Analysis
- max time kernel
148s - max time network
144s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
18/08/2026, 02:45
Behavioral task
behavioral1
Sample
putita.x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
11 signatures
150 seconds
General
- Target putita.x86_64.elf
- Size 59KB
- Sample260818-c849esvbna
- SHA256 36df734baeb3aff8b5bff7aeb35e3a90438a3efc8ab593af91a5d87d7c75014c
- MD5 cf1ae18fd855aeb019cb4bf9afdaca50
- SHA1 09a0a0bb848db80bf1f11c2f11c8a027d81e26d3
- SHA512 713dd27b3abc546cda73923042c3145ed8096515f0e0c728b1f8130b030785f867a07c29c3fe33eb933748d955f01d9b98b10da82dc7eb3f6e536ddd7018e604
- SSDEEP 1536:yJzMtPCxFv3gqmWRl637x6hPdQ/9Hww4QuP:yJooFv3gqFl6rx68lnuP
- TLSH T1B253F1A51A27ACE0DB59173326788790E67273A6C2C3872F14B4686FF86F5447E047A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1512 putita.x86_64.elf - Outbound SSH connection to public host 2 TTPs 64 IoCs
SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
description flow ioc SSH destination 104 149.56.241.59:22 SSH destination 139 149.56.241.59:22 SSH destination 140 149.56.241.59:22 SSH destination 36 139.99.71.14:22 SSH destination 46 139.99.71.14:22 SSH destination 83 149.56.241.59:22 SSH destination 136 149.56.241.59:22 SSH destination 181 149.56.241.59:22 SSH destination 185 149.56.241.59:22 SSH destination 40 139.99.71.14:22 SSH destination 79 149.56.241.59:22 SSH destination 144 149.56.241.59:22 SSH destination 106 149.56.241.59:22 SSH destination 118 149.56.241.59:22 SSH destination 133 149.56.241.59:22 SSH destination 137 149.56.241.59:22 SSH destination 160 149.56.241.59:22 SSH destination 163 149.56.241.59:22 SSH destination 183 149.56.241.59:22 SSH destination 94 149.56.241.59:22 SSH destination 143 149.56.241.59:22 SSH destination 147 149.56.241.59:22 SSH destination 153 149.56.241.59:22 SSH destination 188 149.56.241.59:22 SSH destination 65 139.99.71.14:22 SSH destination 73 149.56.241.59:22 SSH destination 138 149.56.241.59:22 SSH destination 145 149.56.241.59:22 SSH destination 164 149.56.241.59:22 SSH destination 42 139.99.71.14:22 SSH destination 48 139.99.71.14:22 SSH destination 50 139.99.71.14:22 SSH destination 101 149.56.241.59:22 SSH destination 169 149.56.241.59:22 SSH destination 96 149.56.241.59:22 SSH destination 109 149.56.241.59:22 SSH destination 125 149.56.241.59:22 SSH destination 168 149.56.241.59:22 SSH destination 175 149.56.241.59:22 SSH destination 39 139.99.71.14:22 SSH destination 61 139.99.71.14:22 SSH destination 74 149.56.241.59:22 SSH destination 130 149.56.241.59:22 SSH destination 156 149.56.241.59:22 SSH destination 161 149.56.241.59:22 SSH destination 67 139.99.71.14:22 SSH destination 75 149.56.241.59:22 SSH destination 85 149.56.241.59:22 SSH destination 91 149.56.241.59:22 SSH destination 165 149.56.241.59:22 SSH destination 31 139.99.71.14:22 SSH destination 34 139.99.71.14:22 SSH destination 72 149.56.241.59:22 SSH destination 111 149.56.241.59:22 SSH destination 121 149.56.241.59:22 SSH destination 113 149.56.241.59:22 SSH destination 174 149.56.241.59:22 SSH destination 35 139.99.71.14:22 SSH destination 155 149.56.241.59:22 SSH destination 78 149.56.241.59:22 SSH destination 122 149.56.241.59:22 SSH destination 148 149.56.241.59:22 SSH destination 173 149.56.241.59:22 SSH destination 82 149.56.241.59:22 - Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.2z9U9Z crontab - Creates/modifies environment variables 1 TTPs 8 IoCs
Creating/modifying environment variables is a common persistence mechanism.
