bbccc0a31b8de37d58de709feba80c4cb083c3f46cc8993fe0aabed539a722b3

Analysis

max time kernel
5s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/09/2026, 05:58

Target
f b i/FBI/build.sh
Size 10KB
Sample260913-gpjwlaff98
SHA256 bbccc0a31b8de37d58de709feba80c4cb083c3f46cc8993fe0aabed539a722b3
MD5 05ce98786918f3e7efc15ee6dc5de468
SHA1 4ca33a77f3bf71f7cd54a691acad6a62f8cc3e00
SHA512 a1d287d8947f3dcb4126767f45ae2b626cc5e569593ce90e14b9fef9df7a6fa17ba22aeee09727b1514b9613630aa2e642b1fdc1d4e62b7121484efae2bcbed5
SSDEEP 192:MYzl0mURmU5NczzCH/8+qEILfULHSOyeLObNYswng:Tp0mURmU5NcfCH/8+qEIlag
TLSH
T123221C19714A7CBB54875E3B71732246B1B7B4A97F30115E80B21B428EAEAD420CB5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

/tmp/f b i/FBI/build.sh
"/tmp/f b i/FBI/build.sh"
1⤵
PID:727
- /bin/rm
  rm -rf /root/release
  2⤵
  PID:737
- /bin/mkdir
  mkdir /root/release
  2⤵
  - Reads runtime system information
  PID:739
- /bin/mv
  mv "/root/dlr/release/dlr*" /root/loader/bins
  2⤵
  - Reads runtime system information
  PID:831
- /bin/rm
  rm -rf /var/ftp
  2⤵
  PID:832
- /bin/rm
  rm -rf /var/lib/tftpboot
  2⤵
  PID:833
- /bin/rm
  rm -rf /var/www/html/bins
  2⤵
  PID:834
- /bin/rm
  rm -rf /var/www/html/Binary
  2⤵
  PID:835
- /bin/mkdir
  mkdir /var/www/html/Binary
  2⤵
  - Reads runtime system information
  PID:836
- /bin/mkdir
  mkdir /var/www/html/bins
  2⤵
  - Reads runtime system information
  PID:837
- /bin/mkdir
  mkdir /var/ftp
  2⤵
  - Reads runtime system information
  PID:838
- /bin/mkdir
  mkdir /var/lib/tftpboot
  2⤵
  - Reads runtime system information
  PID:839
- /bin/cp
  cp "release/kwari.*" /var/www/html/bins
  2⤵
  - Reads runtime system information
  PID:840
- /bin/cp
  cp "release/kwari.*" /var/www/html/Binary
  2⤵
  - Reads runtime system information
  PID:841
- /bin/cp
  cp "release/kwari.*" /var/ftp
  2⤵
  - Reads runtime system information
  PID:842
- /bin/cp
  cp "release/kwari.*" /var/lib/tftpboot
  2⤵
  - Reads runtime system information
  PID:843