Analysis

  • max time kernel
    0s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13/09/2026, 05:58

General

  • Target
    f b i/FBI/loader/build.sh
  • Size 65B
  • Sample260913-gpjwlaff98
  • SHA256 5bb15012ee9420e37caa046eddecbb3c885c4b1a4e189e605c5b1492b6b6ea92
  • MD5 SHA1 SHA512 TLSH
Score
3/10

Malware Config

Signatures

  • Writes file to tmp directory 25 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/f b i/FBI/loader/build.sh
    "/tmp/f b i/FBI/loader/build.sh"
    1⤵
      PID:1479
      • /usr/bin/gcc
        gcc -static -O3 -lpthread -pthread src/binary.c src/connection.c src/main.c src/server.c src/telnet_info.c src/util.c -o loader
        2⤵
        • Writes file to tmp directory
        PID:1480
        • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
          /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D_REENTRANT src/binary.c -quiet -dumpbase binary.c "-mtune=generic" "-march=x86-64" -auxbase binary -O3 -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccYjJqET.s
          3⤵
          • Writes file to tmp directory
          PID:1481
        • /usr/local/sbin/as
          as --64 -o /tmp/ccqrKJoy.o /tmp/ccYjJqET.s
          3⤵
            PID:1486
          • /usr/local/bin/as
            as --64 -o /tmp/ccqrKJoy.o /tmp/ccYjJqET.s
            3⤵
              PID:1486
            • /usr/sbin/as
              as --64 -o /tmp/ccqrKJoy.o /tmp/ccYjJqET.s
              3⤵
                PID:1486
              • /usr/bin/as
                as --64 -o /tmp/ccqrKJoy.o /tmp/ccYjJqET.s
                3⤵
                • Writes file to tmp directory
                PID:1486
              • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
                /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D_REENTRANT src/connection.c -quiet -dumpbase connection.c "-mtune=generic" "-march=x86-64" -auxbase connection -O3 -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccYjJqET.s
                3⤵
                • Writes file to tmp directory
                PID:1487
              • /usr/local/sbin/as
                as --64 -o /tmp/cc41Wcke.o /tmp/ccYjJqET.s
                3⤵
                  PID:1492
                • /usr/local/bin/as
                  as --64 -o /tmp/cc41Wcke.o /tmp/ccYjJqET.s
                  3⤵
                    PID:1492
                  • /usr/sbin/as
                    as --64 -o /tmp/cc41Wcke.o /tmp/ccYjJqET.s
                    3⤵
                      PID:1492
                    • /usr/bin/as
                      as --64 -o /tmp/cc41Wcke.o /tmp/ccYjJqET.s
                      3⤵
                      • Writes file to tmp directory
                      PID:1492
                    • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
                      /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D_REENTRANT src/main.c -quiet -dumpbase main.c "-mtune=generic" "-march=x86-64" -auxbase main -O3 -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccYjJqET.s
                      3⤵
                      • Writes file to tmp directory
                      PID:1493
                    • /usr/local/sbin/as
                      as --64 -o /tmp/ccI0noEU.o /tmp/ccYjJqET.s
                      3⤵
                        PID:1494
                      • /usr/local/bin/as
                        as --64 -o /tmp/ccI0noEU.o /tmp/ccYjJqET.s
                        3⤵
                          PID:1494
                        • /usr/sbin/as
                          as --64 -o /tmp/ccI0noEU.o /tmp/ccYjJqET.s
                          3⤵
                            PID:1494
                          • /usr/bin/as
                            as --64 -o /tmp/ccI0noEU.o /tmp/ccYjJqET.s
                            3⤵
                            • Writes file to tmp directory
                            PID:1494
                          • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
                            /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D_REENTRANT src/server.c -quiet -dumpbase server.c "-mtune=generic" "-march=x86-64" -auxbase server -O3 -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccYjJqET.s
                            3⤵
                            • Writes file to tmp directory
                            PID:1495
                          • /usr/local/sbin/as
                            as --64 -o /tmp/ccWIN3NB.o /tmp/ccYjJqET.s
                            3⤵
                              PID:1497
                            • /usr/local/bin/as
                              as --64 -o /tmp/ccWIN3NB.o /tmp/ccYjJqET.s
                              3⤵
                                PID:1497
                              • /usr/sbin/as
                                as --64 -o /tmp/ccWIN3NB.o /tmp/ccYjJqET.s
                                3⤵
                                  PID:1497
                                • /usr/bin/as
                                  as --64 -o /tmp/ccWIN3NB.o /tmp/ccYjJqET.s
                                  3⤵
                                  • Writes file to tmp directory
                                  PID:1497
                                • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
                                  /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D_REENTRANT src/telnet_info.c -quiet -dumpbase telnet_info.c "-mtune=generic" "-march=x86-64" -auxbase telnet_info -O3 -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccYjJqET.s
                                  3⤵
                                  • Writes file to tmp directory
                                  PID:1498
                                • /usr/local/sbin/as
                                  as --64 -o /tmp/cc8a5Iej.o /tmp/ccYjJqET.s
                                  3⤵
                                    PID:1499
                                  • /usr/local/bin/as
                                    as --64 -o /tmp/cc8a5Iej.o /tmp/ccYjJqET.s
                                    3⤵
                                      PID:1499
                                    • /usr/sbin/as
                                      as --64 -o /tmp/cc8a5Iej.o /tmp/ccYjJqET.s
                                      3⤵
                                        PID:1499
                                      • /usr/bin/as
                                        as --64 -o /tmp/cc8a5Iej.o /tmp/ccYjJqET.s
                                        3⤵
                                        • Writes file to tmp directory
                                        PID:1499
                                      • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
                                        /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu -D_REENTRANT src/util.c -quiet -dumpbase util.c "-mtune=generic" "-march=x86-64" -auxbase util -O3 -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccYjJqET.s
                                        3⤵
                                        • Writes file to tmp directory
                                        PID:1500
                                      • /usr/local/sbin/as
                                        as --64 -o /tmp/ccuc8410.o /tmp/ccYjJqET.s
                                        3⤵
                                          PID:1501
                                        • /usr/local/bin/as
                                          as --64 -o /tmp/ccuc8410.o /tmp/ccYjJqET.s
                                          3⤵
                                            PID:1501
                                          • /usr/sbin/as
                                            as --64 -o /tmp/ccuc8410.o /tmp/ccYjJqET.s
                                            3⤵
                                              PID:1501
                                            • /usr/bin/as
                                              as --64 -o /tmp/ccuc8410.o /tmp/ccYjJqET.s
                                              3⤵
                                              • Writes file to tmp directory
                                              PID:1501
                                            • /usr/lib/gcc/x86_64-linux-gnu/7/collect2
                                              /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccw3UXQI.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_eh" "-plugin-opt=-pass-through=-lpthread" "-plugin-opt=-pass-through=-lc" --build-id -m elf_x86_64 "--hash-style=gnu" --as-needed -static -z relro -o loader /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginT.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. -lpthread /tmp/ccqrKJoy.o /tmp/cc41Wcke.o /tmp/ccI0noEU.o /tmp/ccWIN3NB.o /tmp/cc8a5Iej.o /tmp/ccuc8410.o --start-group -lgcc -lgcc_eh -lpthread -lc --end-group /usr/lib/gcc/x86_64-linux-gnu/7/crtend.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                                              3⤵
                                              • Writes file to tmp directory
                                              PID:1502
                                              • /usr/bin/ld
                                                /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccw3UXQI.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_eh" "-plugin-opt=-pass-through=-lpthread" "-plugin-opt=-pass-through=-lc" --build-id -m elf_x86_64 "--hash-style=gnu" --as-needed -static -z relro -o loader /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginT.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. -lpthread /tmp/ccqrKJoy.o /tmp/cc41Wcke.o /tmp/ccI0noEU.o /tmp/ccWIN3NB.o /tmp/cc8a5Iej.o /tmp/ccuc8410.o --start-group -lgcc -lgcc_eh -lpthread -lc --end-group /usr/lib/gcc/x86_64-linux-gnu/7/crtend.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                                                4⤵
                                                • Writes file to tmp directory
                                                PID:1503

