Overview

overview

7

Static

static

5

3dd9ac7194...e8.elf

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    1s
  • max time network
    148s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    25/09/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3dd9ac7194cfdd4376196ffbb7b2c608ea11fc80ba1672dda6529109ecdf55e8.elf
  • Size 327KB
  • Sample260925-e6nvrsx14l
  • SHA256 3dd9ac7194cfdd4376196ffbb7b2c608ea11fc80ba1672dda6529109ecdf55e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Removes the immutable protection flag from a file 1 TTPs 6 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Write file to user bin folder 1 IoCs
    persistence
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/3dd9ac7194cfdd4376196ffbb7b2c608ea11fc80ba1672dda6529109ecdf55e8.elf
    /tmp/3dd9ac7194cfdd4376196ffbb7b2c608ea11fc80ba1672dda6529109ecdf55e8.elf
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Modifies systemd
    • Write file to user bin folder
    • Reads runtime system information
    PID:1489
    • /usr/bin/chattr
      chattr +i /etc/.kworker587
      2⤵
        PID:1498
      • /usr/bin/chattr
        chattr -i /var/cache/.kworker587
        2⤵
        • Removes the immutable protection flag from a file
        PID:1499
      • /usr/bin/chattr
        chattr +i /var/cache/.kworker587
        2⤵
        • Removes the immutable protection flag from a file
        PID:1500
      • /usr/bin/chattr
        chattr -i /var/lib/.kworker587
        2⤵
        • Removes the immutable protection flag from a file
        PID:1501
      • /usr/bin/chattr
        chattr +i /var/lib/.kworker587
        2⤵
        • Removes the immutable protection flag from a file
        PID:1502
      • /usr/bin/chattr
        chattr -i /usr/bin/.kworker587
        2⤵
        • Removes the immutable protection flag from a file
        PID:1503
      • /usr/bin/chattr
        chattr +i /usr/bin/.kworker587
        2⤵
        • Removes the immutable protection flag from a file
        PID:1504
      • /bin/systemctl
        systemctl daemon-reload
        2⤵
        • Reads runtime system information
        PID:1505
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/kworker587.service
        2⤵
        • Reads runtime system information
        PID:1526
    • /etc/.kworker587
      /etc/.kworker587
      1⤵
      • Modifies Watchdog functionality
      • Reads runtime system information
      PID:1489

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          .kworker587
          • Path /etc/.kworker587
          • Size 327KB
          • SHA256 3a8ca311c182a9ec01e7974f659c565e59b66cad60fa8d6137c88739d51aa359
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          kworker587.service
          • Path /etc/systemd/system/kworker587.service
          • Size 240B
          • SHA256 ad63c21efcea6c33ce6a398071784b15b8af332b6c52dad204bda4e2a13e1c07
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          .kworker587
          • Path /usr/bin/.kworker587
          • Size 327KB
          • SHA256 a05732ab7e89475847b1e575a4a9a7103cc2c320dc5ce2bc87c1b7d791cd6213
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .kworker587
          • Path /var/cache/.kworker587
          • Size 327KB
          • SHA256 8a52dfb1365acbdc32eb05c7c43614f22b488ae1767cffb2b70e3bfa780e4acd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          .kworker587
          • Path /var/lib/.kworker587
          • Size 327KB
          • SHA256 2743c66ff380aec7902055ba98df982c066a51177d773785daec645eb443def1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download