Analysis
- max time kernel
149s - max time network
149s - platform
ubuntu-20.04_amd64 - resource
ubuntu2004-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20250619-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system - submitted
24/08/2025, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
i486.elf
Resource
ubuntu2004-amd64-20250619-en
ubuntu-20.04-amd64
6 signatures
150 seconds
General
- Target i486.elf
- Size 45KB
- Sample250824-scftyswsb1
- SHA256 a00b3cde85ac7d9a29b748880f6dd6744ecc2a04083742e543a5d7495fd84a2e
- MD5 b4ad4d6b2670eef6061a906700d67e88
- SHA1 e37696f201d9cb7df89a110693e8004e95955193
- SHA512 c4bbfb5f3a2697cb38052fd4e6e424f70f7a590191f8ba6860ccd55f4d6dd180daf1a18717abfeaed6d400b50eb2165a4d0d71e782d037579ed065c468ea3348
- SSDEEP 768:hQXtGqV6uWHJdKfr730JdF+pVx0GSazarXy5B5fJibJ6mBCrnD6NxqLUVI8tl7t:2XtGqGM/30JdFsx0GSazZ/5ABCCXHW8l
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid 1422 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 54 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc File opened for reading /proc/920/maps File opened for reading /proc/442/maps File opened for reading /proc/445/maps File opened for reading /proc/451/maps File opened for reading /proc/455/maps File opened for reading /proc/496/maps File opened for reading /proc/499/maps File opened for reading /proc/851/maps File opened for reading /proc/871/maps File opened for reading /proc/480/maps File opened for reading /proc/500/maps File opened for reading /proc/578/maps File opened for reading /proc/584/maps File opened for reading /proc/877/maps File opened for reading /proc/894/maps File opened for reading /proc/899/maps File opened for reading /proc/927/maps File opened for reading /proc/439/maps File opened for reading /proc/533/maps File opened for reading /proc/635/maps File opened for reading /proc/681/maps File opened for reading /proc/931/maps File opened for reading /proc/536/maps File opened for reading /proc/586/maps File opened for reading /proc/766/maps File opened for reading /proc/862/maps File opened for reading /proc/909/maps File opened for reading /proc/995/maps File opened for reading /proc/242/maps File opened for reading /proc/664/maps File opened for reading /proc/781/maps File opened for reading /proc/788/maps File opened for reading /proc/816/maps File opened for reading /proc/844/maps File opened for reading /proc/848/maps File opened for reading /proc/396/maps File opened for reading /proc/501/maps File opened for reading /proc/659/maps File opened for reading /proc/666/maps File opened for reading /proc/839/maps File opened for reading /proc/270/maps File opened for reading /proc/440/maps File opened for reading /proc/448/maps File opened for reading /proc/483/maps File opened for reading /proc/495/maps File opened for reading /proc/797/maps File opened for reading /proc/843/maps File opened for reading /proc/866/maps File opened for reading /proc/1/maps File opened for reading /proc/394/maps File opened for reading /proc/487/maps File opened for reading /proc/560/maps File opened for reading /proc/636/maps File opened for reading /proc/749/maps - Changes its process name 1 IoCs
description ioc pid Changes the process name, possibly in an attempt to hide itself -bash 1427 - Enumerates kernel/hardware configuration 1 TTPs 11 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc File opened for reading /sys/firmware File opened for reading /sys/module File opened for reading /sys/class File opened for reading /sys/dev File opened for reading /sys/bus File opened for reading /sys/block File opened for reading /sys/kernel File opened for reading /sys/power File opened for reading /sys/devices File opened for reading /sys/hypervisor File opened for reading /sys/fs -
description ioc File opened for reading /proc/1001/maps File opened for reading /proc/1091/maps File opened for reading /proc/1112/maps File opened for reading /proc/1145/maps File opened for reading /proc/1423/maps File opened for reading /proc/mounts File opened for reading /proc/1012/maps File opened for reading /proc/1080/maps File opened for reading /proc/1087/maps File opened for reading /proc/1118/maps File opened for reading /proc/1331/maps File opened for reading /proc/1354/maps File opened for reading /proc/1410/maps File opened for reading /proc/1016/maps File opened for reading /proc/1092/maps File opened for reading /proc/1224/maps File opened for reading /proc/1020/maps File opened for reading /proc/1043/maps File opened for reading /proc/1072/maps File opened for reading /proc/1105/maps File opened for reading /proc/1208/maps File opened for reading /proc/1005/maps File opened for reading /proc/1062/maps File opened for reading /proc/1075/maps File opened for reading /proc/1100/maps File opened for reading /proc/1177/maps File opened for reading /proc/1388/maps File opened for reading /proc/1052/maps File opened for reading /proc/1095/maps File opened for reading /proc/1096/maps File opened for reading /proc/1198/maps File opened for reading /proc/1073/maps File opened for reading /proc/1074/maps File opened for reading /proc/1107/maps File opened for reading /proc/1111/maps File opened for reading /proc/1242/maps File opened for reading /proc/1086/maps File opened for reading /proc/1122/maps File opened for reading /proc/1338/maps