                                        Network

                                              MITRE ATT&CK Matrix

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              cc41Wcke.o

                                              • Path /tmp/cc41Wcke.o
                                              • Size 9KB
                                              • SHA256 89b288cf6f16eaa4d641a6a45b7155d25d8b6e99d20efcf2e7d5d4aab4851bcc
                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                              cc8a5Iej.o

                                              • Path /tmp/cc8a5Iej.o
                                              • Size 3KB
                                              • SHA256 c21d6eefccdd2c5c1f0f58f8ad13a15fa142ef031da1e2696b612d248bc07fb0
                                              • MD5 SHA1 SHA512 TLSH

                                              ccI0noEU.o

                                              • Path /tmp/ccI0noEU.o
                                              • Size 4KB
                                              • SHA256 0fbd4ce401ed7f494cb61f66817faf11ba49925e920ac545f20d573af2a23e09
                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                              ccWIN3NB.o

                                              • Path /tmp/ccWIN3NB.o
                                              • Size 15KB
                                              • SHA256 b3cf73b18857026e9b3e6a761621f434ec6e0ecdd0165ad17651bf92e67a91a0
                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                              ccYjJqET.s

                                              • Path /tmp/ccYjJqET.s
                                              • Size 23KB
                                              • SHA256 5cdc62eee3c60a4cfc3f53fc769c2f5f5a0e83a60cd6eb0560f4a909d7c4c534
                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                              ccYjJqET.s

                                              • Path /tmp/ccYjJqET.s
                                              • Size 5KB
                                              • SHA256 be43bf3daee3dd81c4042d73ac6f49c2951c42c350363d8b65fe0428171ee1bb
                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                              ccYjJqET.s

                                              • Path /tmp/ccYjJqET.s
                                              • Size 4KB
                                              • SHA256 c5d689c9e8658fbfd49fcc13dd0bd9b5f3bd0e7907eaeb557d38fbfe4704b514
                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                              ccYjJqET.s

                                              • Path /tmp/ccYjJqET.s
                                              • Size 21KB
                                              • SHA256 6a8a73a6a8d6bbe53aadfe59b9c8ee11f799608d5613c2504f674dfbcc83292c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                              ccYjJqET.s

                                              • Path /tmp/ccYjJqET.s
                                              • Size 4KB
                                              • SHA256 f9bbf39aa19da1a34745315b01434cde9d4cf829e9c1b7663c24d9d153bcf7c6
                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                              ccqrKJoy.o

                                              • Path /tmp/ccqrKJoy.o
                                              • Size 3KB
                                              • SHA256 96704fcaf676586be9eccd259104c06a6bcef0db6080148d92a5655029b66373
                                              • MD5 SHA1 SHA512 TLSH

                                              ccuc8410.o

                                              • Path /tmp/ccuc8410.o
                                              • Size 3KB
                                              • SHA256 b84b499b59d67eb24987781fd51e8737389d72300ec31afbf583adc74bb22874
                                              • MD5 SHA1 SHA512 TLSH

                                              loader

                                              • Path /tmp/f b i/FBI/loader/loader
                                              • Size 1.5MB
                                              • SHA256 c360538faad2756c20a7098877fc02253859d012af3ed79381f2d217749352f8
                                              • MD5 SHA1 SHA512 SSDEEP TLSH