Analysis
- max time kernel
2s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260127-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/05/2026, 18:15
Behavioral task
behavioral1
Sample
cf30bc39e6ff51de9815492c5d87f98e651e6fdee9adad2a5f52d42d167d6d2e.bin
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
- Target cf30bc39e6ff51de9815492c5d87f98e651e6fdee9adad2a5f52d42d167d6d2e.bin
- Size 1.7MB
- Sample260503-wweb1sfs8v
- SHA256 cf30bc39e6ff51de9815492c5d87f98e651e6fdee9adad2a5f52d42d167d6d2e
- MD5 b2a9e6d1633f474290835b2a69caabd9
- SHA1 b2550c5db3cd5fab422dc93c5e49420a48475174
- SHA512 c9c225e0f6fce131b4e95f80c06292bdbd7d6b6d91180d03d7a32e54bdd3801628b01891af7f28983920713174c261beb1cedfbba0b5e74ff94a158632784d46
- SSDEEP 49152:4zz0kLxqODTzktEbD3ApvtnM+YUANiDojF3pjUtBH:kwk9Fz4EPApvtnNgie3tUtF
- TLSH T1298533EFE12637E0AC4DD95C531D1BE4810209979DEEA06F5E9CC0C2867AAF9F432647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/137/status pgrep File opened for reading /proc/470/status pgrep File opened for reading /proc/1348/cmdline pgrep File opened for reading /proc/1261/cmdline pidof File opened for reading /proc/86/cmdline pgrep File opened for reading /proc/182/cmdline pgrep File opened for reading /proc/458/status pgrep File opened for reading /proc/935/status pgrep File opened for reading /proc/1034/status pgrep File opened for reading /proc/513/stat pidof File opened for reading /proc/1102/cmdline pidof File opened for reading /proc/1321/cmdline pidof File opened for reading /proc/20/cmdline pgrep File opened for reading /proc/1102/cmdline pgrep File opened for reading /proc/185/stat pidof File opened for reading /proc/1573/stat pidof File opened for reading /proc/1581/cmdline pidof File opened for reading /proc/670/status pgrep File opened for reading /proc/918/cmdline pgrep File opened for reading /proc/32/cmdline pidof File opened for reading /proc/35/stat pidof File opened for reading /proc/180/stat pidof File opened for reading /proc/186/cmdline pidof File opened for reading /proc/81/status pgrep File opened for reading /proc/176/cmdline pgrep File opened for reading /proc/1025/status pgrep File opened for reading /proc/322/cmdline pidof File opened for reading /proc/675/stat pidof File opened for reading /proc/913/cmdline pidof File opened for reading /proc/1002/stat pidof File opened for reading /proc/25/status pgrep File opened for reading /proc/31/cmdline pgrep File opened for reading /proc/184/status pgrep File opened for reading /proc/1266/cmdline pgrep File opened for reading /proc/555/cmdline pidof File opened for reading /proc/1067/cmdline pidof File opened for reading /proc/172/status pgrep File opened for reading /proc/1104/status pgrep File opened for reading /proc/3/cmdline pidof File opened for reading /proc/7/cmdline pidof File opened for reading /proc/701/cmdline pidof File opened for reading /proc/978/cmdline pidof File opened for reading /proc/1064/cmdline pidof File opened for reading /proc/83/status pgrep File opened for reading /proc/960/status pgrep File opened for reading /proc/1100/status pgrep File opened for reading /proc/9/stat pidof File opened for reading /proc/89/stat pidof File opened for reading /proc/588/cmdline pidof File opened for reading /proc/1026/cmdline pidof File opened for reading /proc/1567/stat pidof File opened for reading /proc/1100/cmdline pgrep File opened for reading /proc/1205/cmdline pgrep File opened for reading /proc/1/stat pidof File opened for reading /proc/8/stat pidof File opened for reading /proc/34/stat pidof File opened for reading /proc/181/stat pidof File opened for reading /proc/980/cmdline pidof File opened for reading /proc/1059/stat pidof File opened for reading /proc/280/status pgrep File opened for reading /proc/954/status pgrep File opened for reading /proc/1060/cmdline pidof File opened for reading /proc/1079/stat pidof
Processes
-
/tmp/cf30bc39e6ff51de9815492c5d87f98e651e6fdee9adad2a5f52d42d167d6d2e.bin/tmp/cf30bc39e6ff51de9815492c5d87f98e651e6fdee9adad2a5f52d42d167d6d2e.bin1⤵PID:1570
-
/bin/shsh -c "pgrep netwalker"2⤵PID:1573
-
/usr/bin/pgreppgrep netwalker3⤵
- Reads CPU attributes
- Reads runtime system information
PID:1574
-
-
-
/bin/shsh -c "pidof netwalker"2⤵PID:1580
-
/bin/pidofpidof netwalker3⤵
- Reads runtime system information
PID:1581
-
-
-
/bin/shsh -c "rm *.cpass"2⤵PID:1583
-
/bin/rmrm "*.cpass"3⤵PID:1584
-
-