description ioc Process File opened for modification /root/.profile putita.x86_64.elf File opened for modification /etc/profile putita.x86_64.elf File opened for modification /etc/bash.bashrc putita.x86_64.elf File opened for modification /home/admin/.bashrc putita.x86_64.elf File opened for modification /home/admin/.profile putita.x86_64.elf File opened for modification /home/pi/.bashrc putita.x86_64.elf File opened for modification /home/pi/.profile putita.x86_64.elf File opened for modification /root/.bashrc putita.x86_64.elf -
description ioc Process File opened for modification /etc/init.d/kworker-helper putita.x86_64.elf - Modifies rc script 2 TTPs 1 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc.local putita.x86_64.elf - Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
description ioc Process File opened for modification /etc/systemd/system/kworker-helper.service putita.x86_64.elf - Modifies Bash startup script 2 TTPs 8 IoCs
description ioc Process File opened for modification /etc/profile putita.x86_64.elf File opened for modification /etc/bash.bashrc putita.x86_64.elf File opened for modification /home/admin/.bashrc putita.x86_64.elf File opened for modification /home/admin/.profile putita.x86_64.elf File opened for modification /home/pi/.bashrc putita.x86_64.elf File opened for modification /home/pi/.profile putita.x86_64.elf File opened for modification /root/.bashrc putita.x86_64.elf File opened for modification /root/.profile putita.x86_64.elf -
resource yara_rule behavioral1/files/fstream-1.dat upx - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself qx2PAZp9pDLG3Fq 1512 putita.x86_64.elf -
description ioc Process File opened for reading /proc/self/exe putita.x86_64.elf
Processes
-
/tmp/putita.x86_64.elf/tmp/putita.x86_64.elf1⤵
- Deletes itself
- Creates/modifies environment variables
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Modifies Bash startup script
- Changes its process name
- Reads runtime system information
PID:1512 -
/bin/shsh -c "crontab -l 2>/dev/null"2⤵PID:1513
-
/usr/bin/crontabcrontab -l3⤵PID:1514
-
-
-
/bin/shsh -c "(crontab -l 2>/dev/null; echo '@reboot /usr/lib/kworker-helper') | crontab - 2>/dev/null"2⤵PID:1515
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
PID:1517
-
-
/usr/bin/crontabcrontab -l3⤵PID:1518
-
-
-
/bin/busyboxchattr +i /etc/init.d/kworker-helper1⤵PID:1524
-
/bin/busyboxchattr +i /etc/systemd/system/kworker-helper.service1⤵PID:1523
-
/usr/bin/chattrchattr +i /etc/init.d/kworker-helper1⤵PID:1521
-
/bin/busyboxchattr +i /usr/lib/kworker-helper1⤵PID:1522
-
/usr/bin/chattrchattr +i /etc/systemd/system/kworker-helper.service1⤵PID:1520
-
/usr/bin/chattrchattr +i /usr/lib/kworker-helper1⤵PID:1519
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/init.d/kworker-helper
- Size 379B
- SHA256 daeb1a39fa3bf6fad15573d3aba269ac40fd43532bb487be2ed13453756cbe50
- MD5 c38d603241c783cc32e445061d3c1a14
- SHA1 65ec284d9c12bff79813b2f164900351e12512ac
- SHA512 54eedceecdb7fb3a56d9187df635e48654933657309b6e6fd0dc23c29850668278e88e21e046e83c91c1e81c0ce14236c8bdcfe09bab01dd820999c4c95c5f93
- TLSH T153E0D892164D7B3E1E0500B1DA04E7C5D8428D09622AE426B04C17E35BAB747D8755AC
- MD5 SHA1 SHA512 TLSH
- Path /etc/systemd/system/kworker-helper.service
- Size 190B
- SHA256 dcc492c83b938187ae12ae6df39f2350a98bb80761d79aa3ad4f29fa9a371c07
- MD5 ed6dfe7a7cad02f20eabc83ecc6e2563
- SHA1 b160b2a13238257fe4c233118f5152e38a8297d3
- SHA512 8ee7d7d57e9976b9d75bf37739ecdff2c1c003ea0d5e42d979b72dd64e1b424bb5b71d4d7a37c712fa13d9fc9c62156902a5c324007159b75a9e691d27d80be0
- TLSH T155C02232170120E0D80F39F24E97AB008D100A0487CEF0200BC0104B44E2A824431EA9
- MD5 SHA1 SHA512 TLSH
- Path /root/.ashrc
- Size 61B
- SHA256 30fc62ecc4fde897502efdd4821bd14c60694b758b6664f4044cfd48ca3a2efb
- MD5 7ba24613596abdadc60214554a375aed
- SHA1 b83e4b71eaa248f3849936053713453e3c7c3943
- SHA512 1930e566a15a91af54614d2b291dcacb4ad7a942dcfd1d301cd2c439139d79691688586df8d6ce294f0b292092b9e0d9a2146a8f30929bf102794520390170cc
- MD5 SHA1 SHA512
- Path /usr/lib/kworker-helper
- Size 59KB
- SHA256 36df734baeb3aff8b5bff7aeb35e3a90438a3efc8ab593af91a5d87d7c75014c
- MD5 cf1ae18fd855aeb019cb4bf9afdaca50
- SHA1 09a0a0bb848db80bf1f11c2f11c8a027d81e26d3
- SHA512 713dd27b3abc546cda73923042c3145ed8096515f0e0c728b1f8130b030785f867a07c29c3fe33eb933748d955f01d9b98b10da82dc7eb3f6e536ddd7018e604
- SSDEEP 1536:yJzMtPCxFv3gqmWRl637x6hPdQ/9Hww4QuP:yJooFv3gqFl6rx68lnuP
- TLSH T1B253F1A51A27ACE0DB59173326788790E67273A6C2C3872F14B4686FF86F5447E047A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /var/spool/cron/crontabs/tmp.2z9U9Z
- Size 207B
- SHA256 84ecc4abb84f688ba98ce9adcce18b8585141f51ff22412548fb454bbc0dd380
- MD5 6eb3cffc254aa065affa0cf578e01f08
- SHA1 19e435606a177a08fff94fa26791b76e61a669bb
- SHA512 dc1a91d7231d33b6489a31cc21a2bc7a3e7f5ede113b01572bfa5168f8d7ff32d252791239e63aefbf9094ec79f1a56656625e2dc468f0193c8ba800c96c12ee
- TLSH T1C2D0221D7F012A302E082B86241E0B1CED819839C04DBE80E1AC242683466C8BB61C66
- MD5 SHA1 SHA512 TLSH