237baa9e4af13c1326f7421d474401b06d836c7337b76b222d8676655392881e

Analysis

max time kernel
147s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21/04/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
i686
Size 97KB
Sample260421-w2w41set7y
SHA256 237baa9e4af13c1326f7421d474401b06d836c7337b76b222d8676655392881e
MD5 5327d651e2908ad9e8535a7e920dd098
SHA1 3ccb7d535eedf8aa032b1f599b7f893fc3d9ec8b
SHA512 8d7f8953e2b9631170770d1f0c702dbad3a7787843fe0c619c9564112d809961068e7cb80482962f2af2c34dac95e8be6b4f5bb9a89dbfc16d0559b7824b8145
SSDEEP 3072:aPaqjPQP39VjGWX98732V7kGyNVe5heTe7FXnf0OzTyoQQub:ahQP39VjGWXW9NVe5h+0FXnf0OzTyoQ7
TLSH
T173A35B82D642C2F3C4430AF1029F965A0532FB3A8A3B9EAAF75D7CF49B129D53115B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/resolv.conf	i686

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1520	i686

/tmp/i686
/tmp/i686
1⤵
- Writes DNS configuration
- Changes its process name
PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Adversary-in-the-Middle

T1557

Discovery

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads