Overview

overview

10

Static

static

10

kworker.elf

debian-12-armhf

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    07/10/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kworker.elf
  • Size 170KB
  • Sample261007-wpflhasygt
  • SHA256 3e724458a4b817aad81a70746f397fc4830da3ab02d465f53dcf8e6af9a8391e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 4 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Modifies init.d 2 TTPs 2 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 2 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Schedules an At job 1 TTPs 1 IoCs

    Schedules a job to be run using the at command.

    executionpersistenceprivilege_escalation
  • Modifies Bash startup script 2 TTPs 4 IoCs
    persistence
  • Changes its process name 2 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/kworker.elf
    /tmp/kworker.elf
    1⤵
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Reads system routing table
    • Modifies Bash startup script
    • Changes its process name
    • Reads system network configuration
    PID:783
    • /bin/sh
      sh -c "/usr/sbin/update-rc.d bot defaults 2>/dev/null"
      2⤵
        PID:789
        • /usr/sbin/update-rc.d
          /usr/sbin/update-rc.d bot defaults
          3⤵
            PID:790
            • /usr/local/sbin/systemctl
              systemctl daemon-reload
              4⤵
                PID:806
              • /usr/local/bin/systemctl
                systemctl daemon-reload
                4⤵
                  PID:806
                • /usr/sbin/systemctl
                  systemctl daemon-reload
                  4⤵
                    PID:806
                  • /usr/bin/systemctl
                    systemctl daemon-reload
                    4⤵
                    • Reads runtime system information
                    PID:806
              • /bin/sh
                sh -c "/sbin/chkconfig --add bot 2>/dev/null"
                2⤵
                  PID:826
                  • /sbin/chkconfig
                    /sbin/chkconfig --add bot
                    3⤵
                      PID:827
                  • /bin/sh
                    sh -c "systemctl enable bot.service 2>/dev/null"
                    2⤵
                      PID:828
                      • /usr/bin/systemctl
                        systemctl enable bot.service
                        3⤵
                        • Changes its process name
                        • Reads runtime system information
                        PID:829
                        • /lib/systemd/systemd-sysv-install
                          /lib/systemd/systemd-sysv-install enable bot
                          4⤵
                            PID:830
                            • /usr/bin/getopt
                              getopt -o r: --long root: -- enable bot
                              5⤵
                                PID:831
                              • /usr/sbin/update-rc.d
                                /usr/sbin/update-rc.d bot defaults
                                5⤵
                                  PID:832
                                  • /usr/local/sbin/systemctl
                                    systemctl daemon-reload
                                    6⤵
                                      PID:833
                                    • /usr/local/bin/systemctl
                                      systemctl daemon-reload
                                      6⤵
                                        PID:833
                                      • /usr/sbin/systemctl
                                        systemctl daemon-reload
                                        6⤵
                                          PID:833
                                        • /usr/bin/systemctl
                                          systemctl daemon-reload
                                          6⤵
                                          • Reads runtime system information
                                          PID:833
                                      • /usr/sbin/update-rc.d
                                        /usr/sbin/update-rc.d bot enable
                                        5⤵
                                          PID:851
                                          • /usr/local/sbin/systemctl
                                            systemctl daemon-reload
                                            6⤵
                                              PID:852
                                            • /usr/local/bin/systemctl
                                              systemctl daemon-reload
                                              6⤵
                                                PID:852
                                              • /usr/sbin/systemctl
                                                systemctl daemon-reload
                                                6⤵
                                                  PID:852
                                                • /usr/bin/systemctl
                                                  systemctl daemon-reload
                                                  6⤵
                                                  • Reads runtime system information
                                                  PID:852
                                        • /bin/sh
                                          sh -c "echo \"/tmp/kworker.elf\" | at now + 1 minute 2>/dev/null"
                                          2⤵
                                            PID:884
                                            • /usr/bin/at
                                              at now + 1 minute
                                              3⤵
                                              • Creates/modifies Cron job
                                              • Schedules an At job
                                              • Reads runtime system information
                                              PID:886
                                          • /bin/sh
                                            sh -c "cp /tmp/kworker.elf /tmp/.kworker 2>/dev/null; chmod 755 /tmp/.kworker 2>/dev/null"
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:887
                                            • /usr/bin/cp
                                              cp /tmp/kworker.elf /tmp/.kworker
                                              3⤵
                                              • Reads runtime system information
                                              • Writes file to tmp directory
                                              PID:888
                                            • /usr/bin/chmod
                                              chmod 755 /tmp/.kworker
                                              3⤵
                                              • File and Directory Permissions Modification
                                              PID:889

