Overview
overview
7Static
static
3Class of '...32.exe
windows10-2004-x64
3Class of '...32.exe
windows11-21h2-x64
3Class of '...09.exe
windows10-2004-x64
1Class of '...09.exe
windows11-21h2-x64
1Class of '..._09.py
ubuntu-18.04-amd64
3Class of '..._09.py
debian-9-armhf
3Class of '..._09.py
debian-9-mips
3Class of '..._09.py
debian-9-mipsel
3Class of '..._09.sh
ubuntu-18.04-amd64
1Class of '..._09.sh
debian-9-armhf
1Class of '..._09.sh
debian-9-mips
1Class of '..._09.sh
debian-9-mipsel
1Class of '...09.lnk
windows10-2004-x64
7Class of '...09.lnk
windows11-21h2-x64
3Class of '...hon.so
ubuntu-18.04-amd64
1Class of '...python
ubuntu-18.04-amd64
Class of '...ythonw
ubuntu-18.04-amd64
Class of '.../zsync
ubuntu-18.04-amd64
Class of '...ncmake
ubuntu-18.04-amd64
Class of '..._Of_09
ubuntu-18.04-amd64
4Class of '...hon.so
ubuntu-18.04-amd64
1Class of '...python
ubuntu-18.04-amd64
3Class of '...ythonw
ubuntu-18.04-amd64
3Class of '.../zsync
ubuntu-18.04-amd64
1Class of '...ncmake
ubuntu-18.04-amd64
1Class of '...47.dll
windows10-2004-x64
3Class of '...GL.dll
windows10-2004-x64
3Class of '...GL.dll
windows11-21h2-x64
3Class of '...v2.dll
windows10-2004-x64
3Class of '...v2.dll
windows11-21h2-x64
3Class of '...-1.dll
windows10-2004-x64
3Class of '...-1.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
7s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
05/05/2026, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
Class of '09/Class_Of_09-32.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Class of '09/Class_Of_09-32.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Class of '09/Class_Of_09.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Class of '09/Class_Of_09.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Class of '09/Class_Of_09.py
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
Class of '09/Class_Of_09.py
Resource
debian9-armhf-20260126-en
debian-9-armhf
Behavioral task
behavioral7
Sample
Class of '09/Class_Of_09.py
Resource
debian9-mipsbe-20260127-en
debian-9-mips
Behavioral task
behavioral8
Sample
Class of '09/Class_Of_09.py
Resource
debian9-mipsel-20260126-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
Class of '09/Class_Of_09.sh
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
Class of '09/Class_Of_09.sh
Resource
debian9-armhf-20260127-en
debian-9-armhf
Behavioral task
behavioral11
Sample
Class of '09/Class_Of_09.sh
Resource
debian9-mipsbe-20260126-en
debian-9-mips
Behavioral task
behavioral12
Sample
Class of '09/Class_Of_09.sh
Resource
debian9-mipsel-20260126-en
debian-9-mipsel
Behavioral task
behavioral13
Sample
Class of '09/Launch Class of '09.lnk
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Class of '09/Launch Class of '09.lnk
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
Class of '09/lib/py2-linux-i686/librenpython.so
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
Class of '09/lib/py2-linux-i686/python
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral17
Sample
Class of '09/lib/py2-linux-i686/pythonw
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral18
Sample
Class of '09/lib/py2-linux-i686/zsync
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
Class of '09/lib/py2-linux-i686/zsyncmake
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
Class of '09/lib/py2-linux-x86_64/Class_Of_09
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral21
Sample
Class of '09/lib/py2-linux-x86_64/librenpython.so
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
Class of '09/lib/py2-linux-x86_64/python
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
Class of '09/lib/py2-linux-x86_64/pythonw
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
Class of '09/lib/py2-linux-x86_64/zsync
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
Behavioral task
behavioral25
Sample
Class of '09/lib/py2-linux-x86_64/zsyncmake
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
Class of '09/lib/py2-windows-i686/d3dcompiler_47.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Class of '09/lib/py2-windows-i686/libEGL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Class of '09/lib/py2-windows-i686/libEGL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
Class of '09/lib/py2-windows-i686/libGLESv2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Class of '09/lib/py2-windows-i686/libGLESv2.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
Class of '09/lib/py2-windows-i686/libgcc_s_dw2-1.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Class of '09/lib/py2-windows-i686/libgcc_s_dw2-1.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target Class of '09/lib/py2-linux-x86_64/Class_Of_09
- Size 14KB
- Sample260505-e4ppaagv3t
- SHA256 d934148d84b35fb456bf09a8c21e7a866c40cbf5d32a77f29e16235c9541d450
- MD5 c232074c09dc05649abcbd9ed5554b5c
- SHA1 6557db1864012bd52038f7f59d6ee8d8958ab1d4
- SHA512 a3691c62359ab0756a1dfdfe1a4c233d31d0c72f2a8dd05c468ec8f21ff8e7694ddf4b312fec7c9b228f066229cbb484c0730d6c7b12ddba3b09b68dcb175bf9
- SSDEEP 96:Gn4CTXyfEsCvmoQ5032aIkeWiMREkqiV7bq9a:Gb7sEsCvm+3/fibkqi5
- TLSH T184520103E7A5C96FD96C577890D34779B2B7987443E207232615B2301E533852F6BDC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself SDLHotplugALSA 1511 Class_Of_09 Changes the process name, possibly in an attempt to hide itself SDLTimer 1514 Class_Of_09 - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo Class_Of_09 - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online Class_Of_09 - Enumerates kernel/hardware configuration 1 TTPs 30 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus Class_Of_09 File opened for reading /sys/devices/platform/i8042/serio1/input/input3/uevent Class_Of_09 File opened for reading /sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input0/uevent Class_Of_09 File opened for reading /sys/class/hidraw Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/hidraw/hidraw0/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/uevent Class_Of_09 File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/product Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent Class_Of_09 File opened for reading /sys/devices/virtual/input/mice/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4/uevent Class_Of_09 File opened for reading /sys/devices/platform/i8042/serio1/input/input3/mouse1/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/manufacturer Class_Of_09 File opened for reading /sys/class/input Class_Of_09 File opened for reading /sys/devices/platform/i8042/serio0/input/input1/event1/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4/mouse0/uevent Class_Of_09 File opened for reading /sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input0/event0/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/bcdDevice Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/bInterfaceNumber Class_Of_09 File opened for reading /sys/class Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4/event2/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor Class_Of_09 File opened for reading /sys/devices/platform/i8042/serio1/input/input3/event3/uevent Class_Of_09 File opened for reading /sys/devices/platform/i8042/serio0/input/input1/uevent Class_Of_09 File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4/js0/uevent Class_Of_09 -
