Overview
overview
6Static
static
1starlight_....0.tar
windows10-2004-x64
1starlight_....0.tar
windows11-ltsc_2024-x64
1starlight/50default
ubuntu-18.04-amd64
1starlight/50default
debian-9-armhf
1starlight/50default
debian-9-mips
1starlight/50default
debian-9-mipsel
1starlight/...ity.sh
ubuntu-18.04-amd64
1starlight/...ity.sh
debian-9-armhf
1starlight/...ity.sh
debian-9-mips
1starlight/...ity.sh
debian-9-mipsel
1starlight/...un0.sh
windows10-2004-x64
3starlight/...un0.sh
windows11-ltsc_2024-x64
3starlight/...ver.sh
ubuntu-18.04-amd64
1starlight/...ver.sh
debian-9-armhf
1starlight/...ver.sh
debian-9-mips
1starlight/...ver.sh
debian-9-mipsel
1starlight/...tor.py
windows10-2004-x64
3starlight/...tor.py
windows11-ltsc_2024-x64
3starlight/..._ip.sh
ubuntu-18.04-amd64
3starlight/..._ip.sh
debian-9-armhf
3starlight/..._ip.sh
debian-9-mips
3starlight/..._ip.sh
debian-9-mipsel
3starlight/...ate.sh
ubuntu-18.04-amd64
3starlight/...ate.sh
debian-9-armhf
3starlight/...ate.sh
debian-9-mips
3starlight/...ate.sh
debian-9-mipsel
3starlight/...x2.pub
windows10-2004-x64
3starlight/...x2.pub
windows11-ltsc_2024-x64
3starlight/...ins.sh
windows10-2004-x64
3starlight/...ins.sh
windows11-ltsc_2024-x64
3starlight/...pid.sh
ubuntu-18.04-amd64
6starlight/...pid.sh
debian-9-armhf
6Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
20/10/2026, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
starlight_proto_package_v2.5.0.tar
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
starlight_proto_package_v2.5.0.tar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
starlight/50default
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
starlight/50default
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral5
Sample
starlight/50default
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral6
Sample
starlight/50default
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral7
Sample
starlight/base_connectivity.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
starlight/base_connectivity.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral9
Sample
starlight/base_connectivity.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral10
Sample
starlight/base_connectivity.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral11
Sample
starlight/check_tun0.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
starlight/check_tun0.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
starlight/configure_ntpserver.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
starlight/configure_ntpserver.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral15
Sample
starlight/configure_ntpserver.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral16
Sample
starlight/configure_ntpserver.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
starlight/controller_connection_monitor.py
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
starlight/controller_connection_monitor.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
starlight/get_all_interface_ip.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
starlight/get_all_interface_ip.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
starlight/get_all_interface_ip.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
starlight/get_all_interface_ip.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
starlight/host_file_update.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
starlight/host_file_update.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
starlight/host_file_update.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
starlight/host_file_update.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
starlight/id_rsa_ox2.pub
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
starlight/id_rsa_ox2.pub
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
starlight/initledgpiopins.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
starlight/initledgpiopins.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
starlight/kill_iperf_pid.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral32
Sample
starlight/kill_iperf_pid.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
General
- Target starlight/kill_iperf_pid.sh
- Size 860B
- Sample261020-p6ebfabf85
- SHA256 c37fa2a473a22958cc8beea83744ee31f77a5dfb21d0227bfaef82bffb6092bc
- MD5 b2d7d83c366e5283806e3582e9bbdbc0
- SHA1 02262850e73bb52c015707b71a3f8f823c8c42b7
- SHA512 26542531f6563f72b2b8f1cedb91e82d8c1338d92536870a3e4d7f2e42fe987660c391f6d5a7b7fcd8bb182057568a2870aea022b78c09171c347c0f329f87bd
- TLSH T1E011C209608F687D5DEC4059155D30B52F48C60B8BB5513C7CACEDCAFFE156D30E0681
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/457/status ps File opened for reading /proc/562/stat ps File opened for reading /proc/1089/status ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/115/stat ps File opened for reading /proc/164/stat ps File opened for reading /proc/347/status ps File opened for reading /proc/562/status ps File opened for reading /proc/601/status ps File opened for reading /proc/652/cmdline ps File opened for reading /proc/940/cmdline ps File opened for reading /proc/167/cmdline ps File opened for reading /proc/435/cmdline ps File opened for reading /proc/705/stat ps File opened for reading /proc/17/cmdline ps File opened for reading /proc/20/stat ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/35/cmdline ps File opened for reading /proc/166/status ps File opened for reading /proc/466/cmdline ps File opened for reading /proc/554/stat ps File opened for reading /proc/1019/cmdline ps File opened for reading /proc/4/stat ps File opened for reading /proc/1045/cmdline ps File opened for reading /proc/1069/status ps File opened for reading /proc/1507/status ps File opened for reading /proc/32/stat ps File opened for reading /proc/160/status ps File opened for reading /proc/525/stat ps File opened for reading /proc/652/status ps File opened for reading /proc/963/stat ps File opened for reading /proc/78/stat ps File opened for reading /proc/554/status ps File opened for reading /proc/1019/status ps File opened for reading /proc/14/cmdline ps File opened for reading /proc/1341/status ps File opened for reading /proc/1375/cmdline ps File opened for reading /proc/stat ps File opened for reading /proc/25/stat ps File opened for reading /proc/29/status ps File opened for reading /proc/1006/cmdline ps File opened for reading /proc/493/stat ps File opened for reading /proc/1086/stat ps File opened for reading /proc/1122/status ps File opened for reading /proc/158/cmdline ps File opened for reading /proc/1064/status ps File opened for reading /proc/1342/stat ps File opened for reading /proc/82/status ps File opened for reading /proc/175/cmdline ps File opened for reading /proc/926/stat ps File opened for reading /proc/995/stat ps File opened for reading /proc/1483/cmdline ps File opened for reading /proc/20/cmdline ps File opened for reading /proc/23/stat ps File opened for reading /proc/1035/stat ps File opened for reading /proc/1325/cmdline ps File opened for reading /proc/466/status ps File opened for reading /proc/489/cmdline ps File opened for reading /proc/1303/stat ps File opened for reading /proc/1/status ps File opened for reading /proc/2/status ps File opened for reading /proc/10/cmdline ps File opened for reading /proc/11/stat ps File opened for reading /proc/84/stat ps - System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1514 kill_iperf_pid.sh 1517 grep
Processes
-
/tmp/starlight/kill_iperf_pid.sh/tmp/starlight/kill_iperf_pid.sh1⤵
- System Network Configuration Discovery
PID:1514 -
/bin/grepgrep2⤵PID:1518
-
-
/bin/grepgrep iperf32⤵
- System Network Configuration Discovery
PID:1517
-
-
/bin/grepgrep2⤵PID:1519
-
-
/bin/grepgrep -v sh2⤵PID:1520
-
-
/bin/psps -aef2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1516
-
-
/usr/bin/awkawk "{ if (\$1 == \"root\") {print \$2} else {print \$1}}"2⤵PID:1521
-