Overview

overview

8

Static

static

1

agent-full-x86_64

ubuntu-22.04-amd64

8

agent-full-x86_64

ubuntu-24.04-amd64

8

Analysis

  • max time kernel
    45s
  • max time network
    36s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20260126-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    31/07/2026, 07:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    agent-full-x86_64
  • Size 192KB
  • Sample260731-ja18faeg99
  • SHA256 66249bad655bcd7d14339214b8fa4fce01ab11afe3e76656caa5a247aa4d28ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

    persistenceprivilege_escalation
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 2 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Removes the immutable protection flag from a file 1 TTPs 5 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Modifies Bash startup script 2 TTPs 2 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 10 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/agent-full-x86_64
    /tmp/agent-full-x86_64
    1⤵
    • Adds new SSH keys
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies systemd
    • Modifies Bash startup script
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    PID:2021
    • /bin/systemctl
      systemctl stop
      2⤵
        PID:2046
      • /bin/systemctl
        systemctl disable
        2⤵
        • Reads runtime system information
        PID:2047
      • /bin/pkill
        pkill -9
        2⤵
          PID:2050
        • /bin/sh
          /bin/sh -c "ps -eo pid,comm 2>/dev/null"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:2055
          • /usr/bin/ps
            ps -eo "pid,comm"
            3⤵
            • Reads CPU attributes
            • Enumerates kernel/hardware configuration
            • Reads runtime system information
            PID:2056
        • /bin/sh
          /bin/sh -c "iptables-save > /dev/null 2>&1"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          • System Network Configuration Discovery
          PID:2410
        • /bin/sh
          /bin/sh -c "systemctl daemon-reload"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:2412
          • /usr/bin/systemctl
            systemctl daemon-reload
            3⤵
            • Reads runtime system information
            PID:2413
        • /bin/sh
          /bin/sh -c "systemctl enable dbus-systemd.service"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:2445
          • /usr/bin/systemctl
            systemctl enable dbus-systemd.service
            3⤵
            • Reads runtime system information
            PID:2446
        • /bin/sh
          /bin/sh -c "chattr -i /etc/crontab"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:2479
          • /usr/bin/chattr
            chattr -i /etc/crontab
            3⤵
            • Removes the immutable protection flag from a file
            PID:2480
        • /bin/sh
          /bin/sh -c "chattr +i /etc/crontab"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:2482
          • /usr/bin/chattr
            chattr +i /etc/crontab
            3⤵
            • Removes the immutable protection flag from a file
            PID:2483
        • /bin/sh
          /bin/sh -c "chattr -i /root/.ssh/authorized_keys"
          2⤵
          • Removes the immutable protection flag from a file
          • Command and Scripting Interpreter: Unix Shell
          PID:2485
          • /usr/bin/chattr
            chattr -i /root/.ssh/authorized_keys
            3⤵
            • Removes the immutable protection flag from a file
            PID:2486
        • /bin/sh
          /bin/sh -c "chattr +i /root/.ssh/authorized_keys"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:2488
          • /usr/bin/chattr
            chattr +i /root/.ssh/authorized_keys
            3⤵
            • Removes the immutable protection flag from a file
            PID:2489
        • /bin/sh
          /bin/sh -c "systemctl --user daemon-reload"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:2491
          • /usr/bin/systemctl
            systemctl --user daemon-reload
            3⤵
              PID:2492
          • /bin/sh
            /bin/sh -c "systemctl --user enable dbus-user-3508.service"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:2494
            • /usr/bin/systemctl
              systemctl --user enable dbus-user-3508.service
              3⤵
                PID:2495

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Unix Shell

                1
                T1059.004

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Persistence

                Account Manipulation

                1
                T1098

                SSH Authorized Keys

                1
                T1098.004

                Boot or Logon Autostart Execution

                2
                T1547

                XDG Autostart Entries

                1
                T1547.013

                Create or Modify System Process

                1
                T1543

                Systemd Service

                1
                T1543.002

                Event Triggered Execution

                1
                T1546

                Unix Shell Configuration Modification

                1
                T1546.004

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Privilege Escalation

                Account Manipulation

                1
                T1098

                SSH Authorized Keys

                1
                T1098.004

                Boot or Logon Autostart Execution

                2
                T1547

                XDG Autostart Entries

                1
                T1547.013

                Create or Modify System Process

                1
                T1543

                Systemd Service

                1
                T1543.002

                Event Triggered Execution

                1
                T1546

                Unix Shell Configuration Modification

                1
                T1546.004

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Defense Evasion

                File and Directory Permissions Modification

                1
                T1222

                Linux and Mac File and Directory Permissions Modification

                1
                T1222.002

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Credential Access

                Discovery

                System Information Discovery

                2
                T1082

                System Network Configuration Discovery

                2
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                dbus-systemd.service
                • Path /etc/systemd/system/dbus-systemd.service
                • Size 225B
                • SHA256 aed4d4149e6493a1f85dfb8f95dbb5ca5a2d976046ef2de9481968b1ca2f4219
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dbus-user-3508.service
                • Path /root/.config/systemd/user/dbus-user-3508.service
                • Size 218B
                • SHA256 93902c6fe80dd07b0a959be238621b26f9f02657fb24f39469bd8bbe0b22a525
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                .zshrc
                • Path /root/.zshrc
                • Size 97B
                • SHA256 f2e6f1a15d33cb3873cd4183d1dfe91be309abff5195e8f7d1d02dc49afb0260
                • MD5 SHA1 SHA512 TLSH
                Submit Download