Analysis
- max time kernel
141s - max time network
128s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
11/05/2026, 12:19
General
- Target nerv.x86_32
- Size 97KB
- Sample260511-pg85hshw91
- SHA256 853ff7d9ee6129a01fb4dd8eba9c72d73c1f118755e6fbcbd9a1b0ca341df660
- MD5 2fff7eb7de343b909f614ec15ee74fd1
- SHA1 bb7c8b7a946fefed3461ccaea7bfb4095c2c345a
- SHA512 80703893c810402beb0150baf8aac3f03993b17ac469bbf1ee0059635fbf486d7b56d182fbbc59d10e18ae6c2ea8bc78e20d20f9b9b64ba014af65ba629aa3ed
- SSDEEP 3072:ZTdeqPbQ0yhOEckEUI6An128egcTz3s6SNCoUKcnsEW+QuY3uRa:ZTFPbQ0yhOEckEUI6A12ZHTz1Kmn0jF3
- TLSH T13AA329C1F68B84F9D54B48704066F33FCE32E52A8071C96EDF99AF36DA37641921629C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Traces itself 18 IoCs
Traces itself to prevent debugging attempts
pid Process 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 1510 nerv.x86_32 - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uhttpd 1510 nerv.x86_32 Changes the process name, possibly in an attempt to hide itself httpd 1510 nerv.x86_32 - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo nerv.x86_32 -
description ioc Process File opened for reading /proc/mounts nerv.x86_32 File opened for reading /proc/self/status nerv.x86_32