Analysis
- max time kernel
5s - max time network
30s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20260126-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system - submitted
29/04/2026, 00:46
Behavioral task
behavioral1
Sample
iran.x86_64
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral2
Sample
iran.x86_64
Resource
ubuntu2004-amd64-20260126-en
ubuntu-20.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral3
Sample
iran.x86_64
Resource
ubuntu2204-amd64-20260126-en
ubuntu-22.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral4
Sample
iran.x86_64
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
4 signatures
30 seconds
General
- Target iran.x86_64
- Size 46KB
- Sample260429-a4pbasfx9x
- SHA256 cd2ef7c104ccbc9ae0efd0f3e05fef0064f5bfd5ed8a4a912ca4e1b02cda1550
- MD5 75566ec6dd6a5ae692bc650dbe7efce4
- SHA1 2c23dfa0eeb93c31a43a2987aacf5aa2f5a19bd8
- SHA512 881380ee52e194ba35f75b9ef743507c09804b722f9725c36dd7469c925e57a5867311d0dc06beae9559cca205addd1b316574f857ced3b977868f469b7ce3d7
- SSDEEP 768:RdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b87dep43:2wkgI6YONsLsjwVwimoLzxMdei
- TLSH T1E42302FAD357F0BCC470A577064EA2DAA56A78029725270E43F231D9FE676681D023C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1588 iran.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 1588 iran.x86_64 -
description ioc Process File opened for reading /proc/82/comm iran.x86_64 File opened for reading /proc/119/comm iran.x86_64 File opened for reading /proc/188/comm iran.x86_64 File opened for reading /proc/415/comm iran.x86_64 File opened for reading /proc/993/comm iran.x86_64 File opened for reading /proc/22/comm iran.x86_64 File opened for reading /proc/174/comm iran.x86_64 File opened for reading /proc/896/comm iran.x86_64 File opened for reading /proc/1043/comm iran.x86_64 File opened for reading /proc/1097/comm iran.x86_64 File opened for reading /proc/1102/comm iran.x86_64 File opened for reading /proc/1103/comm iran.x86_64 File opened for reading /proc/1526/comm iran.x86_64 File opened for reading /proc/26/comm iran.x86_64 File opened for reading /proc/78/comm iran.x86_64 File opened for reading /proc/161/comm iran.x86_64 File opened for reading /proc/774/comm iran.x86_64 File opened for reading /proc/2/comm iran.x86_64 File opened for reading /proc/408/comm iran.x86_64 File opened for reading /proc/594/comm iran.x86_64 File opened for reading /proc/952/comm iran.x86_64 File opened for reading /proc/1391/comm iran.x86_64 File opened for reading /proc/1574/comm iran.x86_64 File opened for reading /proc/9/comm iran.x86_64 File opened for reading /proc/23/comm iran.x86_64 File opened for reading /proc/74/comm iran.x86_64 File opened for reading /proc/213/comm iran.x86_64 File opened for reading /proc/741/comm iran.x86_64 File opened for reading /proc/1094/comm iran.x86_64 File opened for reading /proc/1/comm iran.x86_64 File opened for reading /proc/7/comm iran.x86_64 File opened for reading /proc/314/comm iran.x86_64 File opened for reading /proc/1052/comm iran.x86_64 File opened for reading /proc/91/comm iran.x86_64 File opened for reading /proc/101/comm iran.x86_64 File opened for reading /proc/315/comm iran.x86_64 File opened for reading /proc/641/comm iran.x86_64 File opened for reading /proc/1099/comm iran.x86_64 File opened for reading /proc/1249/comm iran.x86_64 File opened for reading /proc/1471/comm iran.x86_64 File opened for reading /proc/96/comm iran.x86_64 File opened for reading /proc/163/comm iran.x86_64 File opened for reading /proc/614/comm iran.x86_64 File opened for reading /proc/788/comm iran.x86_64 File opened for reading /proc/799/comm iran.x86_64 File opened for reading /proc/907/comm iran.x86_64 File opened for reading /proc/76/comm iran.x86_64 File opened for reading /proc/93/comm iran.x86_64 File opened for reading /proc/162/comm iran.x86_64 File opened for reading /proc/783/comm iran.x86_64 File opened for reading /proc/1214/comm iran.x86_64 File opened for reading /proc/452/comm iran.x86_64 File opened for reading /proc/723/comm iran.x86_64 File opened for reading /proc/1079/comm iran.x86_64 File opened for reading /proc/1254/comm iran.x86_64 File opened for reading /proc/750/comm iran.x86_64 File opened for reading /proc/977/comm iran.x86_64 File opened for reading /proc/992/comm iran.x86_64 File opened for reading /proc/1013/comm iran.x86_64 File opened for reading /proc/1070/comm iran.x86_64 File opened for reading /proc/1185/comm iran.x86_64 File opened for reading /proc/81/comm iran.x86_64 File opened for reading /proc/114/comm iran.x86_64 File opened for reading /proc/504/comm iran.x86_64