b6226c3e0e4ad64bbda3e6a79eb464c7050faa25d1f5332dcac014d2e79dd87f

Resubmissions

29/04/2026, 08:27

260429-kcs6aahv2x10

10/09/2025, 16:26

250910-txj8js1wgw10

02/09/2025, 11:30

250902-nmg3jshr2z10

Analysis

user interaction
yes
max time kernel
149s
max time network
129s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
29/04/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
Size 559KB
Sample260429-kcs6aahv2x
SHA256 b6226c3e0e4ad64bbda3e6a79eb464c7050faa25d1f5332dcac014d2e79dd87f
MD5 9a4a894d17ddebf2b69c0a8c01cdb5bb
SHA1 fd8981b043381adfaed6ac4c4a625c177d343804
SHA512 ba1d50f149670c9471878a1206b93f2f9abed4974c6e40a32ef937a1e46379e01fb0fc2e8ba286feff660ed2e973593a58f27fe35b16d937857cefa847277efb
SSDEEP 12288:JRXnFrOAr93lwkp+5E2tCfGKi4CK2oJV6V4:/BOAr91wkp+59uZlJ23
TLSH
T129C45B07B7A264BDC592C970876BD572BD35B494112778BB3650EE303E26E305F2EE22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	thermald	2026	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/if_inet6	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2026/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/3/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/43/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/65/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1488/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/2034/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/2/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/17/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/26/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/34/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1105/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1319/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1448/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1667/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/36/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/129/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1051/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1079/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1425/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1730/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1782/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1820/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/50/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/135/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/512/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1506/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/24/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/142/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1490/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1741/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1867/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/stat	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/6/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/11/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/25/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/40/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/46/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1411/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1466/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/72/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/81/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/132/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1069/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1260/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1493/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1501/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1528/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/21/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/52/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/54/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/140/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/276/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1504/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1803/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/63/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/134/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/196/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/258/fd	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1376/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1436/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1485/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
File opened for reading	/proc/1748/cmdline	a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008

System Network Configuration Discovery 1 TTPs 14 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
2076	sh
2039	sh
2042	sh
2045	sh
2053	sh
2055	sh
2058	sh
2064	sh
2067	sh
2048	sh
2054	sh
2061	sh
2070	sh
2073	sh

/tmp/a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
/tmp/a4abba8f34698725954be5c28486c1e756e896586ceddfea23ce198241bb6008
1⤵
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:2026
- /bin/sh
  sh -c "iptables -t nat --line-number -nL PREROUTING | grep dpt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2039
- - /usr/bin/grep
    grep dpt:38717
    3⤵
    PID:2041
- /bin/sh
  sh -c "iptables --line-number -nL INPUT | grep dpt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2042
- - /usr/bin/grep
    grep dpt:38717
    3⤵
    PID:2044
- /bin/sh
  sh -c "iptables --line-number -nL OUTPUT | grep spt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2045
- - /usr/bin/grep
    grep spt:38717
    3⤵
    PID:2047
- /bin/sh
  sh -c "iptables -t nat --line-number -nL POSTROUTING | grep spt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2048
- - /usr/bin/grep
    grep spt:38717
    3⤵
    PID:2050
- /bin/sh
  sh -c "iptables -t nat -I PREROUTING -p tcp --dport 38717 -j ACCEPT"
  2⤵
  PID:2051
- /bin/sh
  sh -c "iptables -I INPUT -p tcp --dport 38717 -j ACCEPT"
  2⤵
  PID:2052
- /bin/sh
  sh -c "iptables -I OUTPUT -p tcp --sport 38717 -j ACCEPT"
  2⤵
  - System Network Configuration Discovery
  PID:2053
- /bin/sh
  sh -c "iptables -t nat -I POSTROUTING -p tcp --sport 38717 -j ACCEPT"
  2⤵
  - System Network Configuration Discovery
  PID:2054
- /bin/sh
  sh -c "iptables -t nat --line-number -nL PREROUTING | grep dpt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2055
- - /usr/bin/grep
    grep dpt:38717
    3⤵
    - Reads runtime system information
    PID:2057
- /bin/sh
  sh -c "iptables --line-number -nL INPUT | grep dpt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2058
- - /usr/bin/grep
    grep dpt:38717
    3⤵
    PID:2060
- /bin/sh
  sh -c "iptables --line-number -nL OUTPUT | grep spt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2061
- - /usr/bin/grep
    grep spt:38717
    3⤵
    PID:2063
- /bin/sh
  sh -c "iptables -t nat --line-number -nL POSTROUTING | grep spt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2064
- - /usr/bin/grep
    grep spt:38717
    3⤵
    PID:2066
- /bin/sh
  sh -c "iptables -t nat --line-number -nL PREROUTING | grep dpt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2067
- - /usr/bin/grep
    grep dpt:38717
    3⤵
    - Reads runtime system information
    PID:2069
- /bin/sh
  sh -c "iptables --line-number -nL INPUT | grep dpt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2070
- - /usr/bin/grep
    grep dpt:38717
    3⤵
    PID:2072
- /bin/sh
  sh -c "iptables --line-number -nL OUTPUT | grep spt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2073
- - /usr/bin/grep
    grep spt:38717
    3⤵
    PID:2075
- /bin/sh
  sh -c "iptables -t nat --line-number -nL POSTROUTING | grep spt:38717"
  2⤵
  - System Network Configuration Discovery
  PID:2076
- - /usr/bin/grep
    grep spt:38717
    3⤵
    PID:2078

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads