Overview

overview

9

Static

static

5

pcdn.elf

ubuntu-18.04-amd64

9

Analysis

  • max time kernel
    34s
  • max time network
    152s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    25/08/2026, 10:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pcdn.elf
  • Size 5.1MB
  • Sample260825-l33cbazeph
  • SHA256 6c2a884eb6c0c038a57f7a5009586b8edcbd4d20ccc8a886d5ddd40ac770d2ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
bootkitcommand_and_controldiscoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Contacts a large (1896) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Modifies kernel boot image 3 IoCs

    Overwrites kernel image in the /boot mountpoint.

    bootkit
  • Outbound SSH connection to public host 2 TTPs 64 IoCs

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 14 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

Processes

  • /tmp/pcdn.elf
    /tmp/pcdn.elf
    1⤵
    • Modifies kernel boot image
    • Enumerates kernel/hardware configuration
    PID:1489
    • /tmp/pcdn.elf
      /tmp/pcdn.elf e
      2⤵
      • Modifies kernel boot image
      • Modifies systemd
      • Enumerates kernel/hardware configuration
      PID:1498
      • /bin/mount
        mount -o bind /var /proc/1498/
        3⤵
        • Reads runtime system information
        PID:1507
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Reads runtime system information
        PID:1508
      • /tmp/pcdn.elf
        /tmp/pcdn.elf d
        3⤵
        • Modifies kernel boot image
        • Enumerates kernel/hardware configuration
        PID:1510
        • /bin/mount
          mount -o bind /var /proc/1510/
          4⤵
          • Reads runtime system information
          PID:1535
      • /bin/systemctl
        systemctl enable redis.service
        3⤵
        • Reads runtime system information
        PID:1538

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        vmlinux
        • Path /boot/vmlinux
        • Size 5.1MB
        • SHA256 6c2a884eb6c0c038a57f7a5009586b8edcbd4d20ccc8a886d5ddd40ac770d2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        redis.service
        • Path /etc/systemd/system/redis.service
        • Size 162B
        • SHA256 7670162855ab7140cfb8ad8bcb5320f10ac08fcdf2731210a7998083e01ceee2
        • MD5 SHA1 SHA512 TLSH
        Submit Download