8402e5704c40778694c3bc16bb76c1e906e3527a976d43b6dbf2cfa3de59da9b

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x86_64.elf
Size 175KB
Sample260819-tyf8aayamd
SHA256 8402e5704c40778694c3bc16bb76c1e906e3527a976d43b6dbf2cfa3de59da9b
MD5 5c0486d686736ca7b8a0f3e8e32fd181
SHA1 eda3df5299cc95c3d9edee76eacb8a06950cb8ac
SHA512 24362d1aa68da2ce8772b3d40207055381e74f7e7efd3a472f99ef7f1d8f8adc81de73afbf8a7f135c0587257673d438ddfd04298d73a34aff71ebacfd3d9059
SSDEEP 3072:jiSbx1u5E67Xi42yBbcOJiGI1rcw1GWT6fFvY1A4QNwE9IVQHoS:jxs5Eo7aTgu8AUHoS
TLSH
T12D046C1BB5D188FDC8D6C1B84B9EE236DA72F0091138761F27D46E226E4DF306B6DA50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	x86_64.elf

Deletes itself 1 IoCs

pid	Process
1538	5

Deletes journal logs 1 TTPs 3 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system@3596518864164933827dc2b04e5025a8-0000000000000001-000651b6517d8d19.journal	x86_64.elf
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal	x86_64.elf
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/[email protected]~	x86_64.elf

Deletes system logs 1 TTPs 2 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	x86_64.elf
File truncated	/var/log/syslog	x86_64.elf

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	x86_64.elf

Deletes log files 1 TTPs 12 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/faillog	x86_64.elf
File truncated	/var/log/faillog	x86_64.elf
File deleted	/var/log/kern.log	x86_64.elf
File truncated	/var/log/kern.log	x86_64.elf
File deleted	/var/log/auth.log	x86_64.elf
File truncated	/var/log/auth.log	x86_64.elf
File deleted	/var/log/wtmp	x86_64.elf
File truncated	/var/log/wtmp	x86_64.elf
File truncated	/var/log/btmp	x86_64.elf
File deleted	/var/log/lastlog	x86_64.elf
File truncated	/var/log/lastlog	x86_64.elf
File deleted	/var/log/btmp	x86_64.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	x86_64.elf

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	1538	x86_64.elf
Changes the process name, possibly in an attempt to hide itself	kworker/0:0	1546	x86_64.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	5

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	x86_64.elf
File opened for reading	/proc/net/tcp6	x86_64.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/165/cmdline	x86_64.elf
File opened for reading	/proc/1094/comm	x86_64.elf
File opened for reading	/proc/1388/comm	x86_64.elf
File opened for reading	/proc/1541/cmdline	x86_64.elf
File opened for reading	/proc/2026/cmdline	x86_64.elf
File opened for reading	/proc/488/comm	x86_64.elf
File opened for reading	/proc/992/cmdline	x86_64.elf
File opened for reading	/proc/1716/comm	x86_64.elf
File opened for reading	/proc/1716/cmdline	x86_64.elf
File opened for reading	/proc/1921/comm	x86_64.elf
File opened for reading	/proc/1309/comm	x86_64.elf
File opened for reading	/proc/98/cmdline	x86_64.elf
File opened for reading	/proc/172/cmdline	x86_64.elf
File opened for reading	/proc/656/cmdline	x86_64.elf
File opened for reading	/proc/1025/cmdline	x86_64.elf
File opened for reading	/proc/1532/comm	x86_64.elf
File opened for reading	/proc/1739/comm	x86_64.elf
File opened for reading	/proc/202/comm	x86_64.elf
File opened for reading	/proc/659/cmdline	x86_64.elf
File opened for reading	/proc/98/comm	x86_64.elf
File opened for reading	/proc/1332/comm	x86_64.elf
File opened for reading	/proc/2115/comm	x86_64.elf
File opened for reading	/proc/83/cmdline	x86_64.elf
File opened for reading	/proc/163/cmdline	x86_64.elf
File opened for reading	/proc/1096/comm	x86_64.elf
File opened for reading	/proc/15/cmdline	x86_64.elf
File opened for reading	/proc/18/cmdline	x86_64.elf
File opened for reading	/proc/1869/cmdline	x86_64.elf
File opened for reading	/proc/1891/cmdline	x86_64.elf
File opened for reading	/proc/1932/comm	x86_64.elf
File opened for reading	/proc/171/comm	x86_64.elf
File opened for reading	/proc/541/comm	x86_64.elf
File opened for reading	/proc/1809/cmdline	x86_64.elf
File opened for reading	/proc/12/cmdline	x86_64.elf
File opened for reading	/proc/1167/comm	x86_64.elf
File opened for reading	/proc/1643/comm	x86_64.elf
File opened for reading	/proc/1643/cmdline	x86_64.elf
File opened for reading	/proc/1910/comm	x86_64.elf
File opened for reading	/proc/9/comm	x86_64.elf
File opened for reading	/proc/173/cmdline	x86_64.elf
File opened for reading	/proc/1046/cmdline	x86_64.elf
File opened for reading	/proc/1621/comm	x86_64.elf
File opened for reading	/proc/1839/comm	x86_64.elf
File opened for reading	/proc/1033/cmdline	x86_64.elf
File opened for reading	/proc/1029/comm	x86_64.elf
File opened for reading	/proc/1052/comm	x86_64.elf
File opened for reading	/proc/488/cmdline	x86_64.elf
File opened for reading	/proc/1798/comm	x86_64.elf
File opened for reading	/proc/660/comm	x86_64.elf
File opened for reading	/proc/494/cmdline	x86_64.elf
File opened for reading	/proc/1071/cmdline	x86_64.elf
File opened for reading	/proc/10/comm	x86_64.elf
File opened for reading	/proc/1421/comm	x86_64.elf
File opened for reading	/proc/1508/comm	x86_64.elf
File opened for reading	/proc/964/cmdline	x86_64.elf
File opened for reading	/proc/1134/cmdline	x86_64.elf
File opened for reading	/proc/1316/cmdline	x86_64.elf
File opened for reading	/proc/1541/comm	x86_64.elf
File opened for reading	/proc/166/comm	x86_64.elf
File opened for reading	/proc/446/comm	x86_64.elf
File opened for reading	/proc/164/cmdline	x86_64.elf
File opened for reading	/proc/1101/cmdline	x86_64.elf
File opened for reading	/proc/1787/comm	x86_64.elf
File opened for reading	/proc/1903/cmdline	x86_64.elf

/tmp/x86_64.elf
/tmp/x86_64.elf
1⤵
- Deletes Audit logs
- Deletes journal logs
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Deletes log files
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1536
- /sbin/iptables
  iptables -w -D INPUT -j LOCKER_INPUT
  2⤵
  PID:1542
- /sbin/iptables
  iptables -w -X LOCKER_INPUT
  2⤵
  PID:1545
- /sbin/iptables
  iptables --version
  2⤵
  PID:1547
- /sbin/iptables
  iptables -w -N LOCKER_INPUT
  2⤵
  PID:1548
- /sbin/iptables
  iptables -w -C INPUT -j LOCKER_INPUT
  2⤵
  PID:1549
- /sbin/iptables
  iptables -w -I INPUT -j LOCKER_INPUT
  2⤵
  PID:1550
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 22 -j DROP
  2⤵
  PID:1551
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 23 -j DROP
  2⤵
  PID:1554
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 2323 -j DROP
  2⤵
  PID:1555
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 21 -j DROP
  2⤵
  PID:1556
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5900 -j DROP
  2⤵
  PID:1557
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 3389 -j DROP
  2⤵
  PID:1558
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5901 -j DROP
  2⤵
  PID:1559
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5902 -j DROP
  2⤵
  PID:1560
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5800 -j DROP
  2⤵
  PID:1561
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 5801 -j DROP
  2⤵
  PID:1562
- /sbin/iptables
  iptables -w -A LOCKER_INPUT -p tcp --dport 2222 -j DROP
  2⤵
  PID:1563
- /sbin/iptables
  iptables --version
  2⤵
  PID:1570

/proc/self/fd/5
NetworkManager
1⤵
- Deletes itself
- Checks CPU configuration
PID:1538

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.disabled.list

Path /run/.disabled.list
Size 13B
SHA256 28cc62c98b48bed3beca77ada5711df900365685c0c24362831decac4147b6e6
MD5 4d3eb3aa664f8b13e009956c510978a8
SHA1 856853c4b7c03976f235b3ac46a42c960a7553d1
SHA512 793aae6214e4d306834ec4407f76ff078c1f83ba71b4f9a32a5caeeacc1443c9da17386b3d384f306f3d83eb4822adeb080dd72efdf792f90be08ec2289de433
MD5 SHA1 SHA512

Submit Download

.disabled.list

Path /run/.disabled.list
Size 28B
SHA256 ee1b8469298c3a0f7893092a0b87371dcc76970f494298339d5eaf9a73113a46
MD5 5f5d3495c4a2d24b2511d9cd8de2785d
SHA1 72cb0c68cd5cd3ba2ab6dcd073c9330ec9b3a900
SHA512 d969c34eb7fa3203ba23b2c6d5912e858c405d44039a22276ba8522dd425740360c485eade9b5ed558fc8ac1f394a8c3381a128648e9d62e029d188cb7146338
MD5 SHA1 SHA512

Submit Download

.disabled.list

Path /run/.disabled.list
Size 41B
SHA256 222260ceec44631991e914d897f699100498c3b3967c9033580c97c71b8e1f49
MD5 b9bdf4d788858c7b93e5c8d3f448fa9d
SHA1 3524a6db4a8ed2f4db095b7688d9acf383f4a058
SHA512 ee74bf7aabd76d8b6d6657802383dc57d864bc847e63aa92dbe4fa87702e99efac6e340cada9bb643814d67f649fba01fe8038655e210fe38a474f0010bf02e6
MD5 SHA1 SHA512

Submit Download

.disabled.list

Path /run/.disabled.list
Size 54B
SHA256 e84c0150ec7fe999e90d35732e0df28e1a0970d4bf5a7b30007d0380f566d671
MD5 1d6cd937bd675a052fd3f3c0582e1259
SHA1 9c4ff7d8c394fe76d1ae2688af0305911de07fa3
SHA512 4afe14aa6362b2524903dcfe946651da242a74f277280061a0eac8deecc0ec815d2ff7fff40e3aebf3e7d727d1ccd08ffca765601386902efc17e789df2ef410
TLSH
T1F4900401F40C033DCC040D374500031550C101401C10FF1004D15505C5373D33310C3D
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 128B
SHA256 56c1e3fb3415b8fdc05ed3a61d63618af0c59657e0557b37eb6550daf299ffe2
MD5 9304bbe4917e9118976786ff89e2e8f1
SHA1 22e7028a89bbe67ec1c6a2972be5696bfca25c01
SHA512 99680561c53d3e2754d27beabbe6af2ecd9d6da87befc134e43b3e1a7fde1307251fa5e414c1317c1a39cb78cc9e2a1ea9218fdc1062192204a6787b6948ef76
TLSH
T132B00250CC4548B1746920012827CF999B241551481744145866C6586E4C4E65945B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 170B
SHA256 3778f3541894a52d8cafb7deb6c034bb4c5c3df11455fcd17e373754da4c3d9c
MD5 9e9ae04e21777a6063f3074bcc62da95
SHA1 e1692161c20ec660727ed47c05daf1f3220e43b4
SHA512 4c684e456468b66cff510947daafc1ae21d76d218e4c14fb2094f67b8c725ebe5dc5c16adc9df6999923570bc3d5780dc68c1a1602796c034b444b16d956f661
TLSH
T139C00251CC4548B1756920012827CF999B241551481744149866D6586E4C8E65945B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 214B
SHA256 3f9b65a7c79f48e5dd88f2e0fedd5c35725f33ebf30c9ec26610bd8ea6ed192f
MD5 bf6cd64e6cf1c951fe11966eccae256b
SHA1 f1cf9332cea0b052e4cb155b9f3844105365d969
SHA512 7d25819382cc4963114d55b6aa2da3935861b796c11aadb97c07ba24926f7860f1277a9c1045be514ddc04d480b069e6772558afafe2cc61562460d827355eed
TLSH
T173D0A210CC084871749920013823CF999B241541481B04549866D65C2E4C8E65941B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 478B
SHA256 30654cd5cbadbd3423a33215f05c06cc7ba77d3c8879c96c8ec68ab6ebc08561
MD5 9446cb55f55fb88f53c9f42cfed84e9e
SHA1 bcc492e9fc334e570bb64bc83caa89a7a215d025
SHA512 48fdd7d18bfcee0013fe7f4c5fffb5de40b719a456aec478771481e27e8cade2d382121b46387ff63b0f8e030b943d004b1b899794b4d2744cf057a85b8def85
TLSH
T168F09215CC088871799D24013C23CFD99F782841481B045198A6D6AC6E499F65A42B41
MD5 SHA1 SHA512 TLSH

