Overview

overview

6

Static

static

1

x86.elf

ubuntu-18.04-amd64

6

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    20/09/2026, 06:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    x86.elf
  • Size 1000KB
  • Sample260920-hl3d7stdlh
  • SHA256 aaa63f1d5a6db0dbe31c06e648168f2c60d474a45fd547e4a4db68aa05929127
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Reads runtime system information 14 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/x86.elf
    /tmp/x86.elf
    1⤵
    • Modifies rc script
    • Modifies systemd
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1471
    • /bin/sh
      sh -c "(crontab -l 2>/dev/null; echo '*/5 * * * * /proc/self/exe >/dev/null 2>&1') | crontab - 2>/dev/null"
      2⤵
        PID:1474
        • /usr/bin/crontab
          crontab -
          3⤵
          • Creates/modifies Cron job
          PID:1476
        • /usr/bin/crontab
          crontab -l
          3⤵
            PID:1477
        • /bin/sh
          sh -c "mkdir -p /etc/systemd/system 2>/dev/null"
          2⤵
            PID:1481
            • /bin/mkdir
              mkdir -p /etc/systemd/system
              3⤵
              • Reads runtime system information
              PID:1483
          • /bin/sh
            sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable redkill.service 2>/dev/null"
            2⤵
              PID:1484
              • /bin/systemctl
                systemctl daemon-reload
                3⤵
                • Reads runtime system information
                PID:1485
              • /bin/systemctl
                systemctl enable redkill.service
                3⤵
                • Reads runtime system information
                PID:1509
            • /bin/sh
              sh -c "echo '/proc/self/exe >/dev/null 2>&1 &' >> /etc/bash.bashrc 2>/dev/null"
              2⤵
              • Creates/modifies environment variables
              • Modifies Bash startup script
              PID:1531
            • /bin/sh
              sh -c "echo '/proc/self/exe >/dev/null 2>&1 &' >> ~/.bashrc 2>/dev/null"
              2⤵
              • Writes file to tmp directory
              PID:1532

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Persistence

                Boot or Logon Autostart Execution

                3
                T1547

                XDG Autostart Entries

                1
                T1547.013

                Boot or Logon Initialization Scripts

                1
                T1037

                RC Scripts

                1
                T1037.004

                Create or Modify System Process

                1
                T1543

                Systemd Service

                1
                T1543.002

                Event Triggered Execution

                1
                T1546

                Unix Shell Configuration Modification

                1
                T1546.004

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                3
                T1547

                XDG Autostart Entries

                1
                T1547.013

                Boot or Logon Initialization Scripts

                1
                T1037

                RC Scripts

                1
                T1037.004

                Create or Modify System Process

                1
                T1543

                Systemd Service

                1
                T1543.002

                Event Triggered Execution

                1
                T1546

                Unix Shell Configuration Modification

                1
                T1546.004

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Scheduled Task/Job

                1
                T1053

                Cron

                1
                T1053.003

                Defense Evasion

                Hijack Execution Flow

                1
                T1574

                Path Interception by PATH Environment Variable

                1
                T1574.007

                Credential Access

                Discovery

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                rc.local
                • Path /etc/rc.local
                • Size 34B
                • SHA256 1c996704d87e72119d22980b0411064f8a63f70b8b9c000b42c09c05180cf93b
                • MD5 SHA1 SHA512
                Submit Download

                redkill.service
                • Path /etc/systemd/system/redkill.service
                • Size 136B
                • SHA256 313db5bd8fa734d9e8c4ffb123ced8d03dc50690406c50a286764d9ae22d553b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                .redkill
                • Path /tmp/.redkill
                • Size 1000KB
                • SHA256 aaa63f1d5a6db0dbe31c06e648168f2c60d474a45fd547e4a4db68aa05929127
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmp.916Hp1
                • Path /var/spool/cron/crontabs/tmp.916Hp1
                • Size 218B
                • SHA256 9e6967045b1f1e82e3f797d61515b27bf65678ac87d533d18b8bbc6b9eaf8e88
                • MD5 SHA1 SHA512 TLSH
                Submit Download