aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Analysis

max time kernel
148s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
Size 59KB
Sample260910-xd8ctaw1e1
SHA256 aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
MD5 c45e98219b3075737e6e257432a920a9
SHA1 2bafd5b0c868c3f031e3523e9a63760c6aea60ff
SHA512 416478cd98dc3d58ae5f77fa5814b673c121eeca193bc3a700d6820f524fe50ee7758aad53808ee772584a8b63f9181e00c46052b0c3ca204147f2ca65e14636
SSDEEP 1536:MY9dIYf58JgUnyEOpR9gDofMxYI27uOHVgHnouy8Lzkk+:MY9pf5T6yEOHg4AYIsuO1gHoutUk+
TLSH
T18B5302C3F0B44F43C77505B0EAEB3C928934825AA0C60AF65BD5F7724E69660B86C4A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution keylogger persistence privilege_escalation

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Deletes journal logs 1 TTPs 3 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system@0b5d78f8189d4bbd88a68c237b2601ac-0000000000000001-000651b60c1d7fad.journal	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/[email protected]~	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/syslog	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
1491	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
1493	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/killer-helper	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Deletes log files 1 TTPs 6 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/faillog	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File truncated	/var/log/kern.log	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File truncated	/var/log/auth.log	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File truncated	/var/log/wtmp	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File truncated	/var/log/btmp	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File truncated	/var/log/lastlog	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/killer-helper.service	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Reads hardware input events 1 TTPs 1 IoCs

Reads raw input events from the evdev driver, possibly to record keystrokes.

keylogger discovery

Keylogging

T1056.001

description	ioc	Process
File opened for reading	/dev/input/event0	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	orimhhh	1491	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
Changes the process name, possibly in an attempt to hide itself	kworker/0:0	1496	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1493	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/net/tcp6	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/debug/tracing	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/963/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/83/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/84/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/689/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/174/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/972/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/25/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/661/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/986/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/657/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/15/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/137/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/484/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/81/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/465/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/602/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/14/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/2/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/921/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1050/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1091/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/28/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/940/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/27/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/6/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/29/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1019/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1044/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/966/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/502/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1045/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1091/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1480/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1061/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1078/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1240/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1501/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1503/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/168/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/22/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/27/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/165/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/967/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1529/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/659/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1019/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/173/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1190/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/161/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1090/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/9/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/444/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1012/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1085/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/83/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/158/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1304/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/173/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/1188/comm	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/21/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/23/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
File opened for reading	/proc/449/cmdline	aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d

System Network Configuration Discovery 1 TTPs 16 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1563	iptables-restore
1521	iptables-restore
1522	iptables-restore
1524	iptables-restore
1525	iptables-restore
1527	iptables-restore
1535	iptables-restore
1532	iptables-restore
1564	iptables-restore
1568	iptables-restore
1523	iptables-restore
1533	iptables-restore
1569	iptables-restore
1526	iptables-restore
1537	iptables-restore
1538	iptables-restore

/tmp/aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
/tmp/aac5b8ba4ad8ca16051ecc9ca05f040c3175d8e2794f05e90865972fc595b87d
1⤵
- Deletes Audit logs
- Deletes journal logs
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Traces itself
- Creates/modifies Cron job
- Deletes log files
- Enumerates active TCP sockets
- Modifies rc script
- Modifies systemd
- Reads hardware input events
- Changes its process name
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1488
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1495
- /sbin/iptables
  iptables --version
  2⤵
  PID:1520
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1521
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1522
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1523
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1524
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1525
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1526
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1527
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1532
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1533
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1535
- /bin/systemctl
  systemctl enable killer-helper.service
  2⤵
  - Reads runtime system information
  PID:1536
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1537
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1538
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1563
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1564
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1568
- /usr/sbin/iptables-restore
  iptables-restore
  2⤵
  - System Network Configuration Discovery
  PID:1569

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Adversary-in-the-Middle

T1557

Input Capture

T1056

Keylogging

T1056.001

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Input Capture

T1056

Keylogging

T1056.001

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.locker.pid.tmp

Path /run/.locker.pid.tmp
Size 10B
SHA256 431631b0f8aad561bc7e77377afeacbb8421aaacba41ab4589a989df0124f77f
MD5 3a7c01bd0b8d647d32785e4887a561e0
SHA1 28ec880566e8f26edb1e2bfebbd5d0171b2a3915
SHA512 5ba066f9e98224c2045612ca59e208c3e58b65b4d04965b780119b996e2256d724835f1f34be3d2c02929b9ffc3a0992ac29d7a573fb1da67a4a6f4620ff9b84
MD5 SHA1 SHA512

Submit Download

.watchdog.pid.tmp

Path /run/.watchdog.pid.tmp
Size 10B
SHA256 a1dc32233503863d77331801905c82f79d1f3ebbbcfd0874782452a2d8d4398e
MD5 d70581231b491df30cc17c86d2d360d5
SHA1 ae1226ebd3c0057d02e87f7ba9e65e55ba676f68
SHA512 6fa482a0234cf1de54c609eef8950b59550bfebabda8dd2b626f82d29ca145fcd3b26f91eb36ae6c93f9c12e1d61d45ec829b503f50119af0037528732b34936
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads