Overview

overview

3

Static

static

1

gdbgo2.sh

ubuntu-18.04-amd64

3

gdbgo2.sh

debian-9-armhf

3

gdbgo2.sh

debian-9-mips

3

gdbgo2.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    1s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    07/11/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    gdbgo2.sh
  • Size 881B
  • Sample261107-phyeeabx4w
  • SHA256 cc092a173ae2c5e66e89493ab2240579b919c53baf2da20e974756bfcbcd1ae8
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/gdbgo2.sh
    /tmp/gdbgo2.sh
    1⤵
    • Writes file to tmp directory
    PID:707
    • /bin/grep
      grep -oP "\\[heap\\]" -B0 /tmp/gdbrun_56_54_63_212.txt
      2⤵
        PID:716
      • /bin/grep
        grep -E heap /tmp/gdbrun_56_54_63_212.txt
        2⤵
          PID:721
        • /usr/bin/head
          head -1
          2⤵
            PID:722
          • /usr/bin/cut
            cut -d- -f1
            2⤵
              PID:724
            • /usr/bin/awk
              awk "{print \$1}"
              2⤵
              • Reads runtime system information
              PID:723
            • /bin/grep
              grep -E heap /tmp/gdbrun_56_54_63_212.txt
              2⤵
                PID:729
              • /usr/bin/head
                head -1
                2⤵
                  PID:730
                • /usr/bin/awk
                  awk "{print \$1}"
                  2⤵
                  • Reads runtime system information
                  PID:731
                • /usr/bin/cut
                  cut -d- -f2
                  2⤵
                    PID:732
                  • /usr/bin/tail
                    tail -20 /tmp/gdbrun_56_54_63_212.txt
                    2⤵
                      PID:735

                  Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        gdbrun_56_54_63_212.txt
                        • Path /tmp/gdbrun_56_54_63_212.txt
                        • Size 47B
                        • SHA256 26ed4a56a56650b147ea0fb2a91aa9f7baf993c6abd07e9efa31d9b9528aacb7
                        • MD5 SHA1 SHA512
                        Submit Download