Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
24/04/2026, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
main_x86_64
Resource
ubuntu1804-amd64-20260126-en
4 signatures
150 seconds
General
- Target main_x86_64
- Size 136KB
- Sample260424-w2pd6sft5x
- SHA256 0f818c18e2da8575cd50046b12f51252a885979726703d73faa950ef510ab3f7
- MD5 aeda8a10a23b428daa0c7d9aada0555f
- SHA1 5be5911edca96ade543bfb4faca798448be2a9ee
- SHA512 eec2414909acae84fcf2bb5cc4183a2231dbf2d0f23a468cd7c07c760ac48dfa5c195d25e267f11f5685526e29d75af0f0d5d66f561b8e5a9ad8cb13d573cc40
- SSDEEP 3072:79eSuygEPjt6qkWq2dhmDnYMb0oBd/gQyVGsdqml69aj:79eSuygEPjt6qkWqs2H2la9a
- TLSH T141D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1522 main_x86_64 - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 1522 main_x86_64 1523 main_x86_64 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 1522 main_x86_64 - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/main_x86_64 main_x86_64