011f9202d7bfa7fe1f34096ada2e554c1cf4aa85c2138e9f59a0f214eea4fb33

Analysis

max time kernel
149s
max time network
146s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20250610-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20250610-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
16/06/2025, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
i686.elf
Size 573KB
Sample250616-la8nmaxzhy
SHA256 011f9202d7bfa7fe1f34096ada2e554c1cf4aa85c2138e9f59a0f214eea4fb33
MD5 5f79e2d591f33e298124321b123b7268
SHA1 d5a9aff2f0206f382b883cea7632aa77f3552b30
SHA512 7e0b2d94ff43dd7f08b58ac47761fed00a47354d8c5e9810ac76e530bc564bc932b56a278eab1dd1180dcb065845bead830e135db5fa670eb16915ae0af65b3c
SSDEEP 12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Renames itself 1 IoCs

pid
1565

Checks hardware identifiers (DMI) 1 TTPs 2 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	configuration
File opened for reading	/sys/class/dmi/id/board_vendor	configuration

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.wcm6F5	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/ens3/address	configuration

Reads hardware information 1 TTPs 4 IoCs

Accesses system info like serial numbers, manufacturer names etc.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/board_name	configuration
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	configuration
File opened for reading	/sys/class/dmi/id/board_name	configuration
File opened for reading	/sys/class/dmi/id/product_uuid	configuration

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	configuration

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	configuration

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/73/cmdline	configuration
File opened for reading	/proc/410/cmdline	configuration
File opened for reading	/proc/633/cmdline	configuration
File opened for reading	/proc/787/cmdline	configuration
File opened for reading	/proc/895/cmdline	configuration
File opened for reading	/proc/925/cmdline	configuration
File opened for reading	/proc/1013/cmdline	configuration
File opened for reading	/proc/1038/cmdline	configuration
File opened for reading	/proc/15/cmdline	configuration
File opened for reading	/proc/76/cmdline	configuration
File opened for reading	/proc/95/cmdline	configuration
File opened for reading	/proc/173/cmdline	configuration
File opened for reading	/proc/315/cmdline	configuration
File opened for reading	/proc/519/cmdline	configuration
File opened for reading	/proc/1058/cmdline	configuration
File opened for reading	/proc/1095/cmdline	configuration
File opened for reading	/proc/213/cmdline	configuration
File opened for reading	/proc/972/cmdline	configuration
File opened for reading	/proc/1164/cmdline	configuration
File opened for reading	/proc/1553/cmdline	configuration
File opened for reading	/proc/1/cmdline	configuration
File opened for reading	/proc/102/cmdline	configuration
File opened for reading	/proc/588/cmdline	configuration
File opened for reading	/proc/1200/cmdline	configuration
File opened for reading	/proc/1335/cmdline	configuration
File opened for reading	/proc/25/cmdline	configuration
File opened for reading	/proc/14/cmdline	configuration
File opened for reading	/proc/19/cmdline	configuration
File opened for reading	/proc/93/cmdline	configuration
File opened for reading	/proc/99/cmdline	configuration
File opened for reading	/proc/1089/cmdline	configuration
File opened for reading	/proc/1093/cmdline	configuration
File opened for reading	/proc/1129/cmdline	configuration
File opened for reading	/proc/81/cmdline	configuration
File opened for reading	/proc/789/cmdline	configuration
File opened for reading	/proc/1032/cmdline	configuration
File opened for reading	/proc/1109/cmdline	configuration
File opened for reading	/proc/1224/cmdline	configuration
File opened for reading	/proc/1233/cmdline	configuration
File opened for reading	/proc/1555/cmdline	configuration
File opened for reading	/proc/2/cmdline	configuration
File opened for reading	/proc/7/cmdline	configuration
File opened for reading	/proc/24/cmdline	configuration
File opened for reading	/proc/85/cmdline	configuration
File opened for reading	/proc/263/cmdline	configuration
File opened for reading	/proc/1008/cmdline	configuration
File opened for reading	/proc/1122/cmdline	configuration
File opened for reading	/proc/1554/cmdline	configuration
File opened for reading	/proc/17/cmdline	configuration
File opened for reading	/proc/763/cmdline	configuration
File opened for reading	/proc/978/cmdline	configuration
File opened for reading	/proc/1016/cmdline	configuration
File opened for reading	/proc/23/cmdline	configuration
File opened for reading	/proc/77/cmdline	configuration
File opened for reading	/proc/197/cmdline	configuration
File opened for reading	/proc/314/cmdline	configuration
File opened for reading	/proc/426/cmdline	configuration
File opened for reading	/proc/498/cmdline	configuration
File opened for reading	/proc/774/cmdline	configuration
File opened for reading	/proc/1196/cmdline	configuration
File opened for reading	/proc/8/cmdline	configuration
File opened for reading	/proc/11/cmdline	configuration
File opened for reading	/proc/74/cmdline	configuration
File opened for reading	/proc/191/cmdline	configuration

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/root1086f3d	configuration

/usr/bin/crontab
crontab -l
1⤵
PID:1567

/usr/bin/crontab
crontab -
1⤵
- Creates/modifies Cron job
PID:1570

/usr/bin/crontab
crontab -l
1⤵
PID:1571

/root/.sys/configuration
/tmp/i686.elf
1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Reads hardware information
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1565

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp.wcm6F5

Path /var/spool/cron/crontabs/tmp.wcm6F5
Size 208B
SHA256 10ea4e57411e32b55906a221dbadfcfc547cfa7294b96bbe2153f211a581fdd5
MD5 f57125c4948c67b2375c9e2fa6b129b1
SHA1 9a38e0fee588aa94aec1529bdba5fbad826298e2
SHA512 ffc04135a6905bb442a741dc43126a73ec6c40eb5b8d069a382051727d667b9fcc69e32f67dcf50c2fc562809272b1f8dc0d05f414e7df05d1c38e93f32bed88
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads