Analysis
- max time kernel
149s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/04/2026, 23:49
Behavioral task
behavioral1
Sample
iran.x86_64.elf
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target iran.x86_64.elf
- Size 52KB
- Sample260419-3vbcashs8v
- SHA256 105f6f43c438a8d0a75203baecb47062c70b3451be8a402ad7799049eb2c55cc
- MD5 206b3646593d0565637929dc4f82f97e
- SHA1 927fe892c36418f33fee6443c2bcd34d2afabafe
- SHA512 16b18aadae9f05d6c96ef81238e95f5fa70f58a743180194b989446282a79afd24d2f07289b0cd984813ad85721fe6d6d9659d487bf2025db057836983e86dc6
- SSDEEP 1536:NnqcvJ0ugth89Sa/AyjgbtOrOWI4VQ8vk1E7ZW6GPmaW:NhWugtO9VqOrOWw1+dgrW
- TLSH T1903302AB94D7C3E8D9339D3776BD058041AEEC19D1095B2F008369A37D32A9238729F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1523 iran.x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 1523 iran.x86_64.elf -
description ioc Process File opened for reading /proc/89/comm iran.x86_64.elf File opened for reading /proc/171/comm iran.x86_64.elf File opened for reading /proc/417/comm iran.x86_64.elf File opened for reading /proc/1028/comm iran.x86_64.elf File opened for reading /proc/204/comm iran.x86_64.elf File opened for reading /proc/666/comm iran.x86_64.elf File opened for reading /proc/1071/comm iran.x86_64.elf File opened for reading /proc/8/comm iran.x86_64.elf File opened for reading /proc/79/comm iran.x86_64.elf File opened for reading /proc/80/comm iran.x86_64.elf File opened for reading /proc/169/comm iran.x86_64.elf File opened for reading /proc/81/comm iran.x86_64.elf File opened for reading /proc/137/comm iran.x86_64.elf File opened for reading /proc/547/comm iran.x86_64.elf File opened for reading /proc/716/comm iran.x86_64.elf File opened for reading /proc/951/comm iran.x86_64.elf File opened for reading /proc/1075/comm iran.x86_64.elf File opened for reading /proc/161/comm iran.x86_64.elf File opened for reading /proc/172/comm iran.x86_64.elf File opened for reading /proc/178/comm iran.x86_64.elf File opened for reading /proc/479/comm iran.x86_64.elf File opened for reading /proc/526/comm iran.x86_64.elf File opened for reading /proc/650/comm iran.x86_64.elf File opened for reading /proc/1045/comm iran.x86_64.elf File opened for reading /proc/1141/comm iran.x86_64.elf File opened for reading /proc/1/comm iran.x86_64.elf File opened for reading /proc/9/comm iran.x86_64.elf File opened for reading /proc/453/comm iran.x86_64.elf File opened for reading /proc/1154/comm iran.x86_64.elf File opened for reading /proc/1230/comm iran.x86_64.elf File opened for reading /proc/20/comm iran.x86_64.elf File opened for reading /proc/30/comm iran.x86_64.elf File opened for reading /proc/159/comm iran.x86_64.elf File opened for reading /proc/1069/comm iran.x86_64.elf File opened for reading /proc/1179/comm iran.x86_64.elf File opened for reading /proc/1521/comm iran.x86_64.elf File opened for reading /proc/32/comm iran.x86_64.elf File opened for reading /proc/170/comm iran.x86_64.elf File opened for reading /proc/693/comm iran.x86_64.elf File opened for reading /proc/4/comm iran.x86_64.elf File opened for reading /proc/978/comm iran.x86_64.elf File opened for reading /proc/203/comm iran.x86_64.elf File opened for reading /proc/1049/comm iran.x86_64.elf File opened for reading /proc/1196/comm iran.x86_64.elf File opened for reading /proc/173/comm iran.x86_64.elf File opened for reading /proc/575/comm iran.x86_64.elf File opened for reading /proc/975/comm iran.x86_64.elf File opened for reading /proc/1036/comm iran.x86_64.elf File opened for reading /proc/1050/comm iran.x86_64.elf File opened for reading /proc/608/comm iran.x86_64.elf File opened for reading /proc/909/comm iran.x86_64.elf File opened for reading /proc/1092/comm iran.x86_64.elf File opened for reading /proc/1162/comm iran.x86_64.elf File opened for reading /proc/5/comm iran.x86_64.elf File opened for reading /proc/34/comm iran.x86_64.elf File opened for reading /proc/86/comm iran.x86_64.elf File opened for reading /proc/160/comm iran.x86_64.elf File opened for reading /proc/467/comm iran.x86_64.elf File opened for reading /proc/485/comm iran.x86_64.elf File opened for reading /proc/904/comm iran.x86_64.elf File opened for reading /proc/545/comm iran.x86_64.elf File opened for reading /proc/723/comm iran.x86_64.elf File opened for reading /proc/964/comm iran.x86_64.elf File opened for reading /proc/988/comm iran.x86_64.elf