78e95e45030842f186cbf4e7a210
SHA1 dcb632507e3b261035d98e2841cc52ed276a1359
SHA512 44825107840a0875a9b2d7289ed1132a263bd05232a64a54e3d56aa4e5cd56846ac21b6e001533857f71da7798a72a57ff2233b2bc5000b7d9defe5e1bf0b1b9
TLSH
T161414388E986927C2E0AD07DEA1E9A62D547853F4B183423705C38583FECE09B1FD792
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/6/stat	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/14/cmdline	pidof
File opened for reading	/proc/10/stat	pidof
File opened for reading	/proc/78/stat	pidof
File opened for reading	/proc/323/stat	pidof
File opened for reading	/proc/43/cmdline	pidof
File opened for reading	/proc/582/stat	pidof
File opened for reading	/proc/28/cmdline	pidof
File opened for reading	/proc/591/cmdline	pidof
File opened for reading	/proc/648/cmdline	pidof
File opened for reading	/proc/668/stat	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/12/stat	pidof
File opened for reading	/proc/20/stat	pidof
File opened for reading	/proc/110/cmdline	pidof
File opened for reading	/proc/259/cmdline	pidof
File opened for reading	/proc/284/stat	pidof
File opened for reading	/proc/323/cmdline	pidof
File opened for reading	/proc/645/cmdline	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/27/cmdline	pidof
File opened for reading	/proc/13/stat	pidof
File opened for reading	/proc/99/stat	pidof
File opened for reading	/proc/282/stat	pidof
File opened for reading	/proc/9/cmdline	pidof
File opened for reading	/proc/135/stat	pidof
File opened for reading	/proc/309/stat	pidof
File opened for reading	/proc/325/cmdline	pidof
File opened for reading	/proc/590/stat	pidof
File opened for reading	/proc/645/stat	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/8/cmdline	pidof
File opened for reading	/proc/20/cmdline	pidof
File opened for reading	/proc/21/stat	pidof
File opened for reading	/proc/110/stat	pidof
File opened for reading	/proc/579/cmdline	pidof
File opened for reading	/proc/757/cmdline	pidof
File opened for reading	/proc/15/stat	pidof
File opened for reading	/proc/300/stat	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/11/cmdline	pidof
File opened for reading	/proc/7/stat	pidof
File opened for reading	/proc/643/cmdline	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/3/cmdline	pidof
File opened for reading	/proc/4/stat	pidof
File opened for reading	/proc/78/cmdline	pidof
File opened for reading	/proc/160/stat	pidof
File opened for reading	/proc/309/cmdline	pidof
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/21/cmdline	pidof
File opened for reading	/proc/222/cmdline	pidof
File opened for reading	/proc/3/stat	pidof
File opened for reading	/proc/14/stat	pidof
File opened for reading	/proc/24/cmdline	pidof
File opened for reading	/proc/41/cmdline	pidof
File opened for reading	/proc/5/cmdline	pidof

/tmp/Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/supplicant-post-start-watchdog.sh
"/tmp/Apps/SystemTools/Menu/TOOLS##MOONLIGHT WI-FI FIX/payload/supplicant-post-start-watchdog.sh"
1⤵
PID:648
- /bin/sleep
  sleep 45
  2⤵
  PID:650
- /bin/pidof
  pidof wpa_supplicant
  2⤵
  - Reads runtime system information
  PID:759
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:762
- /bin/rm
  rm -f /mnt/UDISK/trimui-tools/moonlight-obss-fix/state/filter-attempt-in-progress /mnt/UDISK/trimui-tools/moonlight-obss-fix/state/filter-enabled
  2⤵
  PID:763
- /bin/grep
  grep -q "^wpa_state=COMPLETED\$"
  2⤵
  PID:765
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:766
- /usr/sbin/moonlight-obss-fix/wpa_supplicant
  /usr/sbin/moonlight-obss-fix/wpa_supplicant
  2⤵
  PID:767
- /bin/date
  date "+%s"
  2⤵
  PID:768
- /bin/date
  date "+%s"
  2⤵
  PID:769
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:772
- /bin/sleep
  sleep 2
  2⤵
  PID:773
- /bin/date
  date "+%s"
  2⤵
  PID:776
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:779
- /bin/sleep
  sleep 2
  2⤵
  PID:780
- /bin/date
  date "+%s"
  2⤵
  PID:781
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:784
- /bin/sleep
  sleep 2
  2⤵
  PID:785
- /bin/date
  date "+%s"
  2⤵
  PID:786
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:789
- /bin/sleep
  sleep 2
  2⤵
  PID:790
- /bin/date
  date "+%s"
  2⤵
  PID:791
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:794
- /bin/sleep
  sleep 2
  2⤵
  PID:795
- /bin/date
  date "+%s"
  2⤵
  PID:796
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:799
- /bin/sleep
  sleep 2
  2⤵
  PID:800
- /bin/date
  date "+%s"
  2⤵
  PID:803
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:806
- /bin/sleep
  sleep 2
  2⤵
  PID:807
- /bin/date
  date "+%s"
  2⤵
  PID:808
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:811
- /bin/sleep
  sleep 2
  2⤵
  PID:812
- /bin/date
  date "+%s"
  2⤵
  PID:813
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:816
- /bin/sleep
  sleep 2
  2⤵
  PID:817
- /bin/date
  date "+%s"
  2⤵
  PID:818
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:821
- /bin/sleep
  sleep 2
  2⤵
  PID:822
- /bin/date
  date "+%s"
  2⤵
  PID:824
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:827
- /bin/sleep
  sleep 2
  2⤵
  PID:828
- /bin/date
  date "+%s"
  2⤵
  PID:830
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:833
- /bin/sleep
  sleep 2
  2⤵
  PID:834
- /bin/date
  date "+%s"
  2⤵
  PID:835
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:838
- /bin/sleep
  sleep 2
  2⤵
  PID:839
- /bin/date
  date "+%s"
  2⤵
  PID:840
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:843
- /bin/sleep
  sleep 2
  2⤵
  PID:844
- /bin/date
  date "+%s"
  2⤵
  PID:845
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:848
- /bin/sleep
  sleep 2
  2⤵
  PID:849
- /bin/date
  date "+%s"
  2⤵
  PID:851
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:854
- /bin/sleep
  sleep 2
  2⤵
  PID:855
- /bin/date
  date "+%s"
  2⤵
  PID:857
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:860
- /bin/sleep
  sleep 2
  2⤵
  PID:861
- /bin/date
  date "+%s"
  2⤵
  PID:862
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:865
- /bin/sleep
  sleep 2
  2⤵
  PID:866
- /bin/date
  date "+%s"
  2⤵
  PID:867
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  PID:870
- /bin/sleep
  sleep 2
  2⤵
  PID:871
- /bin/date
  date "+%s"
  2⤵
  PID:872
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:875
- /bin/sleep
  sleep 2
  2⤵
  PID:876
- /bin/date
  date "+%s"
  2⤵
  PID:878
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:881
- /bin/sleep
  sleep 2
  2⤵
  PID:882
- /bin/date
  date "+%s"
  2⤵
  PID:884
- /bin/sed
  sed -n "s/^wpa_state=//p"
  2⤵
  - Reads runtime system information
  PID:887
- /bin/sleep
  sleep 2
  2⤵
  PID:888
- /bin/date
  date "+%s"
  2⤵
  PID:889
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:890

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads