Analysis
- max time kernel
142s - max time network
144s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/10/2026, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
kworker_u8.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target kworker_u8.elf
- Size 1.9MB
- Sample261004-e7apjavxhy
- SHA256 423ebf3f807b93565a2f8752d172f7c63a186c18bc20bf75c8915f0e1f6bbd4d
- MD5 f9924554fa3a3b3e1cce40c3aaf5f0c8
- SHA1 a463391cd267b7695a0bcdf8d740e66be0a63eda
- SHA512 c746b85da7288d5a5336dced0d7b032b84d4ee6f385ef208eed4fb8ab47ce2872e26043c188a5272252ab8094b90d6f078d6cf1560169d0a893a1ec4df8756d0
- SSDEEP 49152:Ag4rvGn96xSuQbg6ThBJt6DK38Pkak5TAvNpf:AzvGn9Yl6d58K38Pkgpf
- TLSH T17C95331767E246E0C7DFA6BD35771BBE96C7E40A9BC209C0104B1B8701D58D37AA7E0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size kworker_u8.elf -
description ioc Process File opened for reading /proc/17/cmdline kworker_u8.elf File opened for reading /proc/83/cmdline kworker_u8.elf File opened for reading /proc/923/cmdline kworker_u8.elf File opened for reading /proc/985/cmdline kworker_u8.elf File opened for reading /proc/1044/cmdline kworker_u8.elf File opened for reading /proc/1164/cmdline kworker_u8.elf File opened for reading /proc/481/cmdline kworker_u8.elf File opened for reading /proc/492/cmdline kworker_u8.elf File opened for reading /proc/496/cmdline kworker_u8.elf File opened for reading /proc/961/cmdline kworker_u8.elf File opened for reading /proc/12/cmdline kworker_u8.elf File opened for reading /proc/1251/cmdline kworker_u8.elf File opened for reading /proc/1315/cmdline kworker_u8.elf File opened for reading /proc/159/cmdline kworker_u8.elf File opened for reading /proc/202/cmdline kworker_u8.elf File opened for reading /proc/32/cmdline kworker_u8.elf File opened for reading /proc/520/cmdline kworker_u8.elf File opened for reading /proc/968/cmdline kworker_u8.elf File opened for reading /proc/167/cmdline kworker_u8.elf File opened for reading /proc/2/cmdline kworker_u8.elf File opened for reading /proc/self/exe kworker_u8.elf File opened for reading /proc/1179/cmdline kworker_u8.elf File opened for reading /proc/18/cmdline kworker_u8.elf File opened for reading /proc/246/cmdline kworker_u8.elf File opened for reading /proc/34/cmdline kworker_u8.elf File opened for reading /proc/531/cmdline kworker_u8.elf File opened for reading /proc/558/cmdline kworker_u8.elf File opened for reading /proc/673/cmdline kworker_u8.elf File opened for reading /proc/1385/cmdline kworker_u8.elf File opened for reading /proc/1050/cmdline kworker_u8.elf File opened for reading /proc/1146/cmdline kworker_u8.elf File opened for reading /proc/1355/cmdline kworker_u8.elf File opened for reading /proc/23/cmdline kworker_u8.elf File opened for reading /proc/498/cmdline kworker_u8.elf File opened for reading /proc/8/cmdline kworker_u8.elf File opened for reading /proc/82/cmdline kworker_u8.elf File opened for reading /proc/1027/cmdline kworker_u8.elf File opened for reading /proc/1090/cmdline kworker_u8.elf File opened for reading /proc/1258/cmdline kworker_u8.elf File opened for reading /proc/84/cmdline kworker_u8.elf File opened for reading /proc/22/cmdline kworker_u8.elf File opened for reading /proc/29/cmdline kworker_u8.elf File opened for reading /proc/414/cmdline kworker_u8.elf File opened for reading /proc/459/cmdline kworker_u8.elf File opened for reading /proc/716/cmdline kworker_u8.elf File opened for reading /proc/942/cmdline kworker_u8.elf File opened for reading /proc/965/cmdline kworker_u8.elf File opened for reading /proc/989/cmdline kworker_u8.elf File opened for reading /proc/1035/cmdline kworker_u8.elf File opened for reading /proc/1486/cmdline kworker_u8.elf File opened for reading /proc/165/cmdline kworker_u8.elf File opened for reading /proc/485/cmdline kworker_u8.elf File opened for reading /proc/602/cmdline kworker_u8.elf File opened for reading /proc/1019/cmdline kworker_u8.elf File opened for reading /proc/1039/cmdline kworker_u8.elf File opened for reading /proc/137/cmdline kworker_u8.elf File opened for reading /proc/16/cmdline kworker_u8.elf File opened for reading /proc/901/cmdline kworker_u8.elf File opened for reading /proc/948/cmdline kworker_u8.elf File opened for reading /proc/1335/cmdline kworker_u8.elf File opened for reading /proc/30/cmdline kworker_u8.elf File opened for reading /proc/31/cmdline kworker_u8.elf File opened for reading /proc/647/cmdline kworker_u8.elf File opened for reading /proc/707/cmdline kworker_u8.elf - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.font-unix/.font0-lock kworker_u8.elf File opened for modification /tmp/.ICE-unix/.ICEauth kworker_u8.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.ICE-unix/.ICEauth
- Size 5B
- SHA256 4128f3e88e472d96e13a2a072a164aa1b1af6accc4efebf979025e310d1e1f4a
- MD5 3d50155858c1916776a6a120af34b008
- SHA1 e971deb8301bf5f76a513a6a8974cd56ff8c9ffe
- SHA512 6ebde72aca66a5d2e8cafe5fc8c2b62b15fb6fb88e660474ca06b93094087c76dbbba516ac9687c80f9adc6d8bacf156ea9d6ec3e3ade62a0fd11d7cc12a5516
- MD5 SHA1 SHA512
- Path /tmp/.font-unix/.font0-lock
- Size 4B
- SHA256 d732f39159e67eb62327ae853dfec69db69ec85b23a8b1f840db1959d32acced
- MD5 1415db70fe9ddb119e23e9b2808cde38
- SHA1 e9c340478ebb17ed024e217d7013275de0fabf8a
- SHA512 5c8b6ebcd1482c6906bcff847818ea47403d35dc8c0ac73cb6398d05f641cfea17cf9c6ef823fabd35e7d1e891ac982388eb0e96084cc24df8ce54866934b2c6
- MD5 SHA1 SHA512