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 42B
SHA256 ea3662f08c78ba53018533d2bf03418163d0f629a10e5b4a93f4b3a9424eaac5
MD5 d35536d363a89490c75d83fd231636c6
SHA1 c64ff3054ff0cc2f4ad141fe5b4320a77a4efdfd
SHA512 923fa528e3faf14fd46c79b25c9b3bc0f29a65f127d13bcb8d8b8de0e2c40a08993cc2295df66d9e143577d2db3dccaacd7293fdaae40b4d439f17e4e4cd9cb9
MD5 SHA1 SHA512

Submit Download

.iptables.rules

Path /run/.iptables.rules
Size 84B
SHA256 47dcfb86d6f248a7b6f4f60d87485469a43585b8db1c7fe2856d6e0ef81dd43d
MD5 43ea709a3265d712d0f59ce87b48c17d
SHA1 9ad0e157eccb16f1532de04abdf147b6c3c99d58
SHA512 7148dc65583e336143c2b19b77f981865da411bd7c8e4041bbe60b4b479ce6a016586c53ddcb58134f33880bbd919e1022cc2da0b8746ca07d408448dbee7468
TLSH
T1E8A00210CC454CB1746D30013823CFDDDB3415414C1744145C76C65C7F4C4F75501F41
MD5 SHA1 SHA512 TLSH

Submit Download

.locker.pid.tmp

Path /run/.locker.pid.tmp
Size 4B
SHA256 495afe547befeedeef191264812945e2c199da63da0e8dfde79bee7dbecb210f
MD5 aff0a6a4521232970b2c1cf539ad0a19
SHA1 bcceeba1e77189d6a3938f29437de543a18024fb
SHA512 8938b57c391e57720fe6e2ad915e3e1252bbfd30e3c0d72e2c98f83723364da32ee8c7e71eef0d386bd14bf210568a32bda74a74748ff8338d794c8de2210656
MD5 SHA1 SHA512

Submit Download

.locker.ready

Path /run/.locker.ready
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

.watchdog.pid.tmp

Path /run/.watchdog.pid.tmp
Size 4B
SHA256 a2258ffaf9a1490a7a7a01c282b1fe03224a2952b119c3f32b1de4739407cd58
MD5 dfa92d8f817e5b08fcaafb50d03763cf
SHA1 722a7e9c6dcbb04ed1fffe8d658ea03ce68f8e01
SHA512 1bb31aa3c0b2b98b36fd84e77aea11ddd9861c3117e90f50627816895636534067f94ea56526c692611289f44d020dc9b44b03d2c94db07f04ae9d2e9b643d77
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads