ebd2b8286e11baaf043a64be806bb4396a0b2ac2be0c89ed8dd79c2e82f6b6c1

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
i486.elf
Size 64KB
Sample261011-wpbybaec72
SHA256 ebd2b8286e11baaf043a64be806bb4396a0b2ac2be0c89ed8dd79c2e82f6b6c1
MD5 039adb68088bc5d4dee97086ba9ff25c
SHA1 8216d14a0b50bc661a38db3c0d1c1df97b92420b
SHA512 5c99259daf0cad0af97a2679569100d9fbdec41a1e05e42d850ff62bf218a249dde9043b372c1adb4732dc5f67b37312263cdb93ae9e176ac2fecfdfbbafda5a
SSDEEP 1536:VYutkaRfaZhgmTEsa/WfMokbkueZM1fnouy8Lzkk0:+u+7ZhKiMNPoutUk0
TLSH
T1AE53028A84BAC776C94AE5354C7971C753B4DB1CE38716ECEB21B0636C43E287A14B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1519	i486.elf

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/syslog	i486.elf

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	i486.elf

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/killer-helper	i486.elf

Deletes log files 1 TTPs 6 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/auth.log	i486.elf
File truncated	/var/log/wtmp	i486.elf
File truncated	/var/log/btmp	i486.elf
File truncated	/var/log/lastlog	i486.elf
File truncated	/var/log/faillog	i486.elf
File truncated	/var/log/kern.log	i486.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	i486.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	i486.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/killer-helper.service	i486.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-7.dat	upx

Changes its process name 10 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	orimhhh	1519	i486.elf
Changes the process name, possibly in an attempt to hide itself	orimhhh	1519	i486.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:5]	1520	i486.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	1525	i486.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	1525	i486.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1524	i486.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:2]	1526	i486.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1524	i486.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:4]	1586	i486.elf
Changes the process name, possibly in an attempt to hide itself	[kworker/0:3]	1585	i486.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	i486.elf

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	i486.elf
File opened for reading	/proc/net/tcp6	i486.elf

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1592	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/80/comm	i486.elf
File opened for reading	/proc/1078/comm	i486.elf
File opened for reading	/proc/13/cmdline	i486.elf
File opened for reading	/proc/1069/cmdline	i486.elf
File opened for reading	/proc/1519/stat	i486.elf
File opened for reading	/proc/14/exe	i486.elf
File opened for reading	/proc/1208/cmdline	i486.elf
File opened for reading	/proc/1598/cmdline	i486.elf
File opened for reading	/proc/478/comm	i486.elf
File opened for reading	/proc/1109/comm	i486.elf
File opened for reading	/proc/1487/comm	i486.elf
File opened for reading	/proc/167/exe	i486.elf
File opened for reading	/proc/184/exe	i486.elf
File opened for reading	/proc/1045/comm	i486.elf
File opened for reading	/proc/461/exe	i486.elf
File opened for reading	/proc/697/cmdline	i486.elf
File opened for reading	/proc/1567/comm	i486.elf
File opened for reading	/proc/1670/cmdline	i486.elf
File opened for reading	/proc/1520/comm	i486.elf
File opened for reading	/proc/522/exe	i486.elf
File opened for reading	/proc/1597/cmdline	i486.elf
File opened for reading	/proc/1632/cmdline	i486.elf
File opened for reading	/proc/1653/cmdline	i486.elf
File opened for reading	/proc/1690/exe	i486.elf
File opened for reading	/proc/738/comm	i486.elf
File opened for reading	/proc/1719/cmdline	i486.elf
File opened for reading	/proc/1722/comm	i486.elf
File opened for reading	/proc/690/cmdline	i486.elf
File opened for reading	/proc/1637/cmdline	i486.elf
File opened for reading	/proc/1657/exe	i486.elf
File opened for reading	/proc/1702/cmdline	i486.elf
File opened for reading	/proc/1714/comm	i486.elf
File opened for reading	/proc/89/cmdline	i486.elf
File opened for reading	/proc/167/cmdline	i486.elf
File opened for reading	/proc/1681/exe	i486.elf
File opened for reading	/proc/170/comm	i486.elf
File opened for reading	/proc/1524/stat	i486.elf
File opened for reading	/proc/35/cmdline	i486.elf
File opened for reading	/proc/335/cmdline	i486.elf
File opened for reading	/proc/1570/cmdline	i486.elf
File opened for reading	/proc/1008/exe	i486.elf
File opened for reading	/proc/1524/exe	i486.elf
File opened for reading	/proc/452/cmdline	i486.elf
File opened for reading	/proc/478/cmdline	i486.elf
File opened for reading	/proc/1616/exe	i486.elf
File opened for reading	/proc/1603/exe	i486.elf
File opened for reading	/proc/81/comm	i486.elf
File opened for reading	/proc/1573/comm	i486.elf
File opened for reading	/proc/1652/exe	i486.elf
File opened for reading	/proc/1688/comm	i486.elf
File opened for reading	/proc/30/comm	i486.elf
File opened for reading	/proc/1573/cmdline	i486.elf
File opened for reading	/proc/1660/cmdline	i486.elf
File opened for reading	/proc/1713/cmdline	i486.elf
File opened for reading	/proc/565/exe	i486.elf
File opened for reading	/proc/1540/exe	i486.elf
File opened for reading	/proc/1580/comm	i486.elf
File opened for reading	/proc/1631/exe	i486.elf
File opened for reading	/proc/1646/comm	i486.elf
File opened for reading	/proc/1674/cmdline	i486.elf
File opened for reading	/proc/1686/comm	i486.elf
File opened for reading	/proc/1633/comm	i486.elf
File opened for reading	/proc/self/exe	i486.elf
File opened for reading	/proc/1530/exe	i486.elf

