Analysis
-
max time kernel
132s -
max time network
148s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
07/05/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf
-
Size
103KB
-
MD5
dfb3b9e8f06911fafd67cd01a02d19e7
-
SHA1
6d2b48acc8cc55a612167c1ac60925f43a550f66
-
SHA256
ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270
-
SHA512
dd1271935dd1bbe240a296013d86162f9e81b6a1a62ee180913f47048956e9da121ef4a995cdd7834ba17f49399b905c212d218a2649ba40723e6da2fec5171b
-
SSDEEP
3072:aXaoPUZSK1mVKpn7q6WFjcArKRy3OFP9mRJf:Ca/ZdrqjcAilFPUb
Malware Config
Signatures
-
description ioc Process File truncated /var/log/journal/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/journal/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Modifies PAM framework files 1 IoCs
Modifies Linux PAM framework files, possibly to intercept credentials.
description ioc Process File opened for modification /etc/pam.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /dev/watchdog ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Modifies sudoers policy 1 IoCs
Adds/ Modifies rule files for sudoers policy, likely to grant additional privileges.
description ioc Process File opened for modification /etc/sudoers.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Modifies user home skeleton directory 1 IoCs
Modifies skeleton of initial home directory of newly added system users.
description ioc Process File opened for modification /etc/skel/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Creates/modifies Cron job 1 TTPs 6 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.weekly/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/cron.monthly/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /var/spool/cron/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/cron.daily/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/cron.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/cron.hourly/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Creates/modifies environment variables 1 TTPs 1 IoCs
Creating/modifying environment variables is a common persistence mechanism.
description ioc Process File opened for modification /etc/profile.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Deletes log files 1 TTPs 20 IoCs
Deletes log files on the system.
description ioc Process File deleted /var/log/gdm3/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/apt/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/apt/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/speech-dispatcher/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/audit/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/dist-upgrade/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/cups/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/speech-dispatcher/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/installer/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/hp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/cups/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/installer/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/audit/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/unattended-upgrades/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/dist-upgrade/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/hp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File truncated /var/log/gdm3/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File deleted /var/log/unattended-upgrades/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Modifies rc script 1 TTPs 7 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc4.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/rc6.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/rc0.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/rc5.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/rc2.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/rc3.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /etc/rc1.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Write file to user bin folder 1 TTPs 4 IoCs
description ioc Process File opened for modification /usr/sbin/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /usr/bin/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /usr/local/sbin/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /usr/local/bin/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Writes file to system bin folder 1 TTPs 3 IoCs
description ioc Process File opened for modification /sbin/watchdog ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /sbin/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /bin/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Modifies Bash startup script 1 TTPs 1 IoCs
description ioc Process File opened for modification /etc/profile.d/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Changes its process name 2 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself /bin/bash 1557 Changes the process name, possibly in an attempt to hide itself /bin/bash 1559 -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Enumerates kernel/hardware configuration 1 TTPs 11 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/block ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/module ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/class ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/hypervisor ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/fs ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/bus ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/firmware ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/kernel ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/power ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/devices ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /sys/dev ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/1331/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1354/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/460/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/507/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1067/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1095/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1177/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1196/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1259/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1557/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1044/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1153/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/579/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/678/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/527/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1128/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1163/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1172/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1310/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1525/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/257/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/455/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1179/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1352/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/963/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1104/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1312/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/727/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1073/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1136/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1155/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1297/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/419/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/660/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/968/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/509/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1197/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1547/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/stat ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/479/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/683/exe ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1077/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/971/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/487/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/563/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/526/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/459/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/501/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/948/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1019/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1365/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/504/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/709/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/490/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/611/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1244/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/318/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/445/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1149/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1158/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1198/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/1283/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/549/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for reading /proc/655/fd ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf -
Writes file to tmp directory 21 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.XIM-unix/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/ssh-sRVekHHvf0pe/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/.X11-unix/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-systemd-resolved.service-LqmGXc/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-ModemManager.service-F3VNGY/tmp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-bolt.service-bVLlJz/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/.font-unix/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-systemd-timedated.service-VgDdmh/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-colord.service-9597KE/tmp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-systemd-timedated.service-VgDdmh/tmp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/snap-private-tmp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-fwupd.service-Z6jdZC/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/netplan_259va_85/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-bolt.service-bVLlJz/tmp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-systemd-resolved.service-LqmGXc/tmp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/.Test-unix/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/.ICE-unix/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-colord.service-9597KE/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-fwupd.service-Z6jdZC/tmp/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf File opened for modification /tmp/systemd-private-c63e28dce7ac40ea99359878c8113a6c-ModemManager.service-F3VNGY/.old_cache ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf
Processes
-
/tmp/ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf/tmp/ea4809046bdfd7d519f48b965318cf94fe08498bef0d9eeb305f81f6a5234270.elf1⤵
- Deletes journal logs
- Modifies PAM framework files
- Modifies Watchdog functionality
- Modifies sudoers policy
- Modifies user home skeleton directory
- Creates/modifies Cron job
- Creates/modifies environment variables
- Deletes log files
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Write file to user bin folder
- Writes file to system bin folder
- Modifies Bash startup script
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to shm directory
- Writes file to tmp directory
PID:1555
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Hijack Execution Flow
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
3Hijack Execution Flow
3Scheduled Task/Job
1