6eb41061b35b36e30f7b1d62b45714b157ec83ec6f0d1e10bc79c71350db7f2d

Analysis

max time kernel
143s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
17/05/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
Size 945KB
Sample260517-fnfbcaf12q
SHA256 6eb41061b35b36e30f7b1d62b45714b157ec83ec6f0d1e10bc79c71350db7f2d
MD5 73335c040aeef3f06266fbb4539477ad
SHA1 4e2b4ba3993c66d018c3c17aace6e6f8e9d10eb4
SHA512 6baab37f59011b0ab8963efc80c0860c20a1419bee18d8bb0fabb7536412d76698776094ed440b4e83ce58f0df72f4bba5b44324fc9e4e6b4f5e519c94813b02
SSDEEP 24576:3BbYiNOByyjvH3+/UcCynrvxwExjoDj8SxWkHPVx6:3BHnyjvH3+/UcCynrJwA0TTHn6
TLSH
T1DD25E116E541E0B5D4A350F2111FE3F689246B34891789CBFF49DE796A3A1E0EF2930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Deletes itself 4 IoCs

pid	Process
1494	2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
1496	.x58d641d1876acf74
1496	.x58d641d1876acf74
1496	.x58d641d1876acf74

Executes dropped EXE 1 IoCs

ioc	pid	Process
/root/.x58d641d1876acf74	1496	2026-05-17_73335c040aeef3f06266fbb4539477ad_akira

Traces itself 5 IoCs

Traces itself to prevent debugging attempts

pid	Process
1497	.x58d641d1876acf74
1516	.x58d641d1876acf74
1518	.x58d641d1876acf74
1519	.x58d641d1876acf74
1521	.x58d641d1876acf74

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.pBilZZ	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/.kworker	.x58d641d1876acf74

Reads MAC address of network interface 2 TTPs 4 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/wlan0/address	.x58d641d1876acf74
File opened for reading	/sys/class/net/ens33/address	.x58d641d1876acf74
File opened for reading	/sys/class/net/enp0s3/address	.x58d641d1876acf74
File opened for reading	/sys/class/net/eth0/address	.x58d641d1876acf74

