55f231ae9e58dad16c1fae908b28257794a1a621019f2670bbd33ff5e244fa56

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/10/2026, 12:56

Target
starlight/host_file_update.sh
Size 4KB
Sample261020-p6ebfabf85
SHA256 55f231ae9e58dad16c1fae908b28257794a1a621019f2670bbd33ff5e244fa56
MD5 23a2ce4ae02cdef5a3c46d85fb304ff9
SHA1 93849c74897a989ee76de95af4f21e9511434611
SHA512 cb0fe4a778b44da5fcaef01d75d2075c2fcbd0692c14e29a5b1b7941841a4e7e452337b99a83ac845c30a024defc6d493b9e4deb1f671ee3df18f3bbcae94165
SSDEEP 96:U8IDCPx7hQopsfueSUeoe/YFGRxvRBSRWsHE5:JPA5RxtGRxvRBSRWsk5
TLSH
T19D91931A96E0CD7C13B6C4ADBA4B5006170BD65750C40C247F9CD9881FC2E6863FEBAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

/tmp/starlight/host_file_update.sh
/tmp/starlight/host_file_update.sh
1⤵
PID:657
- /bin/rm
  rm /opt/starlight/nsresolver_log.txt
  2⤵
  PID:662
- /bin/date
  date "+%d/%m/%Y %H:%M:%S"
  2⤵
  PID:663
- /bin/cat
  cat /opt/starlight/Edge_config.txt
  2⤵
  PID:668
- /bin/grep
  grep CONTROLLER_BROKER_ADDR
  2⤵
  PID:669
- /bin/sed
  sed "s/\\\"//g"
  2⤵
  - Reads runtime system information
  PID:671
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:670
- /bin/sed
  sed "s/\\,//g"
  2⤵
  - Reads runtime system information
  PID:672
- /bin/grep
  grep ://
  2⤵
  PID:680
- /usr/bin/cut
  cut -d: -f1
  2⤵
  PID:683
- /bin/mv
  mv /etc/hosts /etc/hosts.backup
  2⤵
  - Reads runtime system information
  PID:684
- /bin/rm
  rm /opt/starlight/nslookup_output.txt
  2⤵
  PID:686
- /bin/mv
  mv /etc/hosts.backup /etc/hosts
  2⤵
  - Reads runtime system information
  PID:687
- /bin/sleep
  sleep 300
  2⤵
  PID:689