31e2c2ac1dd608c0853adfb9a202706cf639a092ccd30d44fcd4354ae2039d62

Analysis

max time kernel
148s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/05/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8USDaF.x86
Size 64KB
Sample260510-g44vbads2j
SHA256 31e2c2ac1dd608c0853adfb9a202706cf639a092ccd30d44fcd4354ae2039d62
MD5 e0ab380b124bbbfdf1d4c9f6f408f0f0
SHA1 d8b340c3ae024a3f3efb148411423d4cb4738571
SHA512 c056b2e4c540c44b3b6095ec51a14ed05db43407c5a05441e330666243f3f764be694bd772bddbf975ab371b29e1ffa71b9f37b9387c6539ba75a8c37c545ec9
SSDEEP 1536:KOD7auvQni0cnfkmpUF+KhFfF+jZ0ux/fLd5hcmNWb:xD7auvQni0cflpo+cFfc10mfLbI
TLSH
T1D6530B82BA41C677E10320F112F6CB621631FF3B6822E55EE7A57D71D7246C0A62277D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Deletes itself 2 IoCs

pid	Process
1529	4
1538	4

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	4
File opened for modification	/dev/misc/watchdog	4

Runs EXE from memory 1 IoCs

Runs an executable from memory, likely to minimize footprint

ioc	pid	Process
/proc/self/fd/4	1529	8USDaF.x86

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/161/maps	4
File opened for reading	/proc/165/maps	4
File opened for reading	/proc/16/maps	4
File opened for reading	/proc/17/maps	4
File opened for reading	/proc/169/maps	4
File opened for reading	/proc/173/maps	4
File opened for reading	/proc/23/maps	4
File opened for reading	/proc/35/maps	4
File opened for reading	/proc/115/maps	4
File opened for reading	/proc/164/maps	4
File opened for reading	/proc/5/maps	4
File opened for reading	/proc/11/maps	4
File opened for reading	/proc/28/maps	4
File opened for reading	/proc/79/maps	4
File opened for reading	/proc/175/maps	4
File opened for reading	/proc/178/maps	4
File opened for reading	/proc/9/maps	4
File opened for reading	/proc/22/maps	4
File opened for reading	/proc/168/maps	4
File opened for reading	/proc/82/maps	4
File opened for reading	/proc/204/maps	4
File opened for reading	/proc/7/maps	4
File opened for reading	/proc/20/maps	4
File opened for reading	/proc/30/maps	4
File opened for reading	/proc/80/maps	4
File opened for reading	/proc/167/maps	4
File opened for reading	/proc/203/maps	4
File opened for reading	/proc/8/maps	4
File opened for reading	/proc/25/maps	4
File opened for reading	/proc/159/maps	4
File opened for reading	/proc/19/maps	4
File opened for reading	/proc/21/maps	4
File opened for reading	/proc/29/maps	4
File opened for reading	/proc/89/maps	4
File opened for reading	/proc/162/maps	4
File opened for reading	/proc/12/maps	4
File opened for reading	/proc/13/maps	4
File opened for reading	/proc/27/maps	4
File opened for reading	/proc/31/maps	4
File opened for reading	/proc/78/maps	4
File opened for reading	/proc/163/maps	4
File opened for reading	/proc/170/maps	4
File opened for reading	/proc/171/maps	4
File opened for reading	/proc/4/maps	4
File opened for reading	/proc/6/maps	4
File opened for reading	/proc/10/maps	4
File opened for reading	/proc/26/maps	4
File opened for reading	/proc/81/maps	4
File opened for reading	/proc/98/maps	4
File opened for reading	/proc/176/maps	4
File opened for reading	/proc/3/maps	4
File opened for reading	/proc/24/maps	4
File opened for reading	/proc/83/maps	4
File opened for reading	/proc/160/maps	4
File opened for reading	/proc/86/maps	4
File opened for reading	/proc/172/maps	4
File opened for reading	/proc/18/maps	4
File opened for reading	/proc/36/maps	4
File opened for reading	/proc/174/maps	4
File opened for reading	/proc/2/maps	4
File opened for reading	/proc/14/maps	4
File opened for reading	/proc/15/maps	4
File opened for reading	/proc/32/maps	4
File opened for reading	/proc/34/maps	4

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	uucp	1529	4

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1525/maps	4
File opened for reading	/proc/1526/maps	4
File opened for reading	/proc/1527/maps	4
File opened for reading	/proc/self/exe	8USDaF.x86

/tmp/8USDaF.x86
/tmp/8USDaF.x86
1⤵
- Runs EXE from memory
- Reads runtime system information
PID:1529

/proc/self/fd/4
/tmp/8USDaF.x86
1⤵
- Deletes itself
- Modifies Watchdog functionality
- Reads process memory
- Changes its process name
- Reads runtime system information
PID:1529

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /proc/self/fd/4
Size 64KB
SHA256 31e2c2ac1dd608c0853adfb9a202706cf639a092ccd30d44fcd4354ae2039d62
MD5 e0ab380b124bbbfdf1d4c9f6f408f0f0
SHA1 d8b340c3ae024a3f3efb148411423d4cb4738571
SHA512 c056b2e4c540c44b3b6095ec51a14ed05db43407c5a05441e330666243f3f764be694bd772bddbf975ab371b29e1ffa71b9f37b9387c6539ba75a8c37c545ec9
SSDEEP 1536:KOD7auvQni0cnfkmpUF+KhFfF+jZ0ux/fLd5hcmNWb:xD7auvQni0cflpo+cFfc10mfLbI
TLSH
T1D6530B82BA41C677E10320F112F6CB621631FF3B6822E55EE7A57D71D7246C0A62277D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download