bbccc0a31b8de37d58de709feba80c4cb083c3f46cc8993fe0aabed539a722b3

Analysis

user interaction
yes
max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/09/2026, 05:58

Target
f b i/FBI/build.sh
Size 10KB
Sample260913-gpjwlaff98
SHA256 bbccc0a31b8de37d58de709feba80c4cb083c3f46cc8993fe0aabed539a722b3
MD5 05ce98786918f3e7efc15ee6dc5de468
SHA1 4ca33a77f3bf71f7cd54a691acad6a62f8cc3e00
SHA512 a1d287d8947f3dcb4126767f45ae2b626cc5e569593ce90e14b9fef9df7a6fa17ba22aeee09727b1514b9613630aa2e642b1fdc1d4e62b7121484efae2bcbed5
SSDEEP 192:MYzl0mURmU5NczzCH/8+qEILfULHSOyeLObNYswng:Tp0mURmU5NcfCH/8+qEIlag
TLSH
T123221C19714A7CBB54875E3B71732246B1B7B4A97F30115E80B21B428EAEAD420CB5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

/tmp/f b i/FBI/build.sh
"/tmp/f b i/FBI/build.sh"
1⤵
PID:648
- /bin/rm
  rm -rf /root/release
  2⤵
  PID:661
- /bin/mkdir
  mkdir /root/release
  2⤵
  - Reads runtime system information
  PID:663
- /bin/mv
  mv "/root/dlr/release/dlr*" /root/loader/bins
  2⤵
  - Reads runtime system information
  PID:751
- /bin/rm
  rm -rf /var/ftp
  2⤵
  PID:752
- /bin/rm
  rm -rf /var/lib/tftpboot
  2⤵
  PID:753
- /bin/rm
  rm -rf /var/www/html/bins
  2⤵
  PID:754
- /bin/rm
  rm -rf /var/www/html/Binary
  2⤵
  PID:755
- /bin/mkdir
  mkdir /var/www/html/Binary
  2⤵
  - Reads runtime system information
  PID:756
- /bin/mkdir
  mkdir /var/www/html/bins
  2⤵
  - Reads runtime system information
  PID:757
- /bin/mkdir
  mkdir /var/ftp
  2⤵
  - Reads runtime system information
  PID:758
- /bin/mkdir
  mkdir /var/lib/tftpboot
  2⤵
  - Reads runtime system information
  PID:759
- /bin/cp
  cp "release/kwari.*" /var/www/html/bins
  2⤵
  - Reads runtime system information
  PID:760
- /bin/cp
  cp "release/kwari.*" /var/www/html/Binary
  2⤵
  - Reads runtime system information
  PID:761
- /bin/cp
  cp "release/kwari.*" /var/ftp
  2⤵
  - Reads runtime system information
  PID:762
- /bin/cp
  cp "release/kwari.*" /var/lib/tftpboot
  2⤵
  - Reads runtime system information
  PID:763