Analysis
- max time kernel
29s - max time network
30s - platform
ubuntu-20.04_amd64 - resource
ubuntu2004-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20260126-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system - submitted
29/04/2026, 00:46
Behavioral task
behavioral1
Sample
iran.x86_64
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral2
Sample
iran.x86_64
Resource
ubuntu2004-amd64-20260126-en
ubuntu-20.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral3
Sample
iran.x86_64
Resource
ubuntu2204-amd64-20260126-en
ubuntu-22.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral4
Sample
iran.x86_64
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
4 signatures
30 seconds
General
- Target iran.x86_64
- Size 46KB
- Sample260429-a4pbasfx9x
- SHA256 cd2ef7c104ccbc9ae0efd0f3e05fef0064f5bfd5ed8a4a912ca4e1b02cda1550
- MD5 75566ec6dd6a5ae692bc650dbe7efce4
- SHA1 2c23dfa0eeb93c31a43a2987aacf5aa2f5a19bd8
- SHA512 881380ee52e194ba35f75b9ef743507c09804b722f9725c36dd7469c925e57a5867311d0dc06beae9559cca205addd1b316574f857ced3b977868f469b7ce3d7
- SSDEEP 768:RdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b87dep43:2wkgI6YONsLsjwVwimoLzxMdei
- TLSH T1E42302FAD357F0BCC470A577064EA2DAA56A78029725270E43F231D9FE676681D023C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1425 iran.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 1425 iran.x86_64 -
description ioc Process File opened for reading /proc/851/comm iran.x86_64 File opened for reading /proc/911/comm iran.x86_64 File opened for reading /proc/921/comm iran.x86_64 File opened for reading /proc/1220/comm iran.x86_64 File opened for reading /proc/1260/comm iran.x86_64 File opened for reading /proc/88/comm iran.x86_64 File opened for reading /proc/444/comm iran.x86_64 File opened for reading /proc/501/comm iran.x86_64 File opened for reading /proc/537/comm iran.x86_64 File opened for reading /proc/605/comm iran.x86_64 File opened for reading /proc/1088/comm iran.x86_64 File opened for reading /proc/1240/comm iran.x86_64 File opened for reading /proc/1420/comm iran.x86_64 File opened for reading /proc/4/comm iran.x86_64 File opened for reading /proc/89/comm iran.x86_64 File opened for reading /proc/174/comm iran.x86_64 File opened for reading /proc/1086/comm iran.x86_64 File opened for reading /proc/1395/comm iran.x86_64 File opened for reading /proc/11/comm iran.x86_64 File opened for reading /proc/168/comm iran.x86_64 File opened for reading /proc/264/comm iran.x86_64 File opened for reading /proc/574/comm iran.x86_64 File opened for reading /proc/634/comm iran.x86_64 File opened for reading /proc/636/comm iran.x86_64 File opened for reading /proc/1103/comm iran.x86_64 File opened for reading /proc/24/comm iran.x86_64 File opened for reading /proc/270/comm iran.x86_64 File opened for reading /proc/1358/comm iran.x86_64 File opened for reading /proc/1361/comm iran.x86_64 File opened for reading /proc/1/comm iran.x86_64 File opened for reading /proc/768/comm iran.x86_64 File opened for reading /proc/901/comm iran.x86_64 File opened for reading /proc/1364/comm iran.x86_64 File opened for reading /proc/18/comm iran.x86_64 File opened for reading /proc/19/comm iran.x86_64 File opened for reading /proc/22/comm iran.x86_64 File opened for reading /proc/74/comm iran.x86_64 File opened for reading /proc/86/comm iran.x86_64 File opened for reading /proc/452/comm iran.x86_64 File opened for reading /proc/683/comm iran.x86_64 File opened for reading /proc/955/comm iran.x86_64 File opened for reading /proc/76/comm iran.x86_64 File opened for reading /proc/395/comm iran.x86_64 File opened for reading /proc/497/comm iran.x86_64 File opened for reading /proc/570/comm iran.x86_64 File opened for reading /proc/664/comm iran.x86_64 File opened for reading /proc/16/comm iran.x86_64 File opened for reading /proc/162/comm iran.x86_64 File opened for reading /proc/169/comm iran.x86_64 File opened for reading /proc/817/comm iran.x86_64 File opened for reading /proc/1027/comm iran.x86_64 File opened for reading /proc/77/comm iran.x86_64 File opened for reading /proc/79/comm iran.x86_64 File opened for reading /proc/93/comm iran.x86_64 File opened for reading /proc/164/comm iran.x86_64 File opened for reading /proc/177/comm iran.x86_64 File opened for reading /proc/583/comm iran.x86_64 File opened for reading /proc/783/comm iran.x86_64 File opened for reading /proc/1339/comm iran.x86_64 File opened for reading /proc/7/comm iran.x86_64 File opened for reading /proc/13/comm iran.x86_64 File opened for reading /proc/15/comm iran.x86_64 File opened for reading /proc/201/comm iran.x86_64 File opened for reading /proc/496/comm iran.x86_64