System Network Configuration Discovery 1 TTPs 64 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1633	iptables-restore
1685	iptables-restore
1701	iptables-restore
1709	iptables-restore
1717	iptables-restore
1597	iptables-restore
1705	iptables-restore
1613	iptables-restore
1645	iptables-restore
1647	iptables-restore
1695	iptables-restore
1597	iptables-restore
1659	iptables-restore
1675	iptables-restore
1721	iptables-restore
1581	iptables-restore
1605	iptables-restore
1637	iptables-restore
1687	iptables-restore
1603	iptables-restore
1621	iptables-restore
1653	iptables-restore
1663	iptables-restore
1689	iptables-restore
1725	iptables-restore
1595	iptables-restore
1615	iptables-restore
1625	iptables-restore
1627	iptables-restore
1657	iptables-restore
1588	iptables-restore
1595	iptables-restore
1625	iptables-restore
1627	iptables-restore
1649	iptables-restore
1691	iptables-restore
1699	iptables-restore
1711	iptables-restore
1641	iptables-restore
1609	iptables-restore
1611	iptables-restore
1623	iptables-restore
1659	iptables-restore
1681	iptables-restore
1691	iptables-restore
1599	iptables-restore
1601	iptables-restore
1607	iptables-restore
1639	iptables-restore
1665	iptables-restore
1679	iptables-restore
1685	iptables-restore
1701	iptables-restore
1607	iptables-restore
1633	iptables-restore
1683	iptables-restore
1727	iptables-restore
1635	iptables-restore
1669	iptables-restore
1673	iptables-restore
1719	iptables-restore
1621	iptables-restore
1635	iptables-restore
1665	iptables-restore

/tmp/i486.elf
/tmp/i486.elf
1⤵
- Deletes itself
- Deletes system logs
- Modifies the /etc/hosts DNS resolution file
- Creates/modifies Cron job
- Deletes log files
- Enumerates active TCP sockets
- Modifies rc script
- Modifies systemd
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1516
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable killer-helper.service 2>/dev/null"
  2⤵
  PID:1528
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1529
- - /bin/systemctl
    systemctl enable killer-helper.service
    3⤵
    PID:1557
- /usr/sbin/iptables
  iptables -n -L LK_sh7f3a
  2⤵
  PID:1578
- /sbin/iptables
  iptables -n -L LK_sh7f3a
  2⤵
  PID:1578
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1581
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1581
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1583
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1583
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1588
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1588
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1590
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1590
- /bin/sh
  /bin/sh -c "journalctl --rotate --vacuum-time=1s 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:1592
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1595
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1595
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1597
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1597
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1599
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1599
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1601
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1601
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1603
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1603
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1605
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1605
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1607
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1607
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1609
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1609
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1611
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1611
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1613
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1613
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1615
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1615
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1617
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1617
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1621
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1621
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1623
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1623
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1625
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1625
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1627
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1627
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1629
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1629
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1631
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1631
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1633
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1633
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1635
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1635
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1637
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1637
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1639
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1639
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1641
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1641
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1643
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1643
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1645
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1645
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1647
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1647
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1649
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1649
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1651
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1651
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1653
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1653
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1655
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1655
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1657
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1657
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1659
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1659
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1661
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1661
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1663
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1663
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1665
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1665
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1667
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1667
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1669
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1669
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1671
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1671
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1673
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1673
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1675
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1675
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1677
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1677
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1679
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1679
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1681
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1681
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1683
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1683
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1685
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1685
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1687
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1687
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1689
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1689
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1691
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1691
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1693
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1693
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1695
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1695
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1697
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1697
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1699
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1699
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1701
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1701
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1703
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1703
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1705
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1705
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1707
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1707
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1709
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1709
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1711
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1711
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1713
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1713
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1715
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1715
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1717
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1717
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1719
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1719
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1721
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1721
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1723
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1723
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1725
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1725
- /usr/sbin/iptables-restore
  iptables-restore -n
  2⤵
  PID:1727
- /sbin/iptables-restore
  iptables-restore -n
  2⤵
  - System Network Configuration Discovery
  PID:1727

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.hosts.tmp.JNfdAG

Path /etc/.hosts.tmp.JNfdAG
Size 219B
SHA256 908b62e9f94cc492b2ad465bfae5ba6bb5cfffd9ad7af21cdb79821ee118f409
MD5 f483993c70d12ecfd5a5fe3ed5b10244
SHA1 386b3c58555b1337c5a2496efdb7436295256796
SHA512 c60a7528f3d5b5b97d79c7973153cb7a915de04fd717e9ca7c8bdf4093a747146d405c15d47f822dc1b72bcd87b19ab276e9069c3f41bc5bb4dbfd88fd469aaa
TLSH
T147D0228B2F03D8BB00A393C47C1E50319E0281A001440EB20A3C341F63EB7BE3E78A30
MD5 SHA1 SHA512 TLSH

Submit Download

.killer-wd.pid.tmp.1525

Path /run/.killer-wd.pid.tmp.1525
Size 24B
SHA256 1e6c64e9a79f422dcf23bbc2d9ba6104f160e271ba2ae32b22d41a58e4588f8f
MD5 97714599bad763eb340cad1fbbdc0033
SHA1 7c395538007bf2aca37cf236b64c051aa524d524
SHA512 1d3cca3fb0af4ac20885123b3aed5df5dc9c93871d3c7f9d7ea696d11b6fd2be9fedc2972507209920aefaa934eaabb6814880eb288a7cc8e441322569f6c214
MD5 SHA1 SHA512

Submit Download

.killer.pid.tmp.1524

Path /run/.killer.pid.tmp.1524
Size 24B
SHA256 974c6d4a02ef62a34d25f18e6a3805a6c165a7d1bd9b534e29a572a62643d845
MD5 f844af3df2c66c7a200b8af60e7a0596
SHA1 971c2df46dd42ed6a428b9a54fb05ed7851834fc
SHA512 04ab2f1791b6386e16551bbe260cdf47c4c91c2814a5a6b256ea0df5bcc9b5331d931ae879b8170c010d264cd40c238b6dee30db43fcc247d16bd900de882744
MD5 SHA1 SHA512

Submit Download

.locker.pid.tmp.1526

Path /run/.locker.pid.tmp.1526
Size 24B
SHA256 98747695af74a2d335bcb230a0d1a2ecb989ed8c1e6a066dc74abdbd9be099a2
MD5 5808fee6525daff9bb39280257c2996a
SHA1 9c3b01eef0494245de5d1cb6bb0bc2f4d00b4bbb
SHA512 bdce5a832cae317f8afcc4f6906bde6fe78c6067c18b9059c5ab207ca97638bda4bbc864a55f3dec873de2df6c8a963859a7a48af08ace3766e47d6d6e613cd7
MD5 SHA1 SHA512

