Analysis
- max time kernel
120s - max time network
139s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
17/10/2026, 12:24
General
- Target violet.x86
- Size 37KB
- Sample261017-plcbcafw2t
- SHA256 ffb7826c04fc5bb024605f779f9d067a38b0a28032094f6cf7a37ac76ef280f5
Score
6/10
Malware Config
Signatures
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Changes its process name 1 IoCs
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/violet.x86/tmp/violet.x861⤵
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "(crontab -l 2>/dev/null; echo '@reboot /tmp/.violet violet') | crontab - 2>/dev/null"2⤵
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.violet
tmp.oDYvL1