bbccc0a31b8de37d58de709feba80c4cb083c3f46cc8993fe0aabed539a722b3

Analysis

max time kernel
5s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
13/09/2026, 05:58

Target
f b i/FBI/build.sh
Size 10KB
Sample260913-gpjwlaff98
SHA256 bbccc0a31b8de37d58de709feba80c4cb083c3f46cc8993fe0aabed539a722b3
MD5 05ce98786918f3e7efc15ee6dc5de468
SHA1 4ca33a77f3bf71f7cd54a691acad6a62f8cc3e00
SHA512 a1d287d8947f3dcb4126767f45ae2b626cc5e569593ce90e14b9fef9df7a6fa17ba22aeee09727b1514b9613630aa2e642b1fdc1d4e62b7121484efae2bcbed5
SSDEEP 192:MYzl0mURmU5NczzCH/8+qEILfULHSOyeLObNYswng:Tp0mURmU5NcfCH/8+qEIlag
TLSH
T123221C19714A7CBB54875E3B71732246B1B7B4A97F30115E80B21B428EAEAD420CB5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

/tmp/f b i/FBI/build.sh
"/tmp/f b i/FBI/build.sh"
1⤵
PID:708
- /bin/rm
  rm -rf /root/release
  2⤵
  PID:719
- /bin/mkdir
  mkdir /root/release
  2⤵
  - Reads runtime system information
  PID:721
- /bin/mv
  mv "/root/dlr/release/dlr*" /root/loader/bins
  2⤵
  - Reads runtime system information
  PID:809
- /bin/rm
  rm -rf /var/ftp
  2⤵
  PID:810
- /bin/rm
  rm -rf /var/lib/tftpboot
  2⤵
  PID:811
- /bin/rm
  rm -rf /var/www/html/bins
  2⤵
  PID:812
- /bin/rm
  rm -rf /var/www/html/Binary
  2⤵
  PID:813
- /bin/mkdir
  mkdir /var/www/html/Binary
  2⤵
  - Reads runtime system information
  PID:814
- /bin/mkdir
  mkdir /var/www/html/bins
  2⤵
  - Reads runtime system information
  PID:815
- /bin/mkdir
  mkdir /var/ftp
  2⤵
  - Reads runtime system information
  PID:816
- /bin/mkdir
  mkdir /var/lib/tftpboot
  2⤵
  - Reads runtime system information
  PID:817
- /bin/cp
  cp "release/kwari.*" /var/www/html/bins
  2⤵
  - Reads runtime system information
  PID:818
- /bin/cp
  cp "release/kwari.*" /var/www/html/Binary
  2⤵
  - Reads runtime system information
  PID:819
- /bin/cp
  cp "release/kwari.*" /var/ftp
  2⤵
  - Reads runtime system information
  PID:820
- /bin/cp
  cp "release/kwari.*" /var/lib/tftpboot
  2⤵
  - Reads runtime system information
  PID:821