4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f

Analysis

max time kernel
130s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260127-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29/01/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
Size 1.2MB
Sample260129-vpsemaaw3e
SHA256 4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
MD5 4d8671ffc41252bc189b62699cb8cf90
SHA1 5ffe44b04c0c47c83c1cd694b28c432fcde5867d
SHA512 79e5014bf1e8042d5ca2c2eed3d802106c4ef3a79b9c13f31be8788e416fce29df04e166fca43b1ce3a786f5414655f03c57a017fa1ab0497fd53b24bceabf13
SSDEEP 24576:KqW1l0V8vt/RQFReCNUQO70vnTSdrUZ9xkU:c0V4t/RQFgCNLO70vnTSN49xkU
TLSH
T1C2457C136791B450E0824074ABCF92F2ABD5B8B21552B76B6BC6EE233E76CD17319313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/eth0/address	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	dbus-daemon	1521	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
Changes the process name, possibly in an attempt to hide itself	dbus-daemon	1521	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
Changes the process name, possibly in an attempt to hide itself	dbus-daemon	1521	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
Changes the process name, possibly in an attempt to hide itself	crond	1521	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/fd	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
File opened for reading	/proc/sys/kernel/hostname	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
File opened for reading	/proc/loadavg	4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f

/tmp/4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
/tmp/4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f
1⤵
- Reads MAC address of network interface
- Changes its process name
- Reads CPU attributes
- Reads runtime system information
PID:1519

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads