Analysis
- max time kernel
142s - max time network
143s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
17/05/2026, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
bot.elf
Resource
ubuntu1804-amd64-20260513-en
3 signatures
150 seconds
General
- Target bot.elf
- Size 5.6MB
- Sample260517-b2sflse15p
- SHA256 d6a241bfcf54553ce86c0ebf2cf3bbed6728df4991d2bac58f2b7e2359b9dfe8
- MD5 a77a6d833e14a0e67e13ea1e6f1ab756
- SHA1 237f1bfcd321eabb7f9ce5e9b0ade92007ffca8e
- SHA512 14510755f22bfa6c1d5311236d3d631bc82f588e71697803306a34a8e540d26dccb1328f0ee58d0b6742a711856bce594761dca15a0acdacb3f3baaa451e79d0
- SSDEEP 98304:H3slOAFuCjKV5PpHANDr2A+UEwhkKL7zD8mIbMF2Y3Yy0879syuFM4WxMHww6:7AjhkDmxF2Y3Yz87CyiM4WxMHww6
- TLSH T186466C06B5B315AEC09AC430876FC6136D35F85496327D7B3A849E342EE6E245F2EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1490 bot.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ksoftirqd/0 1490 bot.elf - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.sys_lock bot.elf
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.sys_lock
- Size 5B
- SHA256 7dece897a0fe55691ff1d0ace49dcbf3a09fa4194595b5bd02f123dc9fa67473
- MD5 2ae6c2cddc993540ef9a062a4fc52109
- SHA1 8b4dc8c63d2326711a551c5fed0864dd41ebc42e
- SHA512 975161c83b634c1cc900863e65d7d7aa8ac11dda84178c70aaeaecb497adb75c4fcd656aeaa0859845051cef7e4a3040b230c50cdc42d08531179cd5d99cb746
- MD5 SHA1 SHA512