Overview

overview

7

Static

static

5

2a3b30f3e5...8b.elf

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    2s
  • max time network
    151s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    25/09/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2a3b30f3e5a7a8d8c001fa2cfa451154a2a98110c6006a8d09178167f2ab138b.elf
  • Size 328KB
  • Sample260925-e6nvrsx14m
  • SHA256 2a3b30f3e5a7a8d8c001fa2cfa451154a2a98110c6006a8d09178167f2ab138b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Removes the immutable protection flag from a file 1 TTPs 8 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Write file to user bin folder 1 IoCs
    persistence
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/2a3b30f3e5a7a8d8c001fa2cfa451154a2a98110c6006a8d09178167f2ab138b.elf
    /tmp/2a3b30f3e5a7a8d8c001fa2cfa451154a2a98110c6006a8d09178167f2ab138b.elf
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Modifies systemd
    • Reads MAC address of network interface
    • Reads hardware information
    • Write file to user bin folder
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1491
    • /usr/bin/chattr
      chattr -i /etc/.kworker834
      2⤵
      • Removes the immutable protection flag from a file
      PID:1498
    • /usr/bin/chattr
      chattr +i /etc/.kworker834
      2⤵
      • Removes the immutable protection flag from a file
      PID:1499
    • /usr/bin/chattr
      chattr -i /var/cache/.kworker834
      2⤵
      • Removes the immutable protection flag from a file
      PID:1500
    • /usr/bin/chattr
      chattr +i /var/cache/.kworker834
      2⤵
      • Removes the immutable protection flag from a file
      PID:1501
    • /usr/bin/chattr
      chattr -i /var/lib/.kworker834
      2⤵
      • Removes the immutable protection flag from a file
      PID:1502
    • /usr/bin/chattr
      chattr +i /var/lib/.kworker834
      2⤵
      • Removes the immutable protection flag from a file
      PID:1503
    • /usr/bin/chattr
      chattr -i /usr/bin/.kworker834
      2⤵
      • Removes the immutable protection flag from a file
      PID:1504
    • /usr/bin/chattr
      chattr +i /usr/bin/.kworker834
      2⤵
      • Removes the immutable protection flag from a file
      PID:1505
    • /bin/systemctl
      systemctl daemon-reload
      2⤵
      • Reads runtime system information
      PID:1506
    • /bin/systemctl
      systemctl enable --now /etc/systemd/system/kworker834.service
      2⤵
      • Reads runtime system information
      PID:1527
  • /etc/.kworker834
    /etc/.kworker834
    1⤵
    • Modifies Watchdog functionality
    • Reads runtime system information
    PID:1491

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .kworker834
        • Path /etc/.kworker834
        • Size 328KB
        • SHA256 e14cf44d7075024388deaa20077a368c2bf16123466e2744f326d6c20b18c4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kworker834.service
        • Path /etc/systemd/system/kworker834.service
        • Size 240B
        • SHA256 11080fa5f6b3def0698e90043b86ef4a93d6f5f7bfb77f6d091b72558afea7dc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .kworker834
        • Path /usr/bin/.kworker834
        • Size 328KB
        • SHA256 745db21038b24a26a3f7f5e6131231bd82981dcce5001980dcfc8983aec275b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .kworker834
        • Path /var/cache/.kworker834
        • Size 328KB
        • SHA256 ae4af4d35969c84e69cc4880b1bafff8122da6fca78ebef57d77d4d6526a5729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .kworker834
        • Path /var/lib/.kworker834
        • Size 328KB
        • SHA256 2bce578ab89299753559e9ff72f87e8efdea8d723a862d8a89a4e214aa2b82da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download