General
- Target bot.x86_64.elf
- Size 903KB
- Sample260819-t3db7agb96
- SHA256 b90bed9e263890355772c8bc2feeff76509bca7a596f6afcc9221f5b104eea8e
- MD5 8df388b067ed03d37847c5af4527fbdc
- SHA1 30ff8c2fdf4980f91be3bded217368656a243a7b
- SHA512 bee9c598f8b34f86a13eea3c3f449808c6441ac416db2868a51bd612b38b4d570afc754ec3256bc8a6e30d6f2e8c80d11f29862bccaa4daf6b712627597d04ad
- SSDEEP 12288:QSvd2S3bGcr8P9O4E1I7iEd5HFeMNgVH5u4EwOKbl9tFQQwjjay7AGNeHX:QSvd2S3bGcr8grm7hNglQ4EablzWAG
- TLSH T16B158C1AB2B3F5BCD00BC0304BDBCAB29535B07925212D7B37C4DA353E66DA11369B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
bot.x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target bot.x86_64.elf
- Size 903KB
- SHA256 b90bed9e263890355772c8bc2feeff76509bca7a596f6afcc9221f5b104eea8e
- MD5 8df388b067ed03d37847c5af4527fbdc
- SHA1 30ff8c2fdf4980f91be3bded217368656a243a7b
- SHA512 bee9c598f8b34f86a13eea3c3f449808c6441ac416db2868a51bd612b38b4d570afc754ec3256bc8a6e30d6f2e8c80d11f29862bccaa4daf6b712627597d04ad
- SSDEEP 12288:QSvd2S3bGcr8P9O4E1I7iEd5HFeMNgVH5u4EwOKbl9tFQQwjjay7AGNeHX:QSvd2S3bGcr8grm7hNglQ4EablzWAG
- TLSH T16B158C1AB2B3F5BCD00BC0304BDBCAB29535B07925212D7B37C4DA353E66DA11369B66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes itself
-
Traces itself
Traces itself to prevent debugging attempts
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1