a37ea9897221d4495b538de72b74f2aa1d2ff09b7b6dcedd395aee58931adbf3

Analysis

max time kernel
2s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/10/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbus_socket.elf
Size 22KB
Sample261003-x3bedafa59
SHA256 a37ea9897221d4495b538de72b74f2aa1d2ff09b7b6dcedd395aee58931adbf3
MD5 b40da694a31630bd3a66b1e0ee3d8d49
SHA1 06376e891980e771cc4c0bf4d33c0884835315de
SHA512 3e8cef587867667459bd756495e624566756fefcbd838512a2f83e386d4f580bef0e82ac9fbb0e97621833bddf709b0c5f7b1fbd3ec9489964ab23d8d06fd5c5
SSDEEP 384:PVPAkSoUqV6nCug3S+SaNc1pGmAf9Keu7n6ExeubgNlfGEfr:Pxaf3KCDeugEEz
TLSH
T14FB2B837E5A2C378D05EB3344DEF8CB8A971B1B1B727121BB7819A356D557480F0E22A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1482	sh
1485	chmod

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp

/tmp/dbus_socket.elf
/tmp/dbus_socket.elf
1⤵
PID:1481
- /bin/sh
  sh -c "/bin/rm -f /var/run/dbus/dbus_socket;/bin/cp /tmp/dbus_socket.elf /var/run/dbus/dbus_socket && /bin/chmod 755 /var/run/dbus/dbus_socket && /var/run/dbus/dbus_socket --init"
  2⤵
  - File and Directory Permissions Modification
  PID:1482
- - /bin/rm
    /bin/rm -f /var/run/dbus/dbus_socket
    3⤵
    PID:1483
- - /bin/cp
    /bin/cp /tmp/dbus_socket.elf /var/run/dbus/dbus_socket
    3⤵
    - Reads runtime system information
    PID:1484
- - /bin/chmod
    /bin/chmod 755 /var/run/dbus/dbus_socket
    3⤵
    - File and Directory Permissions Modification
    PID:1485
- - /var/run/dbus/dbus_socket
    /var/run/dbus/dbus_socket --init
    3⤵
    PID:1486

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbus_socket

Path /run/dbus/dbus_socket
Size 22KB
SHA256 a37ea9897221d4495b538de72b74f2aa1d2ff09b7b6dcedd395aee58931adbf3
MD5 b40da694a31630bd3a66b1e0ee3d8d49
SHA1 06376e891980e771cc4c0bf4d33c0884835315de
SHA512 3e8cef587867667459bd756495e624566756fefcbd838512a2f83e386d4f580bef0e82ac9fbb0e97621833bddf709b0c5f7b1fbd3ec9489964ab23d8d06fd5c5
SSDEEP 384:PVPAkSoUqV6nCug3S+SaNc1pGmAf9Keu7n6ExeubgNlfGEfr:Pxaf3KCDeugEEz
TLSH
T14FB2B837E5A2C378D05EB3344DEF8CB8A971B1B1B727121BB7819A356D557480F0E22A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download