Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
16/04/2026, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
Sassy.i486
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target Sassy.i486
- Size 49KB
- Sample260416-alnl2se16w
- SHA256 358ad92b13d498f6d6ed59aa3ed1c4e22f84211da2ad514074f23240dd9d8f9d
- MD5 56fa0d50e678b7d5a217e619e1a5e3b8
- SHA1 d041584d64c9a7351bf9979be0626871a5c39edd
- SHA512 d53c736ad15ae037b5cfc01e510bb7692e1a0e2dcac62dcec6f24e864f2d9cee04219f6ec7b8acf848ee81d2eb4536610d248f80892398ccf1b7ff0cd6525ad0
- SSDEEP 768:vRkku1qT+C5Gcbi3pRrnVXfUEAFeFHIruziqANOV+U2331gkLrGfRTgqDl2pjTEr:vufyypHhFHh+U431gkLrG9HUUr
- TLSH T167332B48F783E0F0ED4A0571115BF77E96349E035124DE6EDBD4FE62AE32A12B12B618
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1507 Sassy.i486 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/SassyCNC 1507 Sassy.i486 -
description ioc Process File opened for reading /proc/30/comm Sassy.i486 File opened for reading /proc/204/comm Sassy.i486 File opened for reading /proc/675/comm Sassy.i486 File opened for reading /proc/1032/comm Sassy.i486 File opened for reading /proc/79/comm Sassy.i486 File opened for reading /proc/967/comm Sassy.i486 File opened for reading /proc/1010/comm Sassy.i486 File opened for reading /proc/1024/comm Sassy.i486 File opened for reading /proc/1036/comm Sassy.i486 File opened for reading /proc/1045/comm Sassy.i486 File opened for reading /proc/1063/comm Sassy.i486 File opened for reading /proc/1081/comm Sassy.i486 File opened for reading /proc/31/comm Sassy.i486 File opened for reading /proc/34/comm Sassy.i486 File opened for reading /proc/494/comm Sassy.i486 File opened for reading /proc/1473/comm Sassy.i486 File opened for reading /proc/163/comm Sassy.i486 File opened for reading /proc/490/comm Sassy.i486 File opened for reading /proc/961/comm Sassy.i486 File opened for reading /proc/35/comm Sassy.i486 File opened for reading /proc/416/comm Sassy.i486 File opened for reading /proc/452/comm Sassy.i486 File opened for reading /proc/652/comm Sassy.i486 File opened for reading /proc/1051/comm Sassy.i486 File opened for reading /proc/1498/comm Sassy.i486 File opened for reading /proc/173/comm Sassy.i486 File opened for reading /proc/709/comm Sassy.i486 File opened for reading /proc/965/comm Sassy.i486 File opened for reading /proc/12/comm Sassy.i486 File opened for reading /proc/473/comm Sassy.i486 File opened for reading /proc/526/comm Sassy.i486 File opened for reading /proc/876/comm Sassy.i486 File opened for reading /proc/906/comm Sassy.i486 File opened for reading /proc/14/comm Sassy.i486 File opened for reading /proc/5/comm Sassy.i486 File opened for reading /proc/16/comm Sassy.i486 File opened for reading /proc/20/comm Sassy.i486 File opened for reading /proc/169/comm Sassy.i486 File opened for reading /proc/417/comm Sassy.i486 File opened for reading /proc/901/comm Sassy.i486 File opened for reading /proc/942/comm Sassy.i486 File opened for reading /proc/26/comm Sassy.i486 File opened for reading /proc/89/comm Sassy.i486 File opened for reading /proc/167/comm Sassy.i486 File opened for reading /proc/171/comm Sassy.i486 File opened for reading /proc/667/comm Sassy.i486 File opened for reading /proc/671/comm Sassy.i486 File opened for reading /proc/988/comm Sassy.i486 File opened for reading /proc/9/comm Sassy.i486 File opened for reading /proc/25/comm Sassy.i486 File opened for reading /proc/442/comm Sassy.i486 File opened for reading /proc/168/comm Sassy.i486 File opened for reading /proc/468/comm Sassy.i486 File opened for reading /proc/491/comm Sassy.i486 File opened for reading /proc/557/comm Sassy.i486 File opened for reading /proc/1053/comm Sassy.i486 File opened for reading /proc/8/comm Sassy.i486 File opened for reading /proc/161/comm Sassy.i486 File opened for reading /proc/174/comm Sassy.i486 File opened for reading /proc/115/comm Sassy.i486 File opened for reading /proc/500/comm Sassy.i486 File opened for reading /proc/1148/comm Sassy.i486 File opened for reading /proc/1250/comm Sassy.i486 File opened for reading /proc/11/comm Sassy.i486