Analysis
- max time kernel
29s - max time network
30s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
29/04/2026, 00:46
Behavioral task
behavioral1
Sample
iran.x86_64
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral2
Sample
iran.x86_64
Resource
ubuntu2004-amd64-20260126-en
ubuntu-20.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral3
Sample
iran.x86_64
Resource
ubuntu2204-amd64-20260126-en
ubuntu-22.04-amd64
4 signatures
30 seconds
Behavioral task
behavioral4
Sample
iran.x86_64
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
4 signatures
30 seconds
General
- Target iran.x86_64
- Size 46KB
- Sample260429-a4pbasfx9x
- SHA256 cd2ef7c104ccbc9ae0efd0f3e05fef0064f5bfd5ed8a4a912ca4e1b02cda1550
- MD5 75566ec6dd6a5ae692bc650dbe7efce4
- SHA1 2c23dfa0eeb93c31a43a2987aacf5aa2f5a19bd8
- SHA512 881380ee52e194ba35f75b9ef743507c09804b722f9725c36dd7469c925e57a5867311d0dc06beae9559cca205addd1b316574f857ced3b977868f469b7ce3d7
- SSDEEP 768:RdGwNYm3GJyOvAZhON6YONKVLQi0jytVwLRZ+v84GZ2S0Jz1b87dep43:2wkgI6YONsLsjwVwimoLzxMdei
- TLSH T1E42302FAD357F0BCC470A577064EA2DAA56A78029725270E43F231D9FE676681D023C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2036 iran.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 2036 iran.x86_64 -
description ioc Process File opened for reading /proc/1571/comm iran.x86_64 File opened for reading /proc/11/comm iran.x86_64 File opened for reading /proc/24/comm iran.x86_64 File opened for reading /proc/1465/comm iran.x86_64 File opened for reading /proc/956/comm iran.x86_64 File opened for reading /proc/1818/comm iran.x86_64 File opened for reading /proc/49/comm iran.x86_64 File opened for reading /proc/71/comm iran.x86_64 File opened for reading /proc/139/comm iran.x86_64 File opened for reading /proc/163/comm iran.x86_64 File opened for reading /proc/862/comm iran.x86_64 File opened for reading /proc/1479/comm iran.x86_64 File opened for reading /proc/1558/comm iran.x86_64 File opened for reading /proc/20/comm iran.x86_64 File opened for reading /proc/26/comm iran.x86_64 File opened for reading /proc/508/comm iran.x86_64 File opened for reading /proc/1045/comm iran.x86_64 File opened for reading /proc/1651/comm iran.x86_64 File opened for reading /proc/1950/comm iran.x86_64 File opened for reading /proc/5/comm iran.x86_64 File opened for reading /proc/36/comm iran.x86_64 File opened for reading /proc/57/comm iran.x86_64 File opened for reading /proc/124/comm iran.x86_64 File opened for reading /proc/995/comm iran.x86_64 File opened for reading /proc/1483/comm iran.x86_64 File opened for reading /proc/1688/comm iran.x86_64 File opened for reading /proc/39/comm iran.x86_64 File opened for reading /proc/42/comm iran.x86_64 File opened for reading /proc/70/comm iran.x86_64 File opened for reading /proc/137/comm iran.x86_64 File opened for reading /proc/417/comm iran.x86_64 File opened for reading /proc/1378/comm iran.x86_64 File opened for reading /proc/25/comm iran.x86_64 File opened for reading /proc/44/comm iran.x86_64 File opened for reading /proc/63/comm iran.x86_64 File opened for reading /proc/143/comm iran.x86_64 File opened for reading /proc/581/comm iran.x86_64 File opened for reading /proc/1661/comm iran.x86_64 File opened for reading /proc/1970/comm iran.x86_64 File opened for reading /proc/2031/comm iran.x86_64 File opened for reading /proc/52/comm iran.x86_64 File opened for reading /proc/65/comm iran.x86_64 File opened for reading /proc/80/comm iran.x86_64 File opened for reading /proc/125/comm iran.x86_64 File opened for reading /proc/389/comm iran.x86_64 File opened for reading /proc/771/comm iran.x86_64 File opened for reading /proc/1032/comm iran.x86_64 File opened for reading /proc/1469/comm iran.x86_64 File opened for reading /proc/7/comm iran.x86_64 File opened for reading /proc/31/comm iran.x86_64 File opened for reading /proc/38/comm iran.x86_64 File opened for reading /proc/430/comm iran.x86_64 File opened for reading /proc/1457/comm iran.x86_64 File opened for reading /proc/1478/comm iran.x86_64 File opened for reading /proc/1726/comm iran.x86_64 File opened for reading /proc/33/comm iran.x86_64 File opened for reading /proc/437/comm iran.x86_64 File opened for reading /proc/1008/comm iran.x86_64 File opened for reading /proc/1475/comm iran.x86_64 File opened for reading /proc/22/comm iran.x86_64 File opened for reading /proc/27/comm iran.x86_64 File opened for reading /proc/34/comm iran.x86_64 File opened for reading /proc/132/comm iran.x86_64 File opened for reading /proc/141/comm iran.x86_64