404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69 | Triage™

Analysis

max time kernel
145s
max time network
145s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
31/07/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
Size 6.8MB
Sample260731-q3hecsvxcs
SHA256 404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69
MD5 2314aeaed29c72a1fed332f0099987dc
SHA1 1f1e0bc92fb6569dafd1507d5123e0332632beeb
SHA512 a73a7bd5e55015fe4cc3b2168a4cb81290b55b0375e02c8701cd871d65a32dfb671739494d74e9a4b5448573bcc0c4f5ae4428902628e4cf04ad7e621003b82f
SSDEEP 98304:TqzbMh9JqocHABOCLzUc7P2thQYVSnt7E1IDNp2XeyTjKPZO4YA+9d2o5tWBptqw:TIMzjeo
TLSH
T1EC762852F98B08F6E9031D3215BFA26F27311D064B24DBC7EA407F2AF97B5D52936209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Xs0Qxr	crontab

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/cgroup	404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
File opened for reading	/proc/self/mountinfo	404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.config/.cache/systemd-update	404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
File opened for modification	/tmp/.config/systemd/user/systemd-update.service	404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf

/tmp/404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
/tmp/404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69.elf
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1510
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1514
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1515
- /bin/systemctl
  systemctl --user enable systemd-update.service
  2⤵
  - Reads runtime system information
  PID:1516
- /bin/systemctl
  systemctl --user start systemd-update.service
  2⤵
  - Reads runtime system information
  PID:1517

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Cron

Persistence

Scheduled Task/Job

Cron

Privilege Escalation

Scheduled Task/Job

Cron

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemd-update

Path /tmp/.config/.cache/systemd-update
Size 6.8MB
SHA256 404df61aa1d3bfcfc14288b9cc0131642cbafb31256f28c5fd7e5ef51bbe2d69
MD5 2314aeaed29c72a1fed332f0099987dc
SHA1 1f1e0bc92fb6569dafd1507d5123e0332632beeb
SHA512 a73a7bd5e55015fe4cc3b2168a4cb81290b55b0375e02c8701cd871d65a32dfb671739494d74e9a4b5448573bcc0c4f5ae4428902628e4cf04ad7e621003b82f
SSDEEP 98304:TqzbMh9JqocHABOCLzUc7P2thQYVSnt7E1IDNp2XeyTjKPZO4YA+9d2o5tWBptqw:TIMzjeo
TLSH
T1EC762852F98B08F6E9031D3215BFA26F27311D064B24DBC7EA407F2AF97B5D52936209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemd-update.service

Path /tmp/.config/systemd/user/systemd-update.service
Size 181B
SHA256 f4a710fd94dba8a4deb4aa158f84258ec2936aca546d0826474f668a9f6ddb1b
MD5 3d5ed69121a469113570107db386aa55
SHA1 230be56517955df2c4dc7072e73642d833da428a
SHA512 1b7b10fe3103a67b49141d56faf9339b9d09a24df09adde72aa6cb5ac3dbb04932879b631ef1725f7fa7b67c96f5ead6ba0d11e28d3302536621b3553aad3dfe
TLSH
T170C0C03322A1F4B2CD0B3C728E8257208E204284434F90340FC3044040D1107011467C
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.Xs0Qxr

Path /var/spool/cron/crontabs/tmp.Xs0Qxr
Size 215B
SHA256 4da0c35cf52f92a639138dc2aaa769f3fdbcd6ba7e593c8ea43a9d80c4c2d479
MD5 206f416b02e23ec2504810d9e0b8589c
SHA1 77fb9e9f4d8c463a36c30d4900026fe7adbd1280
SHA512 f9789f501299469f33269c288ecfeff678d9eba14b1b4f7edeb6c8f147769b8ae3b7de693d39fa2e2bbcfc84dfdc6f17afc27dc223e2f480362d97cb32dca947
TLSH
T197D0221DBFA0AA3169460F89602A011A5C91A0BA928FDE41F0DE20244207A8C2F64AB6
MD5 SHA1 SHA512 TLSH

Submit Download