Overview
overview
6Static
static
1starlight_....0.tar
windows10-2004-x64
1starlight_....0.tar
windows11-ltsc_2024-x64
1starlight/50default
ubuntu-18.04-amd64
1starlight/50default
debian-9-armhf
1starlight/50default
debian-9-mips
1starlight/50default
debian-9-mipsel
1starlight/...ity.sh
ubuntu-18.04-amd64
1starlight/...ity.sh
debian-9-armhf
1starlight/...ity.sh
debian-9-mips
1starlight/...ity.sh
debian-9-mipsel
1starlight/...un0.sh
windows10-2004-x64
3starlight/...un0.sh
windows11-ltsc_2024-x64
3starlight/...ver.sh
ubuntu-18.04-amd64
1starlight/...ver.sh
debian-9-armhf
1starlight/...ver.sh
debian-9-mips
1starlight/...ver.sh
debian-9-mipsel
1starlight/...tor.py
windows10-2004-x64
3starlight/...tor.py
windows11-ltsc_2024-x64
3starlight/..._ip.sh
ubuntu-18.04-amd64
3starlight/..._ip.sh
debian-9-armhf
3starlight/..._ip.sh
debian-9-mips
3starlight/..._ip.sh
debian-9-mipsel
3starlight/...ate.sh
ubuntu-18.04-amd64
3starlight/...ate.sh
debian-9-armhf
3starlight/...ate.sh
debian-9-mips
3starlight/...ate.sh
debian-9-mipsel
3starlight/...x2.pub
windows10-2004-x64
3starlight/...x2.pub
windows11-ltsc_2024-x64
3starlight/...ins.sh
windows10-2004-x64
3starlight/...ins.sh
windows11-ltsc_2024-x64
3starlight/...pid.sh
ubuntu-18.04-amd64
6starlight/...pid.sh
debian-9-armhf
6Analysis
- max time kernel
0s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
20/10/2026, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
starlight_proto_package_v2.5.0.tar
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
starlight_proto_package_v2.5.0.tar
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
starlight/50default
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
starlight/50default
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral5
Sample
starlight/50default
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral6
Sample
starlight/50default
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral7
Sample
starlight/base_connectivity.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
starlight/base_connectivity.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral9
Sample
starlight/base_connectivity.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral10
Sample
starlight/base_connectivity.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral11
Sample
starlight/check_tun0.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
starlight/check_tun0.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
starlight/configure_ntpserver.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
starlight/configure_ntpserver.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral15
Sample
starlight/configure_ntpserver.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral16
Sample
starlight/configure_ntpserver.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
starlight/controller_connection_monitor.py
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
starlight/controller_connection_monitor.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
starlight/get_all_interface_ip.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
starlight/get_all_interface_ip.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
starlight/get_all_interface_ip.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
starlight/get_all_interface_ip.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
starlight/host_file_update.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
starlight/host_file_update.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
starlight/host_file_update.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
starlight/host_file_update.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
starlight/id_rsa_ox2.pub
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
starlight/id_rsa_ox2.pub
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
starlight/initledgpiopins.sh
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
starlight/initledgpiopins.sh
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
starlight/kill_iperf_pid.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
Behavioral task
behavioral32
Sample
starlight/kill_iperf_pid.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
General
- Target starlight/kill_iperf_pid.sh
- Size 860B
- Sample261020-p6ebfabf85
- SHA256 c37fa2a473a22958cc8beea83744ee31f77a5dfb21d0227bfaef82bffb6092bc
- MD5 b2d7d83c366e5283806e3582e9bbdbc0
- SHA1 02262850e73bb52c015707b71a3f8f823c8c42b7
- SHA512 26542531f6563f72b2b8f1cedb91e82d8c1338d92536870a3e4d7f2e42fe987660c391f6d5a7b7fcd8bb182057568a2870aea022b78c09171c347c0f329f87bd
- TLSH T1E011C209608F687D5DEC4059155D30B52F48C60B8BB5513C7CACEDCAFFE156D30E0681
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/26/status ps File opened for reading /proc/27/status ps File opened for reading /proc/27/cmdline ps File opened for reading /proc/105/stat ps File opened for reading /proc/165/cmdline ps File opened for reading /proc/223/cmdline ps File opened for reading /proc/17/status ps File opened for reading /proc/41/status ps File opened for reading /proc/154/cmdline ps File opened for reading /proc/282/stat ps File opened for reading /proc/288/status ps File opened for reading /proc/292/status ps File opened for reading /proc/651/cmdline ps File opened for reading /proc/657/status ps File opened for reading /proc/2/status ps File opened for reading /proc/4/status ps File opened for reading /proc/9/cmdline ps File opened for reading /proc/11/stat ps File opened for reading /proc/21/status ps File opened for reading /proc/24/status ps File opened for reading /proc/42/cmdline ps File opened for reading /proc/585/stat ps File opened for reading /proc/25/status ps File opened for reading /proc/43/cmdline ps File opened for reading /proc/72/status ps File opened for reading /proc/15/status ps File opened for reading /proc/2/cmdline ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/8/cmdline ps File opened for reading /proc/13/status ps File opened for reading /proc/12/stat ps File opened for reading /proc/24/stat ps File opened for reading /proc/130/status ps File opened for reading /proc/315/status ps File opened for reading /proc/320/stat ps File opened for reading /proc/585/status ps File opened for reading /proc/586/status ps File opened for reading /proc/644/stat ps File opened for reading /proc/filesystems ps File opened for reading /proc/102/status ps File opened for reading /proc/282/cmdline ps File opened for reading /proc/580/status ps File opened for reading /proc/637/cmdline ps File opened for reading /proc/659/stat ps File opened for reading /proc/659/status ps File opened for reading /proc/16/cmdline ps File opened for reading /proc/18/cmdline ps File opened for reading /proc/20/stat ps File opened for reading /proc/658/stat ps File opened for reading /proc/665/stat ps File opened for reading /proc/665/cmdline ps File opened for reading /proc/19/status ps File opened for reading /proc/105/cmdline ps File opened for reading /proc/561/cmdline ps File opened for reading /proc/28/status ps File opened for reading /proc/132/cmdline ps File opened for reading /proc/294/status ps File opened for reading /proc/561/status ps File opened for reading /proc/629/status ps File opened for reading /proc/631/stat ps File opened for reading /proc/305/status ps File opened for reading /proc/628/stat ps File opened for reading /proc/16/status ps File opened for reading /proc/3/stat ps - System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 651 kill_iperf_pid.sh 659 grep
Processes
-
/tmp/starlight/kill_iperf_pid.sh/tmp/starlight/kill_iperf_pid.sh1⤵
- System Network Configuration Discovery
PID:651 -
/bin/grepgrep iperf32⤵
- System Network Configuration Discovery
PID:659
-
-
/bin/grepgrep2⤵PID:661
-
-
/bin/psps -aef2⤵
- Reads CPU attributes
- Reads runtime system information
PID:658
-
-
/bin/grepgrep2⤵PID:662
-
-
/bin/grepgrep -v sh2⤵PID:663
-
-
/usr/bin/awkawk "{ if (\$1 == \"root\") {print \$2} else {print \$1}}"2⤵PID:664
-