Submit Download

.main.pid.tmp.1519

Path /run/.main.pid.tmp.1519
Size 18B
SHA256 76dd2be33215c8466233ae3c47626a8f9748430535351bc1386e874933e987c0
MD5 d7ce8afa54c49c985d0883cf1a580675
SHA1 cfc6610ad3a987d419154c7dbe9f15072fd897b0
SHA512 857ee19e0d14edf612bb29f90493d679d2eb75204b2beb5f53e105e3142db0c44c88a8deb23964e8fd1f4335a667f82e91a33bd7c914b0c05ae49aff84ca0cb6
MD5 SHA1 SHA512

Submit Download

.watchdog.pid.tmp.1526

Path /run/.watchdog.pid.tmp.1526
Size 24B
SHA256 028d6727929f117ad8fb3253331977dd2a713f86cfcdda354307f4e0e3006f72
MD5 c9fb22222dde799e0103edef320bbb29
SHA1 902665485c4802051f1ace8c308a021cee6ea12f
SHA512 87a1eee5d2a9ee2f5180eecf3f8efe2d0ed66a130652e8585837f7a47d649c85cd10a1895a6bb992aa9c03ed2d0ecb0af00ed9999dc630f2515d2eb1d8f419d2
MD5 SHA1 SHA512

Submit Download

.watchdog.pid.tmp.1585

Path /run/.watchdog.pid.tmp.1585
Size 24B
SHA256 38b56b89f05c99ae2c05187bab443090eb84e24b08f12d1d9cf36084acf1da81
MD5 2ba30d45be94757b7e0497e66fa06548
SHA1 b21c174b281cc744e3cd3750ef044c035a239840
SHA512 eadee99b69612833393665cf8c1d6c44cd99c645605b589bd41c87e497b8fdd64a143a706ec5a827c010d28234b636857c59314f9ae88fba751b177d88a962af
MD5 SHA1 SHA512

Submit Download

.watchdog2.pid.tmp.1526

Path /run/.watchdog2.pid.tmp.1526
Size 24B
SHA256 440091643f3bac14e93d3888c4ae7972611aeb4b4dc740bb178e56103146bbf9
MD5 266a483752fc4769567d4558b5399010
SHA1 91d7c38b071dfb8d89a2715a4af4f06e04cbe018
SHA512 ee0632681cef49d53470929bebd718d7aec16cbaaf39eefc6fb411e50e52974bdf96f7057e09d33f0aab066b1c366052f8ef9484ec2e202bdcbddc8755f626c7
MD5 SHA1 SHA512

Submit Download

.watchdog2.pid.tmp.1586

Path /run/.watchdog2.pid.tmp.1586
Size 24B
SHA256 e06f85512a75a2139d984624a64159ac40e5001cdcaed40407a350a0a6808a26
MD5 1a4fe8a314efdd84cc34b1f71bd3fe88
SHA1 22faf178f4a172663c7b8afea8313a53692c4ac5
SHA512 d5464b0c431e2db71cca06e76ff3fb89b93c893e283fbbbee1fca4c79a5de4b139612de85e7373efca6e08c32b872eb419ff754c9cd4ceef488f22dc347e6a7f
MD5 SHA1 SHA512

Submit Download

.system-helper

Path /usr/lib/systemd/.system-helper
Size 64KB
SHA256 ebd2b8286e11baaf043a64be806bb4396a0b2ac2be0c89ed8dd79c2e82f6b6c1
MD5 039adb68088bc5d4dee97086ba9ff25c
SHA1 8216d14a0b50bc661a38db3c0d1c1df97b92420b
SHA512 5c99259daf0cad0af97a2679569100d9fbdec41a1e05e42d850ff62bf218a249dde9043b372c1adb4732dc5f67b37312263cdb93ae9e176ac2fecfdfbbafda5a
SSDEEP 1536:VYutkaRfaZhgmTEsa/WfMokbkueZM1fnouy8Lzkk0:+u+7ZhKiMNPoutUk0
TLSH
T1AE53028A84BAC776C94AE5354C7971C753B4DB1CE38716ECEB21B0636C43E287A14B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads