Overview
overview
7Static
static
3Class of '...32.exe
windows10-2004-x64
3Class of '...32.exe
windows11-21h2-x64
3Class of '...09.exe
windows10-2004-x64
1Class of '...09.exe
windows11-21h2-x64
1Class of '..._09.py
ubuntu-18.04-amd64
3Class of '..._09.py
debian-9-armhf
3Class of '..._09.py
debian-9-mips
3Class of '..._09.py
debian-9-mipsel
3Class of '..._09.sh
ubuntu-18.04-amd64
1Class of '..._09.sh
debian-9-armhf
1Class of '..._09.sh
debian-9-mips
1Class of '..._09.sh
debian-9-mipsel
1Class of '...09.lnk
windows10-2004-x64
7Class of '...09.lnk
windows11-21h2-x64
3Class of '...hon.so
ubuntu-18.04-amd64
1Class of '...python
ubuntu-18.04-amd64
Class of '...ythonw
ubuntu-18.04-amd64
Class of '.../zsync
ubuntu-18.04-amd64
Class of '...ncmake
ubuntu-18.04-amd64
Class of '..._Of_09
ubuntu-18.04-amd64
4Class of '...hon.so
ubuntu-18.04-amd64
1Class of '...python
ubuntu-18.04-amd64
3Class of '...ythonw
ubuntu-18.04-amd64
3Class of '.../zsync
ubuntu-18.04-amd64
1Class of '...ncmake
ubuntu-18.04-amd64
1Class of '...47.dll
windows10-2004-x64
3Class of '...GL.dll
windows10-2004-x64
3Class of '...GL.dll
windows11-21h2-x64
3Class of '...v2.dll
windows10-2004-x64
3Class of '...v2.dll
windows11-21h2-x64
3Class of '...-1.dll
windows10-2004-x64
3Class of '...-1.dll
windows11-21h2-x64
3Analysis
- max time kernel
1s - platform
debian-9_armhf - resource
debian9-armhf-20260126-en - resource tags
arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
05/05/2026, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
Class of '09/Class_Of_09-32.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Class of '09/Class_Of_09-32.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
Class of '09/Class_Of_09.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Class of '09/Class_Of_09.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
Class of '09/Class_Of_09.py
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
Class of '09/Class_Of_09.py
Resource
debian9-armhf-20260126-en
debian-9-armhf
Behavioral task
behavioral7
Sample
Class of '09/Class_Of_09.py
Resource
debian9-mipsbe-20260127-en
debian-9-mips
Behavioral task
behavioral8
Sample
Class of '09/Class_Of_09.py
Resource
debian9-mipsel-20260126-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
Class of '09/Class_Of_09.sh
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
Class of '09/Class_Of_09.sh
Resource
debian9-armhf-20260127-en
debian-9-armhf
Behavioral task
behavioral11
Sample
Class of '09/Class_Of_09.sh
Resource
debian9-mipsbe-20260126-en
debian-9-mips
Behavioral task
behavioral12
Sample
Class of '09/Class_Of_09.sh
Resource
debian9-mipsel-20260126-en
debian-9-mipsel
Behavioral task
behavioral13
Sample
Class of '09/Launch Class of '09.lnk
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Class of '09/Launch Class of '09.lnk
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
Class of '09/lib/py2-linux-i686/librenpython.so
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
Class of '09/lib/py2-linux-i686/python
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral17
Sample
Class of '09/lib/py2-linux-i686/pythonw
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral18
Sample
Class of '09/lib/py2-linux-i686/zsync
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
Class of '09/lib/py2-linux-i686/zsyncmake
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
Class of '09/lib/py2-linux-x86_64/Class_Of_09
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral21
Sample
Class of '09/lib/py2-linux-x86_64/librenpython.so
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
Class of '09/lib/py2-linux-x86_64/python
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
Class of '09/lib/py2-linux-x86_64/pythonw
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
Class of '09/lib/py2-linux-x86_64/zsync
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
Behavioral task
behavioral25
Sample
Class of '09/lib/py2-linux-x86_64/zsyncmake
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
Behavioral task
behavioral26
Sample
Class of '09/lib/py2-windows-i686/d3dcompiler_47.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Class of '09/lib/py2-windows-i686/libEGL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Class of '09/lib/py2-windows-i686/libEGL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
Class of '09/lib/py2-windows-i686/libGLESv2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Class of '09/lib/py2-windows-i686/libGLESv2.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
Class of '09/lib/py2-windows-i686/libgcc_s_dw2-1.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Class of '09/lib/py2-windows-i686/libgcc_s_dw2-1.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target Class of '09/Class_Of_09.py
- Size 7KB
- Sample260505-e4ppaagv3t
- SHA256 6af25cf47b94af38a4d4d1ea20e48851b2a8f9e557455a3eab439c5e588831bf
- MD5 dc9e4c67d1d604eded98541cd1e57d49
- SHA1 948a2ae98b195e08e779b31fdc464a69ee98fe0d
- SHA512 d61f02f88298aaf85fbd9ace2585c4ab774e783b4629c3fd2ae15559b9d523a0e80cc9dbe2b9d517081a59f85bf53aac44d165ed90c6f63f9bdd292afb42d2e1
- SSDEEP 192:7q1dwQHjiJqdt2RqEq3ghhKBqMAx45KB/U/osX3qwkF0eW281ri:7rKiwdtzvQhhVMA2KNw9XaqeWnk
- TLSH T1ADF1B75775D5269183136B98D986F0882326E4E73EAF25783ADC73543FA181043F36AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/Class of '09/renpy/__init__.pyc python
Processes
-
/tmp/Class of '09/Class_Of_09.py"/tmp/Class of '09/Class_Of_09.py"1⤵PID:768
-
/usr/local/sbin/pythonpython "/tmp/Class of '09/Class_Of_09.py"1⤵PID:768
-
/usr/local/bin/pythonpython "/tmp/Class of '09/Class_Of_09.py"1⤵PID:768
-
/usr/sbin/pythonpython "/tmp/Class of '09/Class_Of_09.py"1⤵PID:768
-
/usr/bin/pythonpython "/tmp/Class of '09/Class_Of_09.py"1⤵
- Writes file to tmp directory
PID:768