1e3eb765015fd335cfdcb0ddd020565690b5a2f15a2a62406d750bcb21b6d77b

Analysis

max time kernel
145s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amd64
Size 5.0MB
Sample260905-phf55a1vdz
SHA256 1e3eb765015fd335cfdcb0ddd020565690b5a2f15a2a62406d750bcb21b6d77b
MD5 fa83031a6964319843f67713fdd56b80
SHA1 42cb9b12c6287225772e040bf8b151c8935bc7e8
SHA512 dabc00e17bd465ad81907d036438b0c0844b7e327635de481eef5e1b34d65810f77996c34b1243f1f2fd1cbfff6cf6bccc2ec02dfc79b136537341b644c23f88
SSDEEP 49152:IJPpsCDvmLCyk8NbrRpeGICkKhhbnRL5EWOiGr9Y/zA95xwEhO:CpsAvmLCc/e6RXEBrPvxJ
TLSH
T1E7364A57FCA545E9C0AED1348A629252BA717C485B3123D72F90F7383F72BD0AA7A344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	amd64
File opened for modification	/dev/misc/watchdog	amd64

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/etc/profile.d/bash.cfg	amd64
File opened for modification	/etc/profile.d/bash.cfg.sh	amd64
File opened for modification	/etc/profile.d/gateway.sh	amd64

Modifies init.d 2 TTPs 35 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/irqbalance	amd64
File opened for modification	/etc/init.d/kmod	amd64
File opened for modification	/etc/init.d/saned	amd64
File opened for modification	/etc/init.d/spice-vdagent	amd64
File opened for modification	/etc/init.d/alsa-utils	amd64
File opened for modification	/etc/init.d/cups-browsed	amd64
File opened for modification	/etc/init.d/networking	amd64
File opened for modification	/etc/init.d/plymouth	amd64
File opened for modification	/etc/init.d/rsync	amd64
File opened for modification	/etc/init.d/selinux-autorelabel	amd64
File opened for modification	/etc/init.d/dns-udp4	amd64
File opened for modification	/etc/init.d/auditd	amd64
File opened for modification	/etc/init.d/ssh	amd64
File opened for modification	/etc/init.d/ufw	amd64
File opened for modification	/etc/init.d/gdm3	amd64
File opened for modification	/etc/init.d/apparmor	amd64
File opened for modification	/etc/init.d/apport	amd64
File opened for modification	/etc/init.d/bluetooth	amd64
File opened for modification	/etc/init.d/hwclock.sh	amd64
File opened for modification	/etc/init.d/keyboard-setup.sh	amd64
File opened for modification	/etc/init.d/plymouth-log	amd64
File opened for modification	/etc/init.d/speech-dispatcher	amd64
File opened for modification	/etc/init.d/cups	amd64
File opened for modification	/etc/init.d/unattended-upgrades	amd64
File opened for modification	/etc/init.d/dbus	amd64
File opened for modification	/etc/init.d/acpid	amd64
File opened for modification	/etc/init.d/console-setup.sh	amd64
File opened for modification	/etc/init.d/cron	amd64
File opened for modification	/etc/init.d/rsyslog	amd64
File opened for modification	/etc/init.d/udev	amd64
File opened for modification	/etc/init.d/uuidd	amd64
File opened for modification	/etc/init.d/x11-common	amd64
File opened for modification	/etc/init.d/anacron	amd64
File opened for modification	/etc/init.d/avahi-daemon	amd64
File opened for modification	/etc/init.d/procps	amd64

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile.d/bash.cfg	amd64
File opened for modification	/etc/profile.d/bash.cfg.sh	amd64
File opened for modification	/etc/profile.d/gateway.sh	amd64

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	amd64
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	amd64

