Analysis
- user interaction
yes - max time kernel
15s - max time network
16s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/04/2026, 00:46
Behavioral task
behavioral1
Sample
iran.x86_64
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral2
Sample
iran.x86_64
Resource
ubuntu2004-amd64-20260126-en
ubuntu-20.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral3
Sample
iran.x86_64
Resource
ubuntu2204-amd64-20260126-en
ubuntu-22.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral4
Sample
iran.x86_64
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
4 signatures
30 seconds
General
- Target iran.x86_64
- Size 46KB
- Sample260429-a4pbasfx9x
- SHA256 cd2ef7c104ccbc9ae0efd0f3e05fef0064f5bfd5ed8a4a912ca4e1b02cda1550
- MD5 75566ec6dd6a5ae692bc650dbe7efce4
- SHA1 2c23dfa0eeb93c31a43a2987aacf5aa2f5a19bd8
- SHA512 881380ee52e194ba35f75b9ef743507c09804b722f9725c36dd7469c925e57a5867311d0dc06beae9559cca205addd1b316574f857ced3b977868f469b7ce3d7
- SSDEEP 768:RdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b87dep43:2wkgI6YONsLsjwVwimoLzxMdei
- TLSH T1E42302FAD357F0BCC470A577064EA2DAA56A78029725270E43F231D9FE676681D023C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1534 iran.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 1534 iran.x86_64 -
description ioc Process File opened for reading /proc/1055/comm iran.x86_64 File opened for reading /proc/159/comm iran.x86_64 File opened for reading /proc/172/comm iran.x86_64 File opened for reading /proc/176/comm iran.x86_64 File opened for reading /proc/173/comm iran.x86_64 File opened for reading /proc/1081/comm iran.x86_64 File opened for reading /proc/12/comm iran.x86_64 File opened for reading /proc/4/comm iran.x86_64 File opened for reading /proc/30/comm iran.x86_64 File opened for reading /proc/34/comm iran.x86_64 File opened for reading /proc/415/comm iran.x86_64 File opened for reading /proc/707/comm iran.x86_64 File opened for reading /proc/1030/comm iran.x86_64 File opened for reading /proc/1392/comm iran.x86_64 File opened for reading /proc/31/comm iran.x86_64 File opened for reading /proc/170/comm iran.x86_64 File opened for reading /proc/270/comm iran.x86_64 File opened for reading /proc/534/comm iran.x86_64 File opened for reading /proc/1065/comm iran.x86_64 File opened for reading /proc/7/comm iran.x86_64 File opened for reading /proc/323/comm iran.x86_64 File opened for reading /proc/535/comm iran.x86_64 File opened for reading /proc/919/comm iran.x86_64 File opened for reading /proc/994/comm iran.x86_64 File opened for reading /proc/1311/comm iran.x86_64 File opened for reading /proc/20/comm iran.x86_64 File opened for reading /proc/22/comm iran.x86_64 File opened for reading /proc/3/comm iran.x86_64 File opened for reading /proc/17/comm iran.x86_64 File opened for reading /proc/25/comm iran.x86_64 File opened for reading /proc/167/comm iran.x86_64 File opened for reading /proc/1021/comm iran.x86_64 File opened for reading /proc/1103/comm iran.x86_64 File opened for reading /proc/1267/comm iran.x86_64 File opened for reading /proc/11/comm iran.x86_64 File opened for reading /proc/19/comm iran.x86_64 File opened for reading /proc/164/comm iran.x86_64 File opened for reading /proc/203/comm iran.x86_64 File opened for reading /proc/500/comm iran.x86_64 File opened for reading /proc/561/comm iran.x86_64 File opened for reading /proc/584/comm iran.x86_64 File opened for reading /proc/666/comm iran.x86_64 File opened for reading /proc/10/comm iran.x86_64 File opened for reading /proc/36/comm iran.x86_64 File opened for reading /proc/86/comm iran.x86_64 File opened for reading /proc/677/comm iran.x86_64 File opened for reading /proc/701/comm iran.x86_64 File opened for reading /proc/1097/comm iran.x86_64 File opened for reading /proc/1172/comm iran.x86_64 File opened for reading /proc/1273/comm iran.x86_64 File opened for reading /proc/79/comm iran.x86_64 File opened for reading /proc/1530/comm iran.x86_64 File opened for reading /proc/662/comm iran.x86_64 File opened for reading /proc/723/comm iran.x86_64 File opened for reading /proc/81/comm iran.x86_64 File opened for reading /proc/162/comm iran.x86_64 File opened for reading /proc/21/comm iran.x86_64 File opened for reading /proc/169/comm iran.x86_64 File opened for reading /proc/426/comm iran.x86_64 File opened for reading /proc/472/comm iran.x86_64 File opened for reading /proc/14/comm iran.x86_64 File opened for reading /proc/80/comm iran.x86_64 File opened for reading /proc/454/comm iran.x86_64 File opened for reading /proc/1060/comm iran.x86_64