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/7/maps	.x58d641d1876acf74
File opened for reading	/proc/19/maps	.x58d641d1876acf74
File opened for reading	/proc/86/maps	.x58d641d1876acf74
File opened for reading	/proc/164/maps	.x58d641d1876acf74
File opened for reading	/proc/15/maps	.x58d641d1876acf74
File opened for reading	/proc/24/maps	.x58d641d1876acf74
File opened for reading	/proc/89/maps	.x58d641d1876acf74
File opened for reading	/proc/115/maps	.x58d641d1876acf74
File opened for reading	/proc/178/maps	.x58d641d1876acf74
File opened for reading	/proc/30/maps	.x58d641d1876acf74
File opened for reading	/proc/32/maps	.x58d641d1876acf74
File opened for reading	/proc/34/maps	.x58d641d1876acf74
File opened for reading	/proc/17/maps	.x58d641d1876acf74
File opened for reading	/proc/80/maps	.x58d641d1876acf74
File opened for reading	/proc/84/maps	.x58d641d1876acf74
File opened for reading	/proc/159/maps	.x58d641d1876acf74
File opened for reading	/proc/160/maps	.x58d641d1876acf74
File opened for reading	/proc/27/maps	.x58d641d1876acf74
File opened for reading	/proc/169/maps	.x58d641d1876acf74
File opened for reading	/proc/174/maps	.x58d641d1876acf74
File opened for reading	/proc/4/maps	.x58d641d1876acf74
File opened for reading	/proc/16/maps	.x58d641d1876acf74
File opened for reading	/proc/20/maps	.x58d641d1876acf74
File opened for reading	/proc/25/maps	.x58d641d1876acf74
File opened for reading	/proc/21/maps	.x58d641d1876acf74
File opened for reading	/proc/204/maps	.x58d641d1876acf74
File opened for reading	/proc/3/maps	.x58d641d1876acf74
File opened for reading	/proc/166/maps	.x58d641d1876acf74
File opened for reading	/proc/168/maps	.x58d641d1876acf74
File opened for reading	/proc/176/maps	.x58d641d1876acf74
File opened for reading	/proc/2/maps	.x58d641d1876acf74
File opened for reading	/proc/26/maps	.x58d641d1876acf74
File opened for reading	/proc/28/maps	.x58d641d1876acf74
File opened for reading	/proc/35/maps	.x58d641d1876acf74
File opened for reading	/proc/163/maps	.x58d641d1876acf74
File opened for reading	/proc/167/maps	.x58d641d1876acf74
File opened for reading	/proc/18/maps	.x58d641d1876acf74
File opened for reading	/proc/79/maps	.x58d641d1876acf74
File opened for reading	/proc/161/maps	.x58d641d1876acf74
File opened for reading	/proc/171/maps	.x58d641d1876acf74
File opened for reading	/proc/175/maps	.x58d641d1876acf74
File opened for reading	/proc/6/maps	.x58d641d1876acf74
File opened for reading	/proc/12/maps	.x58d641d1876acf74
File opened for reading	/proc/83/maps	.x58d641d1876acf74
File opened for reading	/proc/137/maps	.x58d641d1876acf74
File opened for reading	/proc/165/maps	.x58d641d1876acf74
File opened for reading	/proc/10/maps	.x58d641d1876acf74
File opened for reading	/proc/13/maps	.x58d641d1876acf74
File opened for reading	/proc/23/maps	.x58d641d1876acf74
File opened for reading	/proc/29/maps	.x58d641d1876acf74
File opened for reading	/proc/31/maps	.x58d641d1876acf74
File opened for reading	/proc/170/maps	.x58d641d1876acf74
File opened for reading	/proc/36/maps	.x58d641d1876acf74
File opened for reading	/proc/81/maps	.x58d641d1876acf74
File opened for reading	/proc/82/maps	.x58d641d1876acf74
File opened for reading	/proc/98/maps	.x58d641d1876acf74
File opened for reading	/proc/203/maps	.x58d641d1876acf74
File opened for reading	/proc/5/maps	.x58d641d1876acf74
File opened for reading	/proc/14/maps	.x58d641d1876acf74
File opened for reading	/proc/22/maps	.x58d641d1876acf74
File opened for reading	/proc/162/maps	.x58d641d1876acf74
File opened for reading	/proc/172/maps	.x58d641d1876acf74
File opened for reading	/proc/173/maps	.x58d641d1876acf74
File opened for reading	/proc/8/maps	.x58d641d1876acf74

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1504	.x58d641d1876acf74

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/block/sda/device/serial	.x58d641d1876acf74
File opened for reading	/sys/block/vda/serial	.x58d641d1876acf74