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl

/tmp/amd64
/tmp/amd64
1⤵
- Enumerates kernel/hardware configuration
PID:1472
- /tmp/amd64
  /tmp/amd64 " "
  2⤵
  - Modifies Watchdog functionality
  - Creates/modifies environment variables
  - Modifies init.d
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  PID:1476
- - /usr/sbin/update-rc.d
    update-rc.d dns-udp4 defaults
    3⤵
    PID:1483
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1486
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1486
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1486
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1486
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1486
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:1486
- - /bin/mount
    mount -o bind /tmp/ /proc/1476
    3⤵
    PID:1507
- - /usr/sbin/service
    service cron start
    3⤵
    PID:1509
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1510
  - - /usr/bin/basename
      basename /usr/sbin/service
      4⤵
      PID:1511
  - - /bin/systemctl
      systemctl --quiet is-active multi-user.target
      4⤵
      Reads runtime system information
      PID:1512
  - - /bin/systemctl
      systemctl list-unit-files --full "--type=socket"
      4⤵
      Reads runtime system information
      PID:1514
  - - /bin/sed
      sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
      4⤵
      PID:1515
  - - /bin/systemctl
      systemctl -p Triggers show acpid.socket
      4⤵
      Reads runtime system information
      PID:1516
  - - /bin/systemctl
      systemctl -p Triggers show apport-forward.socket
      4⤵
      Reads runtime system information
      PID:1517
  - - /bin/systemctl
      systemctl -p Triggers show avahi-daemon.socket
      4⤵
      Reads runtime system information
      PID:1518
  - - /bin/systemctl
      systemctl -p Triggers show cups.socket
      4⤵
      Reads runtime system information
      PID:1519
  - - /bin/systemctl
      systemctl -p Triggers show dbus.socket
      4⤵
      Reads runtime system information
      PID:1520
  - - /bin/systemctl
      systemctl -p Triggers show saned.socket
      4⤵
      Reads runtime system information
      PID:1521
  - - /bin/systemctl
      systemctl -p Triggers show snapd.socket
      4⤵
      Reads runtime system information
      PID:1522
  - - /bin/systemctl
      systemctl -p Triggers show ssh.socket
      4⤵
      Reads runtime system information
      PID:1523
  - - /bin/systemctl
      systemctl -p Triggers show syslog.socket
      4⤵
      PID:1524
  - - /bin/systemctl
      systemctl -p Triggers show systemd-fsckd.socket
      4⤵
      Reads runtime system information
      PID:1525
  - - /bin/systemctl
      systemctl -p Triggers show systemd-initctl.socket
      4⤵
      Reads runtime system information
      PID:1526
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-audit.socket
      4⤵
      Reads runtime system information
      PID:1527
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald-dev-log.socket
      4⤵
      Reads runtime system information
      PID:1528
  - - /bin/systemctl
      systemctl -p Triggers show systemd-journald.socket
      4⤵
      Reads runtime system information
      PID:1529
  - - /bin/systemctl
      systemctl -p Triggers show systemd-networkd.socket
      4⤵
      Reads runtime system information
      PID:1530
  - - /bin/systemctl
      systemctl -p Triggers show systemd-rfkill.socket
      4⤵
      Reads runtime system information
      PID:1531
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-control.socket
      4⤵
      Reads runtime system information
      PID:1532
  - - /bin/systemctl
      systemctl -p Triggers show systemd-udevd-kernel.socket
      4⤵
      Reads runtime system information
      PID:1533
  - - /bin/systemctl
      systemctl -p Triggers show uuidd.socket
      4⤵
      Reads runtime system information
      PID:1534
- - /usr/local/sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:1509
- - /usr/local/bin/systemctl
    systemctl start cron.service
    3⤵
    PID:1509
- - /usr/sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:1509
- - /usr/bin/systemctl
    systemctl start cron.service
    3⤵
    PID:1509
- - /sbin/systemctl
    systemctl start cron.service
    3⤵
    PID:1509
- - /bin/systemctl
    systemctl start cron.service
    3⤵
    - Reads runtime system information
    PID:1509
- - /bin/systemctl
    systemctl start crond.service
    3⤵
    - Reads runtime system information
    PID:1535

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.mod

Path /.mod
Size 27B
SHA256 503dffa20530956c5f61187e00935f20fe508c35dbb1fcf665b5d28d07d3d704
MD5 f449ef47c4f79ab4ecfe3d11022333d5
SHA1 61ebb524cee5a049cc96bf2cbf339a47dcb1b622
SHA512 a7015de8bd582dbf7ce6df708a58a725e1b1cd472c6616fbb89a9738c533c042ac39c071ca0cf2fc5df8e56f33bf8a28b1ebd3076570f5028cff773af89031f6
MD5 SHA1 SHA512

Submit Download

system.pub

Path /boot/system.pub
Size 5.0MB
SHA256 1e3eb765015fd335cfdcb0ddd020565690b5a2f15a2a62406d750bcb21b6d77b
MD5 fa83031a6964319843f67713fdd56b80
SHA1 42cb9b12c6287225772e040bf8b151c8935bc7e8
SHA512 dabc00e17bd465ad81907d036438b0c0844b7e327635de481eef5e1b34d65810f77996c34b1243f1f2fd1cbfff6cf6bccc2ec02dfc79b136537341b644c23f88
SSDEEP 49152:IJPpsCDvmLCyk8NbrRpeGICkKhhbnRL5EWOiGr9Y/zA95xwEhO:CpsAvmLCc/e6RXEBrPvxJ
TLSH
T1E7364A57FCA545E9C0AED1348A629252BA717C485B3123D72F90F7383F72BD0AA7A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.cfg

Path /etc/.cfg
Size 57B
SHA256 99c308340df8fa6a681543e01ac990e88f932feb08f78014226512fc9a3dba22
MD5 e7cccb6b0aad0d03a6ea0947908f756d
SHA1 96a252ae9cee55b8b7c6d4e86699d00b0482bc15
SHA512 6e3fb4be6f43911e0a53a15a446ae5bc47e2aa75dd7da0ba1c71cc1730b1028432aaed4657bcac408dfa82037bf72dbd1550fd533aae3b5ac1d905508f1ac06e
TLSH
T1AE90020818C001187BA5D1D20DCC1140B19DE02409F16004C3C1958322164C5238D0EE
MD5 SHA1 SHA512 TLSH

Submit Download

.cfg

Path /etc/.cfg
Size 114B
SHA256 03d8cfb4e95f301cbf9d4e51bbbd2c83bf7e4c57e39c5e6ad2f2f4e455785318
MD5 8d8e0f67d2fa683e2051a81bba946e05
SHA1 d47ba994d36779a468175279ee51723ba8401da1
SHA512 7c1667bcdf5c226e226fbce136c774bf65e9a6261e702a6aa4bd5fe7861cf3ff89c055756aa30aa39323ebaded27cc9c75619fe1aa152939825aba801cea68b0
TLSH
T117B092081ACA100CBA62E1C90C89280A708DA45204A010D8C785E9C3725B0E916CA4D9
MD5 SHA1 SHA512 TLSH

Submit Download

dns-udp4

Path /etc/init.d/dns-udp4
Size 159B
SHA256 a3f7d4499b03a14ff2de76122b6a61c221151f59daa6a63a78ae5a805c95a482
MD5 79f1a0bf1a838c817142e43a5818733a
SHA1 768ed04a737dbdc969165092694e0e977321ca19
SHA512 b6d6f76f3e5b768a6670e05276724b70609259c856ba90ad34f8a782ac40134b9cf5cdabebb4aa55f076a786cedf8491adda9835f9d4aee90bd1820a45b2fbce
TLSH
T114C08C025B81FA7B148F29810C18E3424CB497846603E82EB04C32C0E74B38B89B4A24
MD5 SHA1 SHA512 TLSH

Submit Download

gateway.sh

Path /etc/profile.d/gateway.sh
Size 1KB
SHA256 69b61d6772051daf8a6d47f4fbe8b41469895388c249f9d8929cc53fe8085fca
MD5 10a4ada30fd6520ed493141a19f8cc73
SHA1 3eb742a21aa0c986bea54c5d22aaafa471732837
SHA512 998114c49324793470f36515f9882a41259f925f98ea1b4f7784667a931db02e79a19af3b8402695abdb9e0b890078f8dbf531f01d6769a2480593a2e740527f
TLSH
T155213241FDE78667115684B988BDB0382072337393C6BC30E3F638674FA8289122846F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads