General
- Target gpon.sh
- Size 2KB
- Sample261027-mgqbastsby
- SHA256 881be033c2f28e7f3ad6bb7299809fba8a399b10ce389c5cf6191412b556a473
- MD5 c33c3e3da7d64f32f554dd3dd8e29f90
- SHA1 fbb442c61bf7e91da41f6e1dea174ce4842536ee
- SHA512 c11bf6e48fb7dc4fe6b62dbe6123ab399a277f147f013c1bcb9a5d69a04f52f85c4954e39b8eec914e82e4b80d62a0b81c9f9dc727647bb2fd733489cf2e9002
- TLSH T16B5144C50373C978796AFD4F3DE68B14B980B4916CC6AA84B5EC79EC05CEE39584C14B
- MD5 SHA1 SHA512 TLSH
Score
7/10
Static task
static1
Behavioral task
behavioral1
Sample
gpon.sh
Resource
ubuntu1804-amd64-20261019-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
gpon.sh
Resource
debian9-armhf-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
gpon.sh
Resource
debian9-mipsbe-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
gpon.sh
Resource
debian9-mipsel-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target gpon.sh
- Size 2KB
- SHA256 881be033c2f28e7f3ad6bb7299809fba8a399b10ce389c5cf6191412b556a473
- MD5 c33c3e3da7d64f32f554dd3dd8e29f90
- SHA1 fbb442c61bf7e91da41f6e1dea174ce4842536ee
- SHA512 c11bf6e48fb7dc4fe6b62dbe6123ab399a277f147f013c1bcb9a5d69a04f52f85c4954e39b8eec914e82e4b80d62a0b81c9f9dc727647bb2fd733489cf2e9002
- TLSH T16B5144C50373C978796AFD4F3DE68B14B980B4916CC6AA84B5EC79EC05CEE39584C14B
- MD5 SHA1 SHA512 TLSH
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Executes dropped EXE
-
Traces itself
Traces itself to prevent debugging attempts
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1