Analysis
- max time kernel
149s - max time network
142s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260127-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
15/04/2026, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
bot.x86_64
Resource
ubuntu1804-amd64-20260127-en
4 signatures
150 seconds
General
- Target bot.x86_64
- Size 136KB
- Sample260415-vt71wae19j
- SHA256 8d2922fd1e5a89254b172ac29078bfaf572ae36b641689b017464588a174ee1c
- MD5 774e5d7b56da92a034fcd6ba9c2fedfa
- SHA1 8b7ddec6b2dd15cf79d5baa92331e2c8b1977c49
- SHA512 73355cb9f84038e2022744c931fd821ff77d5b9a7409d700b626946daa744ce168a4a93a397f7929f62617146df9469676fd5d2543fb56ef720471c3af4cf0ee
- SSDEEP 3072:m0Y7L9uN7sAk5U1jpJyr4lKqX+CgHsCuvufiZCKmPJ2:m0Y7L9uN7sAki1jmqPf+tQ
- TLSH T16BD34B07B4C190FDC4D9C1748BABB13BE977B1691238B25B2BD4AB272E49E305F1D644
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1564 bot.x86_64 - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 1564 bot.x86_64 1565 bot.x86_64 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 1564 bot.x86_64 - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/bot.x86_64 bot.x86_64