Overview

overview

7

Static

static

5

676149d53f...in.elf

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    142s
  • max time network
    130s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    01/10/2026, 10:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    676149d53fe81917.bin.elf
  • Size 455KB
  • Sample261001-mf4gjayte1
  • SHA256 676149d53fe8191779b090e22380a37218676b14754af32c18224efec5a42e1b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 2 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads hardware information 1 TTPs 2 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Removes the immutable protection flag from a file 1 TTPs 7 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Write file to user bin folder 2 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/676149d53fe81917.bin.elf
    /tmp/676149d53fe81917.bin.elf
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Modifies systemd
    • Reads MAC address of network interface
    • Reads hardware information
    • Write file to user bin folder
    • Enumerates kernel/hardware configuration
    PID:1492
    • /usr/bin/chattr
      chattr -i /etc/.migration248
      2⤵
      • Removes the immutable protection flag from a file
      PID:1495
    • /usr/bin/chattr
      chattr -i /var/cache/.migration248
      2⤵
      • Removes the immutable protection flag from a file
      PID:1502
    • /usr/bin/chattr
      chattr -i /var/lib/.migration248
      2⤵
      • Removes the immutable protection flag from a file
      PID:1503
    • /usr/bin/chattr
      chattr -i /usr/bin/.migration248
      2⤵
      • Removes the immutable protection flag from a file
      PID:1504
    • /bin/systemctl
      systemctl daemon-reload
      2⤵
        PID:1505
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/migration248.service
        2⤵
        • Reads runtime system information
        PID:1526
    • /etc/.migration248
      /etc/.migration248
      1⤵
      • Modifies Watchdog functionality
      • Enumerates active TCP sockets
      • Modifies systemd
      • Reads MAC address of network interface
      • Reads hardware information
      • Write file to user bin folder
      • Changes its process name
      • Reads CPU attributes
      • Reads system network configuration
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1492
      • /usr/bin/chattr
        chattr -i /var/cache/.migration248
        2⤵
        • Removes the immutable protection flag from a file
        PID:1548
      • /usr/bin/chattr
        chattr -i /var/lib/.migration248
        2⤵
        • Removes the immutable protection flag from a file
        PID:1549
      • /usr/bin/chattr
        chattr -i /usr/bin/.migration248
        2⤵
        • Removes the immutable protection flag from a file
        PID:1550
      • /bin/systemctl
        systemctl daemon-reload
        2⤵
          PID:1551
        • /bin/systemctl
          systemctl enable --now /etc/systemd/system/migration248.service
          2⤵
          • Reads runtime system information
          PID:1572

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            XDG Autostart Entries

            1
            T1547.013

            Create or Modify System Process

            1
            T1543

            Systemd Service

            1
            T1543.002

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            XDG Autostart Entries

            1
            T1547.013

            Create or Modify System Process

            1
            T1543

            Systemd Service

            1
            T1543.002

            Defense Evasion

            File and Directory Permissions Modification

            1
            T1222

            Linux and Mac File and Directory Permissions Modification

            1
            T1222.002

            Impair Defenses

            1
            T1562

            Credential Access

            Discovery

            System Information Discovery

            3
            T1082

            System Network Configuration Discovery

            2
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Wi-Fi Discovery

            1
            T1016.002

            System Network Connections Discovery

            2
            T1049

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            .migration248
            • Path /etc/.migration248
            • Size 455KB
            • SHA256 676149d53fe8191779b090e22380a37218676b14754af32c18224efec5a42e1b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            migration248.service
            • Path /etc/systemd/system/migration248.service
            • Size 246B
            • SHA256 b083cda63b8d1d8c03f13450a7699407934b5daa285a2e4452a0246d92954276
            • MD5 SHA1 SHA512 TLSH
            Submit Download