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Scheduled Task/Job

                                              2
                                              T1053

                                              At

                                              1
                                              T1053.002

                                              Cron

                                              1
                                              T1053.003

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              4
                                              T1547

                                              XDG Autostart Entries

                                              1
                                              T1547.013

                                              Boot or Logon Initialization Scripts

                                              2
                                              T1037

                                              RC Scripts

                                              2
                                              T1037.004

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Systemd Service

                                              1
                                              T1543.002

                                              Event Triggered Execution

                                              1
                                              T1546

                                              Unix Shell Configuration Modification

                                              1
                                              T1546.004

                                              Hijack Execution Flow

                                              1
                                              T1574

                                              Path Interception by PATH Environment Variable

                                              1
                                              T1574.007

                                              Scheduled Task/Job

                                              2
                                              T1053

                                              At

                                              1
                                              T1053.002

                                              Cron

                                              1
                                              T1053.003

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              4
                                              T1547

                                              XDG Autostart Entries

                                              1
                                              T1547.013

                                              Boot or Logon Initialization Scripts

                                              2
                                              T1037

                                              RC Scripts

                                              2
                                              T1037.004

                                              Create or Modify System Process

                                              1
                                              T1543

                                              Systemd Service

                                              1
                                              T1543.002

                                              Event Triggered Execution

                                              1
                                              T1546

                                              Unix Shell Configuration Modification

                                              1
                                              T1546.004

                                              Hijack Execution Flow

                                              1
                                              T1574

                                              Path Interception by PATH Environment Variable

                                              1
                                              T1574.007

                                              Scheduled Task/Job

                                              2
                                              T1053

                                              At

                                              1
                                              T1053.002

                                              Cron

                                              1
                                              T1053.003

                                              Defense Evasion

                                              File and Directory Permissions Modification

                                              1
                                              T1222

                                              Linux and Mac File and Directory Permissions Modification

                                              1
                                              T1222.002

                                              Hijack Execution Flow

                                              1
                                              T1574

                                              Path Interception by PATH Environment Variable

                                              1
                                              T1574.007

                                              Credential Access

                                              Discovery

                                              System Network Configuration Discovery

                                              2
                                              T1016

                                              Internet Connection Discovery

                                              2
                                              T1016.001

                                              Lateral Movement

                                              Collection

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              root
                                              • Path /etc/cron.d/root
                                              • Size 50B
                                              • SHA256 3cf4e85b5c5fb1f6acc7b8dad36156599499ee81ddc2fe567d283cb0b7be9e64
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              S99bot
                                              • Path /etc/init.d/S99bot
                                              • Size 85B
                                              • SHA256 dd1e3ce9e4603140334afc3be5e861a708393b92b69030746734276cb17e872c
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              bot
                                              • Path /etc/init.d/bot
                                              • Size 215B
                                              • SHA256 33168660b31e59185887a5c2091cee9a0738020d753a1b829cc3f6c976e08048
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              bot.sh
                                              • Path /etc/profile.d/bot.sh
                                              • Size 47B
                                              • SHA256 f11326cc3926c36766d575ddb51fbeae418dee786480a244b8341a0beb8415fa
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              rc.local
                                              • Path /etc/rc.local
                                              • Size 19B
                                              • SHA256 dd9522913ae3b82e8ffe775b943c4f4fe122bec37abaebbd4a162be4631943eb
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              bot.service
                                              • Path /etc/systemd/system/bot.service
                                              • Size 175B
                                              • SHA256 cf4d24283f361034d8f36650724818ea872a7f65385d1a9d58342860f8f1b0d6
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              .bash_profile
                                              • Path /root/.bash_profile
                                              • Size 38B
                                              • SHA256 e2163a5c6cc1bf92f6be50293f908940fd8f5a6c7f917f88f1e4120e8b753cb5
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              a0000101c7935e
                                              • Path /var/spool/cron/atjobs/a0000101c7935e
                                              • Size 420B
                                              • SHA256 70cfea85abc60e4187dcdaa898e70c5884f485b9cf3b4c48d72d4188a01845fc
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              root
                                              • Path /var/spool/cron/crontabs/root
                                              • Size 45B
                                              • SHA256 b5d322e9235a2420c8410b8c12b0556e9d8a6a628c73491449e0a7363da00df3
                                              • MD5 SHA1 SHA512
                                              Submit Download