806385c4d1ce5fb675357095cb07a81e0a0aebe4962b66e5422e0000945c149d

Analysis

max time kernel
149s
max time network
152s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/08/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x86_64.elf
Size 65KB
Sample260819-cbyelsvbne
SHA256 806385c4d1ce5fb675357095cb07a81e0a0aebe4962b66e5422e0000945c149d
MD5 18c6be9c842ad5eea014af6dde935693
SHA1 707f648b8731cf4163d2c6e1aa979400ccba3e1c
SHA512 16e8995e1818154b0a0cd18e0a2d963138836cd123a75eacad0b90aaaaecfe1ec0a5a281c5953ebceb09fcbba247fbf43ae7c69e77b574ec638020caa239a891
SSDEEP 1536:kgQipUH86fUac/c4NJtQp5Y2ecgj9z2gIHLRPQwk5xN:bRU7fUe4NMp5Y2X69z2gIV4f53
TLSH
T1FD6302731217CE3DE47BB0B6276E125FEE01854719914F7FEB8719BF9A700202AA2760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	x86_64.elf

Deletes itself 1 IoCs

pid	Process
1470	5

Deletes journal logs 1 TTPs 3 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system@86c7b08fe52f47de94a74615ac3fb08d-0000000000000001-000651b655f5f45f.journal	x86_64.elf
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal	x86_64.elf
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/[email protected]~	x86_64.elf

Deletes system logs 1 TTPs 2 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	x86_64.elf
File truncated	/var/log/syslog	x86_64.elf

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	x86_64.elf

Deletes log files 1 TTPs 12 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/auth.log	x86_64.elf
File deleted	/var/log/wtmp	x86_64.elf
File truncated	/var/log/wtmp	x86_64.elf
File deleted	/var/log/faillog	x86_64.elf
File truncated	/var/log/faillog	x86_64.elf
File deleted	/var/log/kern.log	x86_64.elf
File truncated	/var/log/kern.log	x86_64.elf
File deleted	/var/log/auth.log	x86_64.elf
File deleted	/var/log/btmp	x86_64.elf
File truncated	/var/log/btmp	x86_64.elf
File deleted	/var/log/lastlog	x86_64.elf
File truncated	/var/log/lastlog	x86_64.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	x86_64.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	1470	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	kworker/0:0	1478	x86_64.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	5

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	x86_64.elf
File opened for reading	/proc/net/tcp6	x86_64.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/956/cmdline	x86_64.elf
File opened for reading	/proc/2029/comm	x86_64.elf
File opened for reading	/proc/81/comm	x86_64.elf
File opened for reading	/proc/82/comm	x86_64.elf
File opened for reading	/proc/267/comm	x86_64.elf
File opened for reading	/proc/1062/cmdline	x86_64.elf
File opened for reading	/proc/1977/cmdline	x86_64.elf
File opened for reading	/proc/84/comm	x86_64.elf
File opened for reading	/proc/1070/comm	x86_64.elf
File opened for reading	/proc/1363/cmdline	x86_64.elf
File opened for reading	/proc/1690/comm	x86_64.elf
File opened for reading	/proc/20/comm	x86_64.elf
File opened for reading	/proc/89/comm	x86_64.elf
File opened for reading	/proc/5/comm	x86_64.elf
File opened for reading	/proc/159/cmdline	x86_64.elf
File opened for reading	/proc/1918/cmdline	x86_64.elf
File opened for reading	/proc/13/cmdline	x86_64.elf
File opened for reading	/proc/36/cmdline	x86_64.elf
File opened for reading	/proc/1149/comm	x86_64.elf
File opened for reading	/proc/647/cmdline	x86_64.elf
File opened for reading	/proc/1301/comm	x86_64.elf
File opened for reading	/proc/130/cmdline	x86_64.elf
File opened for reading	/proc/1150/cmdline	x86_64.elf
File opened for reading	/proc/1512/comm	x86_64.elf
File opened for reading	/proc/2041/cmdline	x86_64.elf
File opened for reading	/proc/537/comm	x86_64.elf
File opened for reading	/proc/887/cmdline	x86_64.elf
File opened for reading	/proc/949/cmdline	x86_64.elf
File opened for reading	/proc/1070/cmdline	x86_64.elf
File opened for reading	/proc/1534/cmdline	x86_64.elf
File opened for reading	/proc/1906/comm	x86_64.elf
File opened for reading	/proc/2048/comm	x86_64.elf
File opened for reading	/proc/168/cmdline	x86_64.elf
File opened for reading	/proc/1959/cmdline	x86_64.elf
File opened for reading	/proc/976/comm	x86_64.elf
File opened for reading	/proc/24/cmdline	x86_64.elf
File opened for reading	/proc/164/cmdline	x86_64.elf
File opened for reading	/proc/959/cmdline	x86_64.elf
File opened for reading	/proc/1052/cmdline	x86_64.elf
File opened for reading	/proc/651/cmdline	x86_64.elf
File opened for reading	/proc/1795/comm	x86_64.elf
File opened for reading	/proc/1966/cmdline	x86_64.elf
File opened for reading	/proc/477/comm	x86_64.elf
File opened for reading	/proc/897/comm	x86_64.elf
File opened for reading	/proc/1471/comm	x86_64.elf
File opened for reading	/proc/526/cmdline	x86_64.elf
File opened for reading	/proc/4/comm	x86_64.elf
File opened for reading	/proc/25/comm	x86_64.elf
File opened for reading	/proc/201/comm	x86_64.elf
File opened for reading	/proc/567/comm	x86_64.elf
File opened for reading	/proc/14/cmdline	x86_64.elf
File opened for reading	/proc/1649/comm	x86_64.elf
File opened for reading	/proc/166/comm	x86_64.elf
File opened for reading	/proc/1025/comm	x86_64.elf
File opened for reading	/proc/1077/comm	x86_64.elf
File opened for reading	/proc/22/cmdline	x86_64.elf
File opened for reading	/proc/567/cmdline	x86_64.elf
File opened for reading	/proc/1130/cmdline	x86_64.elf
File opened for reading	/proc/1522/cmdline	x86_64.elf
File opened for reading	/proc/34/cmdline	x86_64.elf
File opened for reading	/proc/662/cmdline	x86_64.elf
File opened for reading	/proc/1149/cmdline	x86_64.elf
File opened for reading	/proc/1565/comm	x86_64.elf
File opened for reading	/proc/1588/cmdline	x86_64.elf

/tmp/x86_64.elf
/tmp/x86_64.elf
1⤵
- Deletes Audit logs
- Deletes journal logs
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Deletes log files
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1466
- /sbin/iptables
  iptables -w -D INPUT -j LOCKER_INPUT
  2⤵
  PID:1474
- /sbin/iptables
  iptables -w -X LOCKER_INPUT
  2⤵
  PID:1477
- /sbin/iptables
  iptables --version
  2⤵
  PID:1482
- /sbin/iptables
  iptables -w -N LOCKER_INPUT
  2⤵
  PID:1483
- /sbin/iptables
  iptables -w -C INPUT -j LOCKER_INPUT
  2⤵
  PID:1484
- /sbin/iptables
  iptables -w -I INPUT -j LOCKER_INPUT
  2⤵
  PID:1485
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 22 -j DROP
  2⤵
  PID:1486
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 23 -j DROP
  2⤵
  PID:1489
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 2323 -j DROP
  2⤵
  PID:1490
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 21 -j DROP
  2⤵
  PID:1491
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5900 -j DROP
  2⤵
  PID:1492
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 3389 -j DROP
  2⤵
  PID:1493
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5901 -j DROP
  2⤵
  PID:1494
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5902 -j DROP
  2⤵
  PID:1495
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5800 -j DROP
  2⤵
  PID:1496
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5801 -j DROP
  2⤵
  PID:1498
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 2222 -j DROP
  2⤵
  PID:1499
- /sbin/iptables
  iptables --version
  2⤵
  PID:1503

/proc/self/fd/5
rsyslogd
1⤵
- Deletes itself
- Checks CPU configuration
PID:1470

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.disabled.list

Path /run/.disabled.list
Size 14B
SHA256 b3b4bc539eea47e08c2e2edf6c248844696e3eae3ce03dce9dd2e859f7267621
MD5 e6265a2aeb179498cca95ff510cd39de
SHA1 19c6f358af2a0586855ece0b6d19a13530bff4a2
SHA512 89f2f646611fc833b5ae2b447978a38a3387b5ae4a6610c4fbc32b9e190e17bbdd144c3978ade179696e9b7e579ac41fc95da9588769dc9530ffb727a70b7088
MD5 SHA1 SHA512

Submit Download

.disabled.list

Path /run/.disabled.list
Size 28B
SHA256 ee1b8469298c3a0f7893092a0b87371dcc76970f494298339d5eaf9a73113a46
MD5 5f5d3495c4a2d24b2511d9cd8de2785d
SHA1 72cb0c68cd5cd3ba2ab6dcd073c9330ec9b3a900
SHA512 d969c34eb7fa3203ba23b2c6d5912e858c405d44039a22276ba8522dd425740360c485eade9b5ed558fc8ac1f394a8c3381a128648e9d62e029d188cb7146338
MD5 SHA1 SHA512

Submit Download

.disabled.list

Path /run/.disabled.list
Size 41B
SHA256 222260ceec44631991e914d897f699100498c3b3967c9033580c97c71b8e1f49
MD5 b9bdf4d788858c7b93e5c8d3f448fa9d
SHA1 3524a6db4a8ed2f4db095b7688d9acf383f4a058
SHA512 ee74bf7aabd76d8b6d6657802383dc57d864bc847e63aa92dbe4fa87702e99efac6e340cada9bb643814d67f649fba01fe8038655e210fe38a474f0010bf02e6
MD5 SHA1 SHA512

