Overview

overview

7

Static

static

1

kaf.i386.elf

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    17/05/2026, 15:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kaf.i386.elf
  • Size 1.6MB
  • Sample260517-tedcaaew3k
  • SHA256 97a753ceaefa50cdb402b8bba849ca9e5a97951cc535990a98d03cc2dcbb65fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Changes its process name 1 IoCs
  • Reads runtime system information 18 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/kaf.i386.elf
    /tmp/kaf.i386.elf
    1⤵
    • Modifies rc script
    • Modifies systemd
    • Changes its process name
    • Writes file to tmp directory
    PID:1482
    • /bin/sh
      sh -c -- "(crontab -l 2>/dev/null | grep -v '/tmp/kaf.i386.elf'; echo '@reboot /tmp/kaf.i386.elf'; echo '*/5 * * * * /tmp/kaf.i386.elf') | crontab - 2>/dev/null"
      2⤵
        PID:1488
        • /bin/grep
          grep -v /tmp/kaf.i386.elf
          3⤵
            PID:1492
          • /usr/bin/crontab
            crontab -
            3⤵
            • Creates/modifies Cron job
            PID:1490
          • /usr/bin/crontab
            crontab -l
            3⤵
              PID:1491
          • /bin/sh
            sh -c -- "systemctl daemon-reload"
            2⤵
              PID:1493
              • /bin/systemctl
                systemctl daemon-reload
                3⤵
                • Reads runtime system information
                PID:1494
            • /bin/sh
              sh -c -- "systemctl enable toxnet.service"
              2⤵
                PID:1515
                • /bin/systemctl
                  systemctl enable toxnet.service
                  3⤵
                  • Reads runtime system information
                  PID:1516
              • /bin/sh
                sh -c -- "systemctl start toxnet.service"
                2⤵
                  PID:1537
                  • /bin/systemctl
                    systemctl start toxnet.service
                    3⤵
                    • Reads runtime system information
                    PID:1538

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    rc.local
                    • Path /etc/rc.local
                    • Size 20B
                    • SHA256 beb97dc6ef9e8dff6b65e336478a420452968659569fb193cfc5246785f48bd3
                    • MD5 SHA1 SHA512
                    Submit Download

                    toxnet.service
                    • Path /etc/systemd/system/toxnet.service
                    • Size 169B
                    • SHA256 094a0e5e537aaa43e1ee5ae132d0e4b4804cd0e72b16055413e5b7f5538c57f7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    tmp.zMlcxL
                    • Path /var/spool/cron/crontabs/tmp.zMlcxL
                    • Size 231B
                    • SHA256 ba1899b5c99cf3a611e4a9210add5763e98744d8d2e376f073b20956ee8910ad
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download