13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59

Analysis

max time kernel
1s
max time network
138s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/10/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
diddysbot-amd64
Size 2.0MB
Sample261030-pecnjaee39
SHA256 13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59
MD5 c29ed13c9c2b23786635566704063baa
SHA1 dfa4e9dabc6addeae0272e4676e74e768230bd1c
SHA512 0ca2480a1f1aedd6964714bfa25a0d31313b1dc6d401e4e0a2cc1a4c0878992b23f4fb351a18383eac93496d59018f8bf7d498db74590aaf5e8a3a8dcf4dfb6f
SSDEEP 49152:WxrItweLMiyZFeecIdlb0WdRlWY6wFj5ydik4AlT0J3SVey:WxrfeLMiyZrVbrWY6qwdijvJqey
TLSH
T12995337EB90AB370C1D07FF24263742B4F8854DCADAE24A125463D464FE885B7A62BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence privilege_escalation upx

Malware Config

Signatures

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/kworker.service	diddysbot-amd64

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/kworker	diddysbot-amd64

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	diddysbot-amd64

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/exe	diddysbot-amd64
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl

/tmp/diddysbot-amd64
/tmp/diddysbot-amd64
1⤵
- Modifies systemd
- Write file to user bin folder
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1516
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Reads runtime system information
  PID:1527
- /bin/systemctl
  systemctl enable --now kworker
  2⤵
  - Reads runtime system information
  PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kworker.service

Path /etc/systemd/system/kworker.service
Size 216B
SHA256 92bf676d139fe56b26bf727ff481ba9d84b8e2950f66c34c1fb6d576f32e56fe
MD5 6d3adaa04559a464e584bcddc051ec59
SHA1 db694096383b9e608c18a9b28f50002e96d8fae8
SHA512 de81c593f0e8e7c24f07d9a4eecfb8872dea203278cd9b845bb40e519f09d13fe4f5e22b5e03cacc1d09630d32a842149539ab45809c7c33a3a6dc8f922c7f71
TLSH
T163D0A903AE2221E5980B0C758EE323404C4002424ACEB27CAFE1A58931E1A4EA03A4AA
MD5 SHA1 SHA512 TLSH

Submit Download

kworker

Path /usr/local/bin/kworker
Size 2.0MB
SHA256 13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59
MD5 c29ed13c9c2b23786635566704063baa
SHA1 dfa4e9dabc6addeae0272e4676e74e768230bd1c
SHA512 0ca2480a1f1aedd6964714bfa25a0d31313b1dc6d401e4e0a2cc1a4c0878992b23f4fb351a18383eac93496d59018f8bf7d498db74590aaf5e8a3a8dcf4dfb6f
SSDEEP 49152:WxrItweLMiyZFeecIdlb0WdRlWY6wFj5ydik4AlT0J3SVey:WxrfeLMiyZrVbrWY6qwdijvJqey
TLSH
T12995337EB90AB370C1D07FF24263742B4F8854DCADAE24A125463D464FE885B7A62BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads