1b2873d53d47eec40d887f257d1084199ef2df6f5bc54e1073c96e5a7b1df83c

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18/04/2026, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_1b2873d53d47eec40d887f257d1084199ef2df6f5bc54e1073c96e5a7b1df83c.elf
Size 83KB
Sample260418-j1g79aa16w
SHA256 1b2873d53d47eec40d887f257d1084199ef2df6f5bc54e1073c96e5a7b1df83c
MD5 a33888d3a7bdfab9284fb9d25b13083a
SHA1 64ceb3267e11b8f53d3fc91104f4761fb22a16ab
SHA512 9dbebdd678eb08888b0049c839fd214025f188558904fc77b2aaf0d90104467813aadd0772813d8b13f114978c32e70caef9c0667bb17893846ceb5e2b5ca6a6
SSDEEP 1536:eNXQrUwQvIfGAAz9vCd6aJxprGhVFBfxBq4rwmFHg2OZIf5jr8y:eNiU6eH9vS6ELrcLtUmtg2OZ85jr8y
TLSH
T1B38308925785C5F7D0431BB706975FB50B2AF83A0DBAEE41F36CBCB48A610A4713AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Contacts a large (3875) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	_1b2873d53d47eec40d887f257d1084199ef2df6f5bc54e1073c96e5a7b1df83c.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	_1b2873d53d47eec40d887f257d1084199ef2df6f5bc54e1073c96e5a7b1df83c.elf

/tmp/_1b2873d53d47eec40d887f257d1084199ef2df6f5bc54e1073c96e5a7b1df83c.elf
/tmp/_1b2873d53d47eec40d887f257d1084199ef2df6f5bc54e1073c96e5a7b1df83c.elf
1⤵
- Reads system routing table
- Reads system network configuration
PID:1522

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads