Analysis
- max time kernel
42s - max time network
153s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
30/09/2026, 00:23
General
- Target bot_linux_x86_32
- Size 3.3MB
- Sample260930-apxdcsshrf
- SHA256 adc8990ec03d1bf4a1aeb0e1e4c80eff1a0887d8d7e30a2b92d9e3906ddf3439
Score
7/10
Malware Config
Signatures
- Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Creates a desktop entry file 3 TTPs 1 IoCs
A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.
- Reads CPU attributes 1 TTPs 1 IoCs
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 6 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/bot_linux_x86_32/tmp/bot_linux_x86_321⤵
- Checks CPU configuration
- Creates a desktop entry file
- Reads CPU attributes
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
a951524f-860c-4d94-8ef1-d88344a98ba3.desktop
.pf