Analysis
- max time kernel
127s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/06/2026, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
kworker_u8.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target kworker_u8.elf
- Size 1.9MB
- Sample260604-l4p4dacv2s
- SHA256 8e28f6fe6f48cabd1c821a64bd0785ffdaca1379a414780d5db6a6c110fbb123
- MD5 0f410a2acb96790e324f25f677380b09
- SHA1 1461617e27550c7a994000563cc5f424288aea91
- SHA512 153f8e85a63ad1fbf8afa364e303fda3422649d043e0c95a471a872b2dd51bae6139a5ddb02a179da658abf1175e8f18d1cf5fb7be2ac61e200e5fa4081155c3
- SSDEEP 49152:dXdCFpGmOcJO+Ffu7aqMgtdwJ4M7yR7q41y+xA8e9Mj:dXepNO6saJgdwyMe9qXi/
- TLSH T14E9533D8E5034C5B610800278D7F36A4105A1615CED8978BFA16DF3FA6198BFB6B9B0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size kworker_u8.elf -
description ioc Process File opened for reading /proc/1079/cmdline kworker_u8.elf File opened for reading /proc/1463/cmdline kworker_u8.elf File opened for reading /proc/1467/cmdline kworker_u8.elf File opened for reading /proc/18/cmdline kworker_u8.elf File opened for reading /proc/457/cmdline kworker_u8.elf File opened for reading /proc/989/cmdline kworker_u8.elf File opened for reading /proc/1036/cmdline kworker_u8.elf File opened for reading /proc/13/cmdline kworker_u8.elf File opened for reading /proc/163/cmdline kworker_u8.elf File opened for reading /proc/166/cmdline kworker_u8.elf File opened for reading /proc/424/cmdline kworker_u8.elf File opened for reading /proc/434/cmdline kworker_u8.elf File opened for reading /proc/78/cmdline kworker_u8.elf File opened for reading /proc/83/cmdline kworker_u8.elf File opened for reading /proc/1469/cmdline kworker_u8.elf File opened for reading /proc/1470/cmdline kworker_u8.elf File opened for reading /proc/20/cmdline kworker_u8.elf File opened for reading /proc/3/cmdline kworker_u8.elf File opened for reading /proc/464/cmdline kworker_u8.elf File opened for reading /proc/651/cmdline kworker_u8.elf File opened for reading /proc/1/cmdline kworker_u8.elf File opened for reading /proc/477/cmdline kworker_u8.elf File opened for reading /proc/980/cmdline kworker_u8.elf File opened for reading /proc/self/exe kworker_u8.elf File opened for reading /proc/1057/cmdline kworker_u8.elf File opened for reading /proc/1076/cmdline kworker_u8.elf File opened for reading /proc/1083/cmdline kworker_u8.elf File opened for reading /proc/160/cmdline kworker_u8.elf File opened for reading /proc/172/cmdline kworker_u8.elf File opened for reading /proc/534/cmdline kworker_u8.elf File opened for reading /proc/596/cmdline kworker_u8.elf File opened for reading /proc/1002/cmdline kworker_u8.elf File opened for reading /proc/1028/cmdline kworker_u8.elf File opened for reading /proc/1366/cmdline kworker_u8.elf File opened for reading /proc/89/cmdline kworker_u8.elf File opened for reading /proc/892/cmdline kworker_u8.elf File opened for reading /proc/1308/cmdline kworker_u8.elf File opened for reading /proc/1337/cmdline kworker_u8.elf File opened for reading /proc/159/cmdline kworker_u8.elf File opened for reading /proc/174/cmdline kworker_u8.elf File opened for reading /proc/433/cmdline kworker_u8.elf File opened for reading /proc/449/cmdline kworker_u8.elf File opened for reading /proc/919/cmdline kworker_u8.elf File opened for reading /proc/1165/cmdline kworker_u8.elf File opened for reading /proc/1245/cmdline kworker_u8.elf File opened for reading /proc/161/cmdline kworker_u8.elf File opened for reading /proc/28/cmdline kworker_u8.elf File opened for reading /proc/29/cmdline kworker_u8.elf File opened for reading /proc/448/cmdline kworker_u8.elf File opened for reading /proc/34/cmdline kworker_u8.elf File opened for reading /proc/10/cmdline kworker_u8.elf File opened for reading /proc/1140/cmdline kworker_u8.elf File opened for reading /proc/137/cmdline kworker_u8.elf File opened for reading /proc/164/cmdline kworker_u8.elf File opened for reading /proc/169/cmdline kworker_u8.elf File opened for reading /proc/26/cmdline kworker_u8.elf File opened for reading /proc/268/cmdline kworker_u8.elf File opened for reading /proc/1012/cmdline kworker_u8.elf File opened for reading /proc/1072/cmdline kworker_u8.elf File opened for reading /proc/1127/cmdline kworker_u8.elf File opened for reading /proc/165/cmdline kworker_u8.elf File opened for reading /proc/339/cmdline kworker_u8.elf File opened for reading /proc/487/cmdline kworker_u8.elf File opened for reading /proc/511/cmdline kworker_u8.elf - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.ICE-unix/.ICEauth kworker_u8.elf File opened for modification /tmp/.font-unix/.font0-lock kworker_u8.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.ICE-unix/.ICEauth
- Size 4B
- SHA256 2d2d06cd6fe58a04804f43cfa2a91d06337821696b6d6669fd4f71514842dd3b
- MD5 fccaac545a5292be88089e8bb00501fe
- SHA1 61524313d1d79f125874c12deb5d95fd78e20869
- SHA512 9e2d3ed7b8e8be69acacfc006461398d246f6f0239daf60de0012f4ec75da6dacbabecb321fb4fef89e051676c94ae0882d6ff75a3c22ccf8d2a86563d618f85
- MD5 SHA1 SHA512
- Path /tmp/.font-unix/.font0-lock
- Size 4B
- SHA256 33bf4329c846019957cdba15fd5767df4392769eac8c3637ac395651a72108af
- MD5 ac796a52db3f16bbdb6557d3d89d1c5a
- SHA1 442bdc9a0e80132c626a3605e010b8fb0ee0c1f6
- SHA512 ee9f4e2ef9a00de553f5c8a72a10cab62bb41e317302eab047115279ce1847306c6bd1130546e20b29035df3ab7509e10d712995174278ca4f79be7c7628b2b8
- MD5 SHA1 SHA512