description ioc Process File opened for reading /proc/1497/maps Class_Of_09 File opened for reading /proc/1510/status dbus-daemon File opened for reading /proc/1510/attr/current dbus-daemon File opened for reading /proc/1497/cmdline dbus-daemon File opened for reading /proc/self/fd Class_Of_09 File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/sys/vm/overcommit_memory Class_Of_09 - Writes file to tmp directory 64 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Class of '09/renpy/config.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/game.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/translation/__init__.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/minigame.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/ui.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/sl2/slparser.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/revertable.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/ast.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/savelocation.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/imagelike.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/joystick.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/warp.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/test/testmouse.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/translation/dialogue.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/audio/ioshw.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/compat/fixes.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/__init__.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/loader.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/text/text.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/image.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/predict.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/gl2/gl2shadercache.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/pgrender.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/text/__init__.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/parser.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/video.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/audio/audio.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/audio/sound.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/minstore.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/test/testkey.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/color.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/presplash.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/audio/androidhw.pyo Class_Of_09 File opened for modification /tmp/GZZ5Fn Class_Of_09 File opened for modification /tmp/Class of '09/renpy/sl2/__init__.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/memory.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/test/testfocus.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/scale.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/swdraw.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/text/font.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/screenlang.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/arguments.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/module.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/test/testexecution.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/main.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/compat/__init__.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/easy.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/sl2/sldisplayables.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/editor.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/object.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/loadsave.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/translation/generation.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/core.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/viewport.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/transform.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/error.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/persistent.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/motion.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/im.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/display/gesture.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/vc_version.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/scriptedit.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/preferences.pyo Class_Of_09 File opened for modification /tmp/Class of '09/renpy/translation/extract.pyo Class_Of_09
Processes
-
/tmp/Class of '09/lib/py2-linux-x86_64/Class_Of_09"/tmp/Class of '09/lib/py2-linux-x86_64/Class_Of_09"1⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1497 -
/bin/shsh -c "uname -p 2> /dev/null"2⤵PID:1498
-
/bin/unameuname -p3⤵PID:1499
-
-
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr2⤵PID:1506
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1508
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.renpy/Class_Of_09-1594772489/text.txt
- Size 5B
- SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
- MD5 f4020e91252aafd4b18d8acd17f883db
- SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
- SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
- MD5 SHA1 SHA512
- Path /tmp/CEndHU
- Size 4B
- SHA256 f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2
- MD5 3f1d1d8d87177d3d8d897d7e421f84d6
- SHA1 dd082d742a5cb751290f1db2bd519c286aa86d95
- SHA512 2ae2b3936f31756332ca7a4b877d18f3fcc50e41e9472b5cd45a70bea82e29a0fa956ee6a9ee0e02f23d9db56b41d19cb51d88aac06e9c923a820a21023752a9
- MD5 SHA1 SHA512
- Path /tmp/GZZ5Fn
- Size 4KB
- SHA256 b19c0fada10195aac191b8ea7207f35ab662fb2f3e6c69899fb5b3505d450238
- MD5 41c8f4e081ecf3b854907ef3e7853a4e
- SHA1 d80a2491169b82e6bf1b1197038f9410d6936d01
- SHA512 8a52eb527436626b99347999f7eb8813e3c18e23b64ae9f5c24dce63e9ff8d7a096db8422b3b81bbed8bd72adc7ddb3f923106f2cdec4e9dec280b3e4e9ae910
- TLSH T137810302BBCBA00F800BC4CB504F0EEAE93A201100032C0E688CB00C048A828CFA0E00
- MD5 SHA1 SHA512 TLSH