Submit Download

.disabled.list

Path /run/.disabled.list
Size 54B
SHA256 e84c0150ec7fe999e90d35732e0df28e1a0970d4bf5a7b30007d0380f566d671
MD5 1d6cd937bd675a052fd3f3c0582e1259
SHA1 9c4ff7d8c394fe76d1ae2688af0305911de07fa3
SHA512 4afe14aa6362b2524903dcfe946651da242a74f277280061a0eac8deecc0ec815d2ff7fff40e3aebf3e7d727d1ccd08ffca765601386902efc17e789df2ef410
TLSH
T1F4900401F40C033DCC040D374500031550C101401C10FF1004D15505C5373D33310C3D
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 128B
SHA256 56c1e3fb3415b8fdc05ed3a61d63618af0c59657e0557b37eb6550daf299ffe2
MD5 9304bbe4917e9118976786ff89e2e8f1
SHA1 22e7028a89bbe67ec1c6a2972be5696bfca25c01
SHA512 99680561c53d3e2754d27beabbe6af2ecd9d6da87befc134e43b3e1a7fde1307251fa5e414c1317c1a39cb78cc9e2a1ea9218fdc1062192204a6787b6948ef76
TLSH
T132B00250CC4548B1746920012827CF999B241551481744145866C6586E4C4E65945B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 170B
SHA256 3778f3541894a52d8cafb7deb6c034bb4c5c3df11455fcd17e373754da4c3d9c
MD5 9e9ae04e21777a6063f3074bcc62da95
SHA1 e1692161c20ec660727ed47c05daf1f3220e43b4
SHA512 4c684e456468b66cff510947daafc1ae21d76d218e4c14fb2094f67b8c725ebe5dc5c16adc9df6999923570bc3d5780dc68c1a1602796c034b444b16d956f661
TLSH
T139C00251CC4548B1756920012827CF999B241551481744149866D6586E4C8E65945B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 214B
SHA256 3f9b65a7c79f48e5dd88f2e0fedd5c35725f33ebf30c9ec26610bd8ea6ed192f
MD5 bf6cd64e6cf1c951fe11966eccae256b
SHA1 f1cf9332cea0b052e4cb155b9f3844105365d969
SHA512 7d25819382cc4963114d55b6aa2da3935861b796c11aadb97c07ba24926f7860f1277a9c1045be514ddc04d480b069e6772558afafe2cc61562460d827355eed
TLSH
T173D0A210CC084871749920013823CF999B241541481B04549866D65C2E4C8E65941B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 478B
SHA256 30654cd5cbadbd3423a33215f05c06cc7ba77d3c8879c96c8ec68ab6ebc08561
MD5 9446cb55f55fb88f53c9f42cfed84e9e
SHA1 bcc492e9fc334e570bb64bc83caa89a7a215d025
SHA512 48fdd7d18bfcee0013fe7f4c5fffb5de40b719a456aec478771481e27e8cade2d382121b46387ff63b0f8e030b943d004b1b899794b4d2744cf057a85b8def85
TLSH
T168F09215CC088871799D24013C23CFD99F782841481B045198A6D6AC6E499F65A42B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 42B
SHA256 ea3662f08c78ba53018533d2bf03418163d0f629a10e5b4a93f4b3a9424eaac5
MD5 d35536d363a89490c75d83fd231636c6
SHA1 c64ff3054ff0cc2f4ad141fe5b4320a77a4efdfd
SHA512 923fa528e3faf14fd46c79b25c9b3bc0f29a65f127d13bcb8d8b8de0e2c40a08993cc2295df66d9e143577d2db3dccaacd7293fdaae40b4d439f17e4e4cd9cb9
MD5 SHA1 SHA512

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 84B
SHA256 47dcfb86d6f248a7b6f4f60d87485469a43585b8db1c7fe2856d6e0ef81dd43d
MD5 43ea709a3265d712d0f59ce87b48c17d
SHA1 9ad0e157eccb16f1532de04abdf147b6c3c99d58
SHA512 7148dc65583e336143c2b19b77f981865da411bd7c8e4041bbe60b4b479ce6a016586c53ddcb58134f33880bbd919e1022cc2da0b8746ca07d408448dbee7468
TLSH
T1E8A00210CC454CB1746D30013823CFDDDB3415414C1744145C76C65C7F4C4F75501F41
MD5 SHA1 SHA512 TLSH

Submit Download

.locker.pid.tmp

Path /run/.locker.pid.tmp
Size 4B
SHA256 a13df1211cf4c38cdb7a165c67f8e5ab6fded2982c2cb1f55d4cefef880183d5
MD5 83cdcec08fbf90370fcf53bdd56604ff
SHA1 6bb0e3b82a69a2bdf7139d17eeb5f79818b92a4d
SHA512 4857999f8e8489709ca2c0f281437e6d1be198dad03232a20b7bccfa61290c371cd8176287a88b9157f74966fb1cecc9db68357d241a08e709d80dfb3426ce42
MD5 SHA1 SHA512

Submit Download

.locker.ready

Path /run/.locker.ready
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

.watchdog.pid.tmp

Path /run/.watchdog.pid.tmp
Size 4B
SHA256 3873ecf4855ce373db4b7afc32fe5884d984d37a32c2c605065671d3eed825d4
MD5 5cbdfd0dfa22a3fca7266376887f549b
SHA1 0e55c1a2d589c70e5cfe4c2ecdb1ccd2607aa44f
SHA512 35fc7e0ddb30c7736f785b0537f949ea370644ba6414a855548cb5ff1e0f7a9590b34dcacadcccc0883e4b4055b6fa9e12a25203b06423873ceccde1160f34e4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads