Analysis
- user interaction
yes - max time kernel
33s - max time network
34s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
03/10/2026, 10:27
General
- Target x86
- Size 5.4MB
- Sample261003-mhal8swfla
- SHA256 905e5071aa07a3c2707fe2c6fb873bfc0bd1efeb2a35dddaaa478944b5bf2f4f
Score
10/10
Malware Config
Signatures
- Family: GoDDoSAgent
GoDDoSAgent is a Linux botnet written in GoLang.
- Detects GoDDoSAgent 1 IoCs
- Creates/modifies environment variables 1 TTPs 3 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Write file to user bin folder 2 IoCs
- Modifies Bash startup script 2 TTPs 3 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 4 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/x86/tmp/x861⤵
- Creates/modifies environment variables
- Write file to user bin folder
- Modifies Bash startup script
- Enumerates kernel/hardware configuration
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Replay Monitor
Loading Replay Monitor...
Downloads
sysd