08358d066e0d757582926ff181e0d2ad647e6bd50816db9ead0e59f95184d565

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/08/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
execute
Size 543B
Sample260810-wyy47seq2z
SHA256 08358d066e0d757582926ff181e0d2ad647e6bd50816db9ead0e59f95184d565
MD5 dfba91109b2050937e45c605dd8f7eec
SHA1 d044cc8c9be883d94391cbd637dd376a291894ed
SHA512 a9efc5e6742f941b99b6442f4f5c46499a5ce8ed3c9e994a0dba5ccd507a5e888d3869b82857fb5f8610a4d77ce07fca293eeccd922903ac63195ef405d45717
TLSH
T15CF02B56F2305EB47C9948589947F68829837FA1889C73B0B0CBAE0E74CC51AB154FB3
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1492	sh
1493	chmod

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1514	systemctl

Reads runtime system information 43 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	plymouth
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl

/tmp/execute
/tmp/execute
1⤵
PID:1488
- /usr/bin/whoami
  whoami
  2⤵
  PID:1489
- /bin/sh
  sh -c "/bin/monitor > /dev/null 2>&1 &"
  2⤵
  PID:1490
- /bin/sh
  sh -c "chmod 755 /bin/save > /dev/null 2>&1 &"
  2⤵
  - File and Directory Permissions Modification
  PID:1492
- /bin/sh
  sh -c "systemctl enable crond > /dev/null 2>&1 &"
  2⤵
  PID:1494
- /bin/sh
  sh -c "systemctl start crond > /dev/null 2>&1 &"
  2⤵
  PID:1496
- /bin/sh
  sh -c "/etc/init.d/crond start > /dev/null 2>&1 &"
  2⤵
  PID:1499
- /bin/sh
  sh -c "systemctl enable cron > /dev/null 2>&1 &"
  2⤵
  PID:1501
- /bin/sh
  sh -c "systemctl start cron > /dev/null 2>&1 &"
  2⤵
  PID:1503
- /bin/sh
  sh -c "/etc/init.d/cron start > /dev/null 2>&1 &"
  2⤵
  PID:1505

/bin/monitor
/bin/monitor
1⤵
PID:1491

/bin/chmod
chmod 755 /bin/save
1⤵
- File and Directory Permissions Modification
PID:1493

/bin/systemctl
systemctl enable crond
1⤵
- Reads runtime system information
PID:1495

/bin/systemctl
systemctl start crond
1⤵
- Reads runtime system information
PID:1498

/etc/init.d/crond
/etc/init.d/crond start
1⤵
PID:1500

/bin/systemctl
systemctl enable cron
1⤵
- Changes its process name
- Reads runtime system information
PID:1502
- /lib/systemd/systemd-sysv-install
  /lib/systemd/systemd-sysv-install enable cron
  2⤵
  PID:1514
- - /usr/bin/getopt
    getopt -o r: --long root: -- enable cron
    3⤵
    PID:1515
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d cron defaults
    3⤵
    PID:1516
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1519
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1519
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1519
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1519
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1519
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:1519
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d cron enable
    3⤵
    PID:1540
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1541
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1541
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1541
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1541
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1541
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:1541

/bin/systemctl
systemctl start cron
1⤵
- Reads runtime system information
PID:1504

/etc/init.d/cron
/etc/init.d/cron start
1⤵
PID:1506
- /bin/run-parts
  run-parts --lsbsysinit --list /lib/lsb/init-functions.d
  2⤵
  PID:1508
- /bin/systemctl
  systemctl -p LoadState --value show cron.service
  2⤵
  - Reads runtime system information
  PID:1513
- /bin/plymouth
  plymouth --ping
  2⤵
  - Reads runtime system information
  PID:1517
- /sbin/start-stop-daemon
  /sbin/start-stop-daemon --start --nicelevel 0 --quiet --oknodo --chdir /tmp --exec /usr/sbin/cron --oknodo --pidfile /var/run/crond.pid --
  2⤵
  PID:1518

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads