Overview

overview

10

Static

static

10

x86_64

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    53s
  • max time network
    138s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    27/05/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    x86_64
  • Size 224KB
  • Sample260527-phpr9sdt5l
  • SHA256 453fcb42c40ddd27f7e91fa52c1fae0f56841f55190d920f7c3d6beb5fccf993
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionladvixinfectorpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Family: Ladvix

    Ladvix is a linux trojan and file infector first seen in 2022.

    trojaninfectorladvix
  • ladvix 1 IoCs

    Detects Ladvix payload

  • Executes dropped EXE 23 IoCs
  • Unexpected DNS network traffic destination 7 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 24 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Writes file to system bin folder 1 IoCs
  • Reads runtime system information 24 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 24 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/x86_64
    /tmp/x86_64
    1⤵
    • Executes dropped EXE
    • Creates/modifies Cron job
    • Writes file to system bin folder
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1480
    • /tmp/fileCAREQS
      /tmp/x86_64
      2⤵
      • Executes dropped EXE
      • Creates/modifies Cron job
      • Reads runtime system information
      • Writes file to tmp directory
      PID:1489
      • /tmp/filet7sZwN
        /tmp/x86_64
        3⤵
        • Executes dropped EXE
        • Creates/modifies Cron job
        • Reads runtime system information
        • Writes file to tmp directory
        PID:1490
        • /tmp/fileioA0Q2
          /tmp/x86_64
          4⤵
          • Executes dropped EXE
          • Creates/modifies Cron job
          • Reads runtime system information
          • Writes file to tmp directory
          PID:1491
          • /tmp/filerwlMAi
            /tmp/x86_64
            5⤵
            • Executes dropped EXE
            • Creates/modifies Cron job
            • Reads runtime system information
            • Writes file to tmp directory
            PID:1492
            • /tmp/fileMYk4vA
              /tmp/x86_64
              6⤵
              • Executes dropped EXE
              • Creates/modifies Cron job
              • Reads runtime system information
              • Writes file to tmp directory
              PID:1493
              • /tmp/fileC1jKAM
                /tmp/x86_64
                7⤵
                • Executes dropped EXE
                • Creates/modifies Cron job
                • Reads runtime system information
                • Writes file to tmp directory
                PID:1494
                • /tmp/filexKbIp3
                  /tmp/x86_64
                  8⤵
                  • Executes dropped EXE
                  • Creates/modifies Cron job
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:1495
                  • /tmp/file8LEDIi
                    /tmp/x86_64
                    9⤵
                    • Executes dropped EXE
                    • Creates/modifies Cron job
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:1496
                    • /tmp/filepMKrtD
                      /tmp/x86_64
                      10⤵
                      • Executes dropped EXE
                      • Creates/modifies Cron job
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:1497
                      • /tmp/filecenzVP
                        /tmp/x86_64
                        11⤵
                        • Executes dropped EXE
                        • Creates/modifies Cron job
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:1498
                        • /tmp/fileLnnpk9
                          /tmp/x86_64
                          12⤵
                          • Executes dropped EXE
                          • Creates/modifies Cron job
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:1499
                          • /tmp/filee7W18t
                            /tmp/x86_64
                            13⤵
                            • Executes dropped EXE
                            • Creates/modifies Cron job
                            • Reads runtime system information
                            • Writes file to tmp directory
                            PID:1500
                            • /tmp/filevrEURI
                              /tmp/x86_64
                              14⤵
                              • Executes dropped EXE
                              • Creates/modifies Cron job
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:1501
                              • /tmp/fileMSidS4
                                /tmp/x86_64
                                15⤵
                                • Executes dropped EXE
                                • Creates/modifies Cron job
                                • Reads runtime system information
                                • Writes file to tmp directory
                                PID:1504
                                • /tmp/filey7Kihi
                                  /tmp/x86_64
                                  16⤵
                                  • Executes dropped EXE
                                  • Creates/modifies Cron job
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:1505
                                  • /tmp/filePHMMTE
                                    /tmp/x86_64
                                    17⤵
                                    • Executes dropped EXE
                                    • Creates/modifies Cron job
                                    • Reads runtime system information
                                    • Writes file to tmp directory
                                    PID:1506
                                    • /tmp/fileesP7E0
                                      /tmp/x86_64
                                      18⤵
                                      • Executes dropped EXE
                                      • Creates/modifies Cron job
                                      • Reads runtime system information
                                      • Writes file to tmp directory
                                      PID:1507
                                      • /tmp/filezO3S8s
                                        /tmp/x86_64
                                        19⤵
                                        • Executes dropped EXE
                                        • Creates/modifies Cron job
                                        • Reads runtime system information
                                        • Writes file to tmp directory
                                        PID:1508
                                        • /tmp/fileGzVxSY
                                          /tmp/x86_64
                                          20⤵
                                          • Executes dropped EXE
                                          • Creates/modifies Cron job
                                          • Reads runtime system information
                                          • Writes file to tmp directory
                                          PID:1509
                                          • /tmp/fileWQnhyd
                                            /tmp/x86_64
                                            21⤵
                                            • Executes dropped EXE
                                            • Creates/modifies Cron job
                                            • Reads runtime system information
                                            • Writes file to tmp directory
                                            PID:1510
                                            • /tmp/file3mfM5O
                                              /tmp/x86_64
                                              22⤵
                                              • Executes dropped EXE
                                              • Creates/modifies Cron job
                                              • Reads runtime system information
                                              • Writes file to tmp directory
                                              PID:1511
                                              • /tmp/filemwlOTp
                                                /tmp/x86_64
                                                23⤵
                                                • Executes dropped EXE
                                                • Creates/modifies Cron job
                                                • Reads runtime system information
                                                • Writes file to tmp directory
                                                PID:1512
                                                • /tmp/fileAlTtxQ
                                                  /tmp/x86_64
                                                  24⤵
                                                  • Creates/modifies Cron job
                                                  • Reads runtime system information
                                                  • Writes file to tmp directory
                                                  PID:1513

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        0
        • Path /etc/cron.hourly/0
        • Size 92B
        • SHA256 982f9e0f089b91ba79df723435099df15c72e1201a45010ee60226ab136c93bf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        fileCAREQS
        • Path /tmp/fileCAREQS
        • Size 216KB
        • SHA256 fcea9ec22eac1edbcd5e6fcdb2c22148b146caf90e36e235b9ce20e6fcd744c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fileCAREQS
        • Path /tmp/fileCAREQS
        • Size 224KB
        • SHA256 453fcb42c40ddd27f7e91fa52c1fae0f56841f55190d920f7c3d6beb5fccf993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download