Overview

overview

7

Static

static

5

1.elf

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    142s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30/09/2026, 17:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1.elf
  • Size 454KB
  • Sample260930-vjbjxsshmb
  • SHA256 3cb83781894685092256cdd28b11632a00d4a6db01103f4fa041e2371b193a53
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 2 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads hardware information 1 TTPs 2 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Removes the immutable protection flag from a file 1 TTPs 7 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Write file to user bin folder 2 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/1.elf
    /tmp/1.elf
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Modifies systemd
    • Reads MAC address of network interface
    • Reads hardware information
    • Write file to user bin folder
    • Enumerates kernel/hardware configuration
    PID:1503
    • /usr/bin/chattr
      chattr -i /etc/.ata_sff617
      2⤵
      • Removes the immutable protection flag from a file
      PID:1506
    • /usr/bin/chattr
      chattr -i /var/cache/.ata_sff617
      2⤵
      • Removes the immutable protection flag from a file
      PID:1512
    • /usr/bin/chattr
      chattr -i /var/lib/.ata_sff617
      2⤵
      • Removes the immutable protection flag from a file
      PID:1513
    • /usr/bin/chattr
      chattr -i /usr/bin/.ata_sff617
      2⤵
      • Removes the immutable protection flag from a file
      PID:1514
    • /bin/systemctl
      systemctl daemon-reload
      2⤵
        PID:1515
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/ata_sff617.service
        2⤵
          PID:1536
      • /etc/.ata_sff617
        /etc/.ata_sff617
        1⤵
        • Modifies Watchdog functionality
        • Enumerates active TCP sockets
        • Modifies systemd
        • Reads MAC address of network interface
        • Reads hardware information
        • Write file to user bin folder
        • Changes its process name
        • Reads CPU attributes
        • Reads system network configuration
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:1503
        • /usr/bin/chattr
          chattr -i /var/cache/.ata_sff617
          2⤵
          • Removes the immutable protection flag from a file
          PID:1558
        • /usr/bin/chattr
          chattr -i /var/lib/.ata_sff617
          2⤵
          • Removes the immutable protection flag from a file
          PID:1559
        • /usr/bin/chattr
          chattr -i /usr/bin/.ata_sff617
          2⤵
          • Removes the immutable protection flag from a file
          PID:1560
        • /bin/systemctl
          systemctl daemon-reload
          2⤵
          • Reads runtime system information
          PID:1561
        • /bin/systemctl
          systemctl enable --now /etc/systemd/system/ata_sff617.service
          2⤵
            PID:1582

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              XDG Autostart Entries

              1
              T1547.013

              Create or Modify System Process

              1
              T1543

              Systemd Service

              1
              T1543.002

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              XDG Autostart Entries

              1
              T1547.013

              Create or Modify System Process

              1
              T1543

              Systemd Service

              1
              T1543.002

              Defense Evasion

              File and Directory Permissions Modification

              1
              T1222

              Linux and Mac File and Directory Permissions Modification

              1
              T1222.002

              Impair Defenses

              1
              T1562

              Credential Access

              Discovery

              System Information Discovery

              3
              T1082

              System Network Configuration Discovery

              2
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Wi-Fi Discovery

              1
              T1016.002

              System Network Connections Discovery

              2
              T1049

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              .ata_sff617
              • Path /etc/.ata_sff617
              • Size 454KB
              • SHA256 3cb83781894685092256cdd28b11632a00d4a6db01103f4fa041e2371b193a53
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ata_sff617.service
              • Path /etc/systemd/system/ata_sff617.service
              • Size 244B
              • SHA256 77d716c498026309eb36ed5ce2438af2b3171659d0a2e4cd54c544f8e099b392
              • MD5 SHA1 SHA512 TLSH
              Submit Download