Analysis
- max time kernel
140s - max time network
141s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
11/05/2026, 15:36
General
- Target manji.x86.elf
- Size 77KB
- Sample260511-s2d2nadw3x
- SHA256 5d34563214fab084c451dd3515bc5dfab160c2b65464fb256b8161a9efbb190c
- MD5 c175467725b2725de77879b91efe9b8f
- SHA1 cb70922b7a429e5d749f6d2e7ae8fb4d3557339c
- SHA512 d841834486c1b56a5f61fe9158ba1e5522d2f97a2efca8460916ee970e1bbe547ef038eaff7cfc2c345ac1265a9e2c633fd2298b53569bb9136cbecfcd58c015
- SSDEEP 1536:p6XTc4odpF3ZrzCN9g52lcM1QLL/3rhOvPJbWlNjPz79XoT6:EX4FdpBZrWo2lpgL/3AvPJyHPF1
- TLSH T1227309C2BA43DFB3E45761F411B79B364A32FD3A183AC686E774FCA199115C0A11636C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Traces itself 19 IoCs
Traces itself to prevent debugging attempts
pid Process 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf 1522 manji.x86.elf - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself uhttpd 1522 manji.x86.elf Changes the process name, possibly in an attempt to hide itself kthreadd 1522 manji.x86.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo manji.x86.elf -
description ioc Process File opened for reading /proc/mounts manji.x86.elf File opened for reading /proc/self/status manji.x86.elf