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/79/status	.x58d641d1876acf74
File opened for reading	/proc/98/fd	.x58d641d1876acf74
File opened for reading	/proc/172/stat	.x58d641d1876acf74
File opened for reading	/proc/174/stat	.x58d641d1876acf74
File opened for reading	/proc/204/status	.x58d641d1876acf74
File opened for reading	/proc/8/stat	.x58d641d1876acf74
File opened for reading	/proc/173/stat	.x58d641d1876acf74
File opened for reading	/proc/979/cmdline	.x58d641d1876acf74
File opened for reading	/proc/1049/stat	.x58d641d1876acf74
File opened for reading	/proc/1097/cmdline	.x58d641d1876acf74
File opened for reading	/proc/12/environ	.x58d641d1876acf74
File opened for reading	/proc/13/stat	.x58d641d1876acf74
File opened for reading	/proc/14/stat	.x58d641d1876acf74
File opened for reading	/proc/1491/maps	.x58d641d1876acf74
File opened for reading	/proc/7/stat	.x58d641d1876acf74
File opened for reading	/proc/22/fd	.x58d641d1876acf74
File opened for reading	/proc/26/stat	.x58d641d1876acf74
File opened for reading	/proc/84/cmdline	.x58d641d1876acf74
File opened for reading	/proc/170/environ	.x58d641d1876acf74
File opened for reading	/proc/174/cmdline	.x58d641d1876acf74
File opened for reading	/proc/549/stat	.x58d641d1876acf74
File opened for reading	/proc/997/stat	.x58d641d1876acf74
File opened for reading	/proc/10/environ	.x58d641d1876acf74
File opened for reading	/proc/169/cmdline	.x58d641d1876acf74
File opened for reading	/proc/1491/environ	.x58d641d1876acf74
File opened for reading	/proc/18/stat	.x58d641d1876acf74
File opened for reading	/proc/25/environ	.x58d641d1876acf74
File opened for reading	/proc/166/cmdline	.x58d641d1876acf74
File opened for reading	/proc/170/fd	.x58d641d1876acf74
File opened for reading	/proc/516/cmdline	.x58d641d1876acf74
File opened for reading	/proc/1059/cmdline	.x58d641d1876acf74
File opened for reading	/proc/11/environ	.x58d641d1876acf74
File opened for reading	/proc/6/stat	.x58d641d1876acf74
File opened for reading	/proc/9/status	.x58d641d1876acf74
File opened for reading	/proc/18/cmdline	.x58d641d1876acf74
File opened for reading	/proc/161/status	.x58d641d1876acf74
File opened for reading	/proc/953/stat	.x58d641d1876acf74
File opened for reading	/proc/27/status	.x58d641d1876acf74
File opened for reading	/proc/82/status	.x58d641d1876acf74
File opened for reading	/proc/1099/cmdline	.x58d641d1876acf74
File opened for reading	/proc/1251/stat	.x58d641d1876acf74
File opened for reading	/proc/12/status	.x58d641d1876acf74
File opened for reading	/proc/613/cmdline	.x58d641d1876acf74
File opened for reading	/proc/959/cmdline	.x58d641d1876acf74
File opened for reading	/proc/1147/cmdline	.x58d641d1876acf74
File opened for reading	/proc/468/cmdline	.x58d641d1876acf74
File opened for reading	/proc/502/cmdline	.x58d641d1876acf74
File opened for reading	/proc/1062/stat	.x58d641d1876acf74
File opened for reading	/proc/5/environ	.x58d641d1876acf74
File opened for reading	/proc/12/cmdline	.x58d641d1876acf74
File opened for reading	/proc/24/status	.x58d641d1876acf74
File opened for reading	/proc/34/fd	.x58d641d1876acf74
File opened for reading	/proc/168/status	.x58d641d1876acf74
File opened for reading	/proc/437/cmdline	.x58d641d1876acf74
File opened for reading	/proc/576/cmdline	.x58d641d1876acf74
File opened for reading	/proc/668/stat	.x58d641d1876acf74
File opened for reading	/proc/4/environ	.x58d641d1876acf74
File opened for reading	/proc/596/stat	.x58d641d1876acf74
File opened for reading	/proc/1018/cmdline	.x58d641d1876acf74
File opened for reading	/proc/709/stat	.x58d641d1876acf74
File opened for reading	/proc/1101/stat	.x58d641d1876acf74
File opened for reading	/proc/self/environ	.x58d641d1876acf74
File opened for reading	/proc/3/fd	.x58d641d1876acf74
File opened for reading	/proc/15/fd	.x58d641d1876acf74

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.x19fffd604fbaaa05	2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
File opened for modification	/tmp/.cron_tmp	.x58d641d1876acf74

/tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
/tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
1⤵
- Deletes itself
- Executes dropped EXE
- Writes file to tmp directory
PID:1494
- /usr/local/sbin/.x19fffd604fbaaa05
  .x19fffd604fbaaa05 /tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
  2⤵
  PID:1495
- /usr/local/bin/.x19fffd604fbaaa05
  .x19fffd604fbaaa05 /tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
  2⤵
  PID:1495
- /usr/sbin/.x19fffd604fbaaa05
  .x19fffd604fbaaa05 /tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
  2⤵
  PID:1495
- /usr/bin/.x19fffd604fbaaa05
  .x19fffd604fbaaa05 /tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
  2⤵
  PID:1495
- /sbin/.x19fffd604fbaaa05
  .x19fffd604fbaaa05 /tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
  2⤵
  PID:1495
- /bin/.x19fffd604fbaaa05
  .x19fffd604fbaaa05 /tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
  2⤵
  PID:1495
- /snap/bin/.x19fffd604fbaaa05
  .x19fffd604fbaaa05 /tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
  2⤵
  PID:1495
- /root/.x58d641d1876acf74
  /root/.x58d641d1876acf74 /tmp/2026-05-17_73335c040aeef3f06266fbb4539477ad_akira
  2⤵
  - Deletes itself
  - Traces itself
  - Modifies init.d
  - Reads MAC address of network interface
  - Reads process memory
  - Changes its process name
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1496
- - /usr/local/sbin/crontab
    crontab -l
    3⤵
    PID:1498
- - /usr/local/bin/crontab
    crontab -l
    3⤵
    PID:1498
- - /usr/sbin/crontab
    crontab -l
    3⤵
    PID:1498
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:1498
- - /usr/local/sbin/crontab
    crontab /tmp/.cron_tmp
    3⤵
    PID:1499
- - /usr/local/bin/crontab
    crontab /tmp/.cron_tmp
    3⤵
    PID:1499
- - /usr/sbin/crontab
    crontab /tmp/.cron_tmp
    3⤵
    PID:1499
- - /usr/bin/crontab
    crontab /tmp/.cron_tmp
    3⤵
    - Creates/modifies Cron job
    PID:1499

