ff3abb3ff46c15c8c11cd60b3e446c46eb6548c79b7a1e58013804a451c73504

Analysis

max time kernel
147s
max time network
152s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/10/2026, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x86_64.elf
Size 5.7MB
Sample261004-h8391sysht
SHA256 ff3abb3ff46c15c8c11cd60b3e446c46eb6548c79b7a1e58013804a451c73504
MD5 96c368637ff5c1d24f76eb33e79c2d83
SHA1 8a8a02133e4e136373185c7b5a49980855682e81
SHA512 76a3b1fa1442c9841d3827f7410358fe3b55fcee00038297a3aada2eff3802834e5e3318ac3cc4e29f4b376fd549012995440a7546f88b53023e828bb0207e9c
SSDEEP 49152:SVskTpUb2p4ULn/SmUPOpnL6Tb4dou0qPIyjlSePK4f7iGcgHhNxewaLAHKQKDKT:SVXOqOEeutIyBL3iGdKAkuCEj
TLSH
T17C564A03FCA555E6C0EEE23489629213BB717C495B3123D72BA0F7282F76BD06AB5750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.AuNA3j	crontab
File opened for modification	/etc/cron.d/system-update	x86_64.elf

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/system-update	x86_64.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/bot-update.service	x86_64.elf

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	x86_64.elf
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	x86_64.elf
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	x86_64.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/status	x86_64.elf
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/mountinfo	x86_64.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.cron	x86_64.elf

/tmp/x86_64.elf
/tmp/x86_64.elf
1⤵
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1481
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1491
- /usr/bin/crontab
  crontab /tmp/.cron
  2⤵
  - Creates/modifies Cron job
  PID:1494
- /bin/systemctl
  systemctl enable bot-update.service
  2⤵
  - Reads runtime system information
  PID:1498
- /bin/systemctl
  systemctl start bot-update.service
  2⤵
  - Reads runtime system information
  PID:1519
- /usr/sbin/update-rc.d
  update-rc.d system-update defaults
  2⤵
  PID:1521
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1530
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1530
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1530
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1530
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1530
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:1530
- /usr/sbin/service
  service system-update start
  2⤵
  PID:1551
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1552
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:1553
- - /bin/systemctl
    systemctl --quiet is-active multi-user.target
    3⤵
    - Reads runtime system information
    PID:1554
- - /bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    PID:1556
- - /bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    - Reads runtime system information
    PID:1557
- - /bin/systemctl
    systemctl -p Triggers show acpid.socket
    3⤵
    - Reads runtime system information
    PID:1558
- - /bin/systemctl
    systemctl -p Triggers show apport-forward.socket
    3⤵
    - Reads runtime system information
    PID:1559
- - /bin/systemctl
    systemctl -p Triggers show avahi-daemon.socket
    3⤵
    PID:1560
- - /bin/systemctl
    systemctl -p Triggers show cups.socket
    3⤵
    - Reads runtime system information
    PID:1561
- - /bin/systemctl
    systemctl -p Triggers show dbus.socket
    3⤵
    - Reads runtime system information
    PID:1562
- - /bin/systemctl
    systemctl -p Triggers show saned.socket
    3⤵
    - Reads runtime system information
    PID:1563
- - /bin/systemctl
    systemctl -p Triggers show snapd.socket
    3⤵
    - Reads runtime system information
    PID:1564
- - /bin/systemctl
    systemctl -p Triggers show ssh.socket
    3⤵
    - Reads runtime system information
    PID:1565
- - /bin/systemctl
    systemctl -p Triggers show syslog.socket
    3⤵
    - Reads runtime system information
    PID:1566
- - /bin/systemctl
    systemctl -p Triggers show systemd-fsckd.socket
    3⤵
    - Reads runtime system information
    PID:1567
- - /bin/systemctl
    systemctl -p Triggers show systemd-initctl.socket
    3⤵
    - Reads runtime system information
    PID:1568
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-audit.socket
    3⤵
    - Reads runtime system information
    PID:1569
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald-dev-log.socket
    3⤵
    - Reads runtime system information
    PID:1570
- - /bin/systemctl
    systemctl -p Triggers show systemd-journald.socket
    3⤵
    - Reads runtime system information
    PID:1571
- - /bin/systemctl
    systemctl -p Triggers show systemd-networkd.socket
    3⤵
    - Reads runtime system information
    PID:1572
- - /bin/systemctl
    systemctl -p Triggers show systemd-rfkill.socket
    3⤵
    - Reads runtime system information
    PID:1573
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-control.socket
    3⤵
    - Reads runtime system information
    PID:1575
- - /bin/systemctl
    systemctl -p Triggers show systemd-udevd-kernel.socket
    3⤵
    - Reads runtime system information
    PID:1576
- - /bin/systemctl
    systemctl -p Triggers show uuidd.socket
    3⤵
    - Reads runtime system information
    PID:1577
- /usr/local/sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:1551
- /usr/local/bin/systemctl
  systemctl start system-update.service
  2⤵
  PID:1551
- /usr/sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:1551
- /usr/bin/systemctl
  systemctl start system-update.service
  2⤵
  PID:1551
- /sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:1551
- /bin/systemctl
  systemctl start system-update.service
  2⤵
  - Reads runtime system information
  PID:1551
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1590
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1593

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system-update

Path /etc/cron.d/system-update
Size 95B
SHA256 c8e6c462f706ad0dc586447c3994987716f47dd1de7034f49114af9cbd124824
MD5 52009b396fb89c4e762927c40f64c200
SHA1 4cbdc08d4953b436e469145fdf630efdf84af0c7
SHA512 497493376364c0acf94e2f6352ecbd7d7b7d4e195ad9c60bd76d7aeb51d4fd11b40f483d8cc583f264d9880cce2b4ee60494108d2885af80e4feb867320b6dad
TLSH
T129B00234E78AA7319155FCE40004295484A534542381781018CD90D1D115A92062AC69
MD5 SHA1 SHA512 TLSH

Submit Download

system-update

Path /etc/init.d/system-update
Size 219B
SHA256 477bf61f9e1fd395fed549ba499defb931b4d2ac08fd1995cae82aafe24ef466
MD5 aac68dc76250db4d89678f1bff8eb4ef
SHA1 f459b173e0a906028edb0bf41b869da5da08c94d
SHA512 d3ade0e7a62f3542688f256dba0b5c89867edda43234c23b33a5e5ae6c1e13655170f3a7c98bb01b3bcb9aa5320ea517562940b532286516529c9beab34496aa
TLSH
T18AD01251E255D6306F1B85FC970A326BC86025171621BC107FCE5BC7EF129635279A74
MD5 SHA1 SHA512 TLSH

Submit Download

bot-update.service

Path /etc/systemd/system/bot-update.service
Size 194B
SHA256 e2e271543855504eefcce8105ef01fb452f09f9949ab7fc13b51ff4596ffc63b
MD5 91a421186741476b94cd9ee8b0c978a9
SHA1 4efd57787991ea94a56f70d614ef3d5187f34125
SHA512 533252e22e1ab159a1a2068f981b1737434fef9a4cf5754e0efc376d91a5f83a9041b8d9f45d9988c0d9c0ab63da45158b95a3a68c49f50099cc592fe268876b
TLSH
T137C0222297A1A0B1C90A3CB68EA26B108E2011442B8EF0200FC11085C0D09470234DBD
MD5 SHA1 SHA512 TLSH

Submit Download

.cron

Path /tmp/.cron
Size 86B
SHA256 b8d421c20e7f52ffde0c79f50ac013cfede505db85f78ea4b0a3ab25262087c5
MD5 03c5fcb50a1afa1a83619d11b61b2e1d
SHA1 36bc7d90a6ff717036560d75f062a248322b1f35
SHA512 999b08968fce88bedec537cf7127409841d09799bc3e2c4103c44bc15d2a012baa0ddb2c969a4fb26ffad77ad7662eb9c71adecc76e5deeba3853dbb1cbc53d5
TLSH
T144A00234D7CEE671D1157CF410043D1484B43450338165001CCD50D1D115FA20739C75
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update

Path /usr/lib/systemd/systemd-update
Size 5.7MB
SHA256 ff3abb3ff46c15c8c11cd60b3e446c46eb6548c79b7a1e58013804a451c73504
MD5 96c368637ff5c1d24f76eb33e79c2d83
SHA1 8a8a02133e4e136373185c7b5a49980855682e81
SHA512 76a3b1fa1442c9841d3827f7410358fe3b55fcee00038297a3aada2eff3802834e5e3318ac3cc4e29f4b376fd549012995440a7546f88b53023e828bb0207e9c
SSDEEP 49152:SVskTpUb2p4ULn/SmUPOpnL6Tb4dou0qPIyjlSePK4f7iGcgHhNxewaLAHKQKDKT:SVXOqOEeutIyBL3iGdKAkuCEj
TLSH
T17C564A03FCA555E6C0EEE23489629213BB717C495B3123D72BA0F7282F76BD06AB5750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.AuNA3j

Path /var/spool/cron/crontabs/tmp.AuNA3j
Size 270B
SHA256 ddcdb7097c4199783c0b831ee43d5080282e1672c269fa8a20fdd468902d1ae0
MD5 d8f7cb4eb8b7dc669b43da879dad489a
SHA1 cf7800a90cca11cbf3529da382a0e81ef09c94a0
SHA512 f25bd9d5d8ae52da49747b1f453122c898c07632c473a51b61c83530a4c6941c124f25e26fde38fc029f3921b0bb1bac5173f3af1bef7b33bee837e1367527cb
TLSH
T16AD02B38EB50BA3165012AC810092D2888D0B07466459D00E4CD50A4C217B562B21CB1
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads