Overview

overview

7

Static

static

5

1.elf

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    147s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    20/10/2026, 10:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1.elf
  • Size 462KB
  • Sample261020-mj1j2sgv21
  • SHA256 423116f78074a41693d45d9f35d58bcb05bf85a1300cbb5d5d82de5e7730ed1b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 4 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 2 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads hardware information 1 TTPs 2 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Removes the immutable protection flag from a file 1 TTPs 7 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Write file to user bin folder 2 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/1.elf
    /tmp/1.elf
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Modifies systemd
    • Reads MAC address of network interface
    • Reads hardware information
    • Write file to user bin folder
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to shm directory
    PID:1553
    • /usr/bin/chattr
      chattr -i /etc/.migration597
      2⤵
      • Removes the immutable protection flag from a file
      PID:1561
    • /usr/bin/chattr
      chattr -i /var/cache/.migration597
      2⤵
      • Removes the immutable protection flag from a file
      PID:1562
    • /usr/bin/chattr
      chattr -i /var/lib/.migration597
      2⤵
      • Removes the immutable protection flag from a file
      PID:1563
    • /usr/bin/chattr
      chattr -i /usr/bin/.migration597
      2⤵
      • Removes the immutable protection flag from a file
      PID:1564
    • /bin/systemctl
      systemctl daemon-reload
      2⤵
        PID:1565
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/migration597.service
        2⤵
        • Reads runtime system information
        PID:1586
    • /bin/sh
      sh /etc/.migration597.loop
      1⤵
        PID:1609
        • /bin/date
          date "+%s"
          2⤵
            PID:1610
          • /bin/cat
            cat /etc/.migration597.beat
            2⤵
              PID:1611
            • /bin/sleep
              sleep 45
              2⤵
                PID:1612
              • /bin/date
                date "+%s"
                2⤵
                  PID:1665
                • /bin/cat
                  cat /etc/.migration597.beat
                  2⤵
                    PID:1666
                  • /bin/sleep
                    sleep 45
                    2⤵
                      PID:1667
                    • /bin/date
                      date "+%s"
                      2⤵
                        PID:1668
                      • /bin/cat
                        cat /etc/.migration597.beat
                        2⤵
                          PID:1669
                        • /bin/sleep
                          sleep 45
                          2⤵
                            PID:1670
                          • /bin/date
                            date "+%s"
                            2⤵
                              PID:1671
                            • /bin/cat
                              cat /etc/.migration597.beat
                              2⤵
                                PID:1672
                              • /bin/sleep
                                sleep 45
                                2⤵
                                  PID:1673
                              • /etc/.migration597
                                /etc/.migration597
                                1⤵
                                • Modifies Watchdog functionality
                                • Enumerates active TCP sockets
                                • Modifies systemd
                                • Reads MAC address of network interface
                                • Reads hardware information
                                • Write file to user bin folder
                                • Changes its process name
                                • Reads CPU attributes
                                • Reads system network configuration
                                • Enumerates kernel/hardware configuration
                                • Reads runtime system information
                                PID:1553
                                • /usr/bin/chattr
                                  chattr -i /var/cache/.migration597
                                  2⤵
                                  • Removes the immutable protection flag from a file
                                  PID:1613
                                • /usr/bin/chattr
                                  chattr -i /var/lib/.migration597
                                  2⤵
                                  • Removes the immutable protection flag from a file
                                  PID:1614
                                • /usr/bin/chattr
                                  chattr -i /usr/bin/.migration597
                                  2⤵
                                  • Removes the immutable protection flag from a file
                                  PID:1615
                                • /bin/systemctl
                                  systemctl daemon-reload
                                  2⤵
                                    PID:1616
                                  • /bin/systemctl
                                    systemctl enable --now /etc/systemd/system/migration597.service
                                    2⤵
                                      PID:1637

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        XDG Autostart Entries

                                        1
                                        T1547.013

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Systemd Service

                                        1
                                        T1543.002

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        XDG Autostart Entries

                                        1
                                        T1547.013

                                        Create or Modify System Process

                                        1
                                        T1543

                                        Systemd Service

                                        1
                                        T1543.002

                                        Defense Evasion

                                        File and Directory Permissions Modification

                                        1
                                        T1222

                                        Linux and Mac File and Directory Permissions Modification

                                        1
                                        T1222.002

                                        Impair Defenses

                                        1
                                        T1562

                                        Credential Access

                                        Discovery

                                        System Information Discovery

                                        3
                                        T1082

                                        System Network Configuration Discovery

                                        2
                                        T1016

                                        Internet Connection Discovery

                                        1
                                        T1016.001

                                        Wi-Fi Discovery

                                        1
                                        T1016.002

                                        System Network Connections Discovery

                                        2
                                        T1049

                                        Lateral Movement

                                        Collection

                                        Command and Control

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        .boat.lock
                                        • Path /dev/shm/.boat.lock
                                        • Size 5B
                                        • SHA256 13d31657024fa3e1e1ece566ca9e52f418bc4e06e24b6f6ad92c5d4f6b97a393
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        .migration597
                                        • Path /etc/.migration597
                                        • Size 462KB
                                        • SHA256 423116f78074a41693d45d9f35d58bcb05bf85a1300cbb5d5d82de5e7730ed1b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        migration597.service
                                        • Path /etc/systemd/system/migration597.service
                                        • Size 246B
                                        • SHA256 0a22215e6f8649a71c8ed74805350c8170a8f9d1418fb26b81e8dc75388aebe4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download