Overview

overview

3

Static

static

1

gdbgo2.sh

ubuntu-18.04-amd64

3

gdbgo2.sh

debian-9-armhf

3

gdbgo2.sh

debian-9-mips

3

gdbgo2.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    0s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    07/11/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    gdbgo2.sh
  • Size 881B
  • Sample261107-phyeeabx4w
  • SHA256 cc092a173ae2c5e66e89493ab2240579b919c53baf2da20e974756bfcbcd1ae8
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/gdbgo2.sh
    /tmp/gdbgo2.sh
    1⤵
    • Writes file to tmp directory
    PID:1519
    • /usr/bin/gdb
      gdb -batch -ex "set confirm off" -ex "set pagination off" -ex run -ex "printf \"SIGABRT caught\\n\"" -ex "info proc mappings" -ex "p \$pc" --args /tmp/.a/runner 56 54 63 212
      2⤵
      • Reads runtime system information
      PID:1520
      • /usr/local/sbin/iconv
        iconv -l
        3⤵
          PID:1523
        • /usr/local/bin/iconv
          iconv -l
          3⤵
            PID:1523
          • /usr/sbin/iconv
            iconv -l
            3⤵
              PID:1523
            • /usr/bin/iconv
              iconv -l
              3⤵
                PID:1523
            • /bin/grep
              grep -oP "\\[heap\\]" -B0 /tmp/gdbrun_56_54_63_212.txt
              2⤵
                PID:1525
              • /usr/bin/cut
                cut -d- -f1
                2⤵
                  PID:1529
                • /bin/grep
                  grep -E heap /tmp/gdbrun_56_54_63_212.txt
                  2⤵
                    PID:1526
                  • /usr/bin/awk
                    awk "{print \$1}"
                    2⤵
                    • Reads runtime system information
                    PID:1528
                  • /usr/bin/head
                    head -1
                    2⤵
                      PID:1527
                    • /usr/bin/head
                      head -1
                      2⤵
                        PID:1533
                      • /usr/bin/awk
                        awk "{print \$1}"
                        2⤵
                        • Reads runtime system information
                        PID:1534
                      • /bin/grep
                        grep -E heap /tmp/gdbrun_56_54_63_212.txt
                        2⤵
                          PID:1532
                        • /usr/bin/cut
                          cut -d- -f2
                          2⤵
                            PID:1535
                          • /usr/bin/tail
                            tail -20 /tmp/gdbrun_56_54_63_212.txt
                            2⤵
                              PID:1539

                          Network

                                MITRE ATT&CK Matrix

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                gdbrun_56_54_63_212.txt
                                • Path /tmp/gdbrun_56_54_63_212.txt
                                • Size 180B
                                • SHA256 b8c8be5c9d4a338c29664071734504d5646a0b67225ee2cf161c1c030789bc56
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                __init__.cpython-36.pyc.140275278557792
                                • Path /usr/share/gdb/python/gdb/__pycache__/__init__.cpython-36.pyc.140275278557792
                                • Size 3KB
                                • SHA256 984f4f3973a2fca8333de1b24129d8ee2c790f8fc2e06dfb4b0214d59048cbc1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                __init__.cpython-36.pyc.140275277563224
                                • Path /usr/share/gdb/python/gdb/command/__pycache__/__init__.cpython-36.pyc.140275277563224
                                • Size 128B
                                • SHA256 392dbf8bdba6c3f175670db3162d7899606403f914c0e38119cba50de2fbd054
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                __init__.cpython-36.pyc.140275277562624
                                • Path /usr/share/gdb/python/gdb/function/__pycache__/__init__.cpython-36.pyc.140275277562624
                                • Size 129B
                                • SHA256 0e931d4b20a1be6c54d9797c8b2a2ee9972d7fe01bb40ca7cb3754e125bfe4eb
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                __init__.cpython-36.pyc.140275276444296
                                • Path /usr/share/gdb/python/gdb/printer/__pycache__/__init__.cpython-36.pyc.140275276444296
                                • Size 128B
                                • SHA256 1ffb6ac93a9bcb8f0d346976772320bd9c04a1d4cd54db6d0127066f0c4faf21
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download