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.kworker

Path /etc/init.d/.kworker
Size 65B
SHA256 41602099ac3b9c7e713fa0d7bf9c6d45ef23feabec6388df7bc24f5069f9b249
MD5 5b70b5ec1b3320471d5463668ef0cb9c
SHA1 b6ac168358b930dee8eaad43c83b9d2827700528
SHA512 db36ffc6f76d9545e4ce52af35ccef54b41889eaa6d01c3b96d396246345514513006d36d7efb7a52c98cf2bcee5f3f4af71f51c287beccb82bba42510ea349e
TLSH
T101A00241894DAE4118CA1A342C5C52793445AD09A7C1091A451065A79563B51303A755
MD5 SHA1 SHA512 TLSH

Submit Download

.cron_tmp

Path /tmp/.cron_tmp
Size 52B
SHA256 ddd3c1932a4d94529c3f6883ead09c1ba051cab02455e2a87206634a40c20d95
MD5 0c2af5137ec2bf19cddf07e3f646b009
SHA1 33d1e6152388d4c05bba7feeee49c8018b95004d
SHA512 c5033b569aa7856493082edc634c5888a73e607ad07e394fd57dc4a4b2a627dbfe8a297a8b778d2752f45a813f39a8d845e656254a0e3d1eb708a18e49ebee67
TLSH
T17B90025499A55E0134851564641C535458925D1143D51140C0C1B4218B560846214A52
MD5 SHA1 SHA512 TLSH

Submit Download

.x19fffd604fbaaa05

Path /tmp/.x19fffd604fbaaa05
Size 702KB
SHA256 902abccdbca29e28228acb3aaeb40dbf3d195f2d7be5a29d540aa76159cdc923
MD5 437b3ece6b71803920c49dc14c3ab086
SHA1 2d7c68734f213ea8ef3e7be89e7426e6d2fa978c
SHA512 a8cf32e74430977636eda5421f3363deca98d287fb6d3f2fabb14a0ca685cddbfb4367388bc8cab7445c9cebbb689c5f2c2d6821e2a58c0bbc7be3bbb2734c1c
SSDEEP 12288:AgONZbSyGfzXd9BTTDdxTySA6y7FJx7rMguSTW+QGIK0Y5YvjKs8c+z3:AgONdZmRH3nPryPhQgjW+QGIK0Y6+s83
TLSH
T157E47D16F901E0B9D46350F1511FD3B6C8646B3485278CCBFF4AED68A6366D2AF2930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.pBilZZ

Path /var/spool/cron/crontabs/tmp.pBilZZ
Size 240B
SHA256 58c18a78521d624cd2199a1b69ffe02300d0f4246a7090865b0c55ebde4ef77c
MD5 f3a20bc086d36f69bef04b62eb93393f
SHA1 a8b55ce9f110189b4e171664af1f084ddea73223
SHA512 977f960cf9afb3fe912a85448a2ed330c15003bb0a941514719ee281c781e87d18b920be047310f3592bf7eb6eab52d32e837fbae5e0bc3f486f1b169c5a7b2e
TLSH
T19FD0A71DBF607D3229451744315E16299983E879958D5E10E0DD303983572597B50AB2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads