Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
16/05/2026, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
apex3.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target apex3.bin
- Size 6.9MB
- Sample260516-rl82eshz6l
- SHA256 dfe708e560b26a38d6f633e4faadcd86cf387456f5e2d3753b1ccdf946d3291d
- MD5 9caf86ae923db92ef657275aaff52d08
- SHA1 55b16183d78879cf04e57674490d3566442e35f4
- SHA512 aea8366e549bfb052ca28d9f9f1d41ae1a856877577ade273124752e8a15fde2a0301b07c4151f51796e30dda3251a7b3a6e5e6bde6d6bdfe0c50fa21d191eb6
- SSDEEP 49152:ZDcg444mBP+v3bUbRSkJiZu50cwOXT2VDDD4EvEuN2SD8LJ+WUGQEl/mCLpK5ELf:d+4vq3QbRSP9ODiDoEv3mvg7ELf
- TLSH T15B762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/bin/dbus-daemon 1492 apex3.bin - Enumerates kernel/hardware configuration 1 TTPs 6 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us apex3.bin File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size apex3.bin File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us apex3.bin File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us apex3.bin File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size apex3.bin File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us apex3.bin -
description ioc Process File opened for reading /proc/1481/stat apex3.bin File opened for reading /proc/171/stat apex3.bin File opened for reading /proc/175/stat apex3.bin File opened for reading /proc/18/stat apex3.bin File opened for reading /proc/9/stat apex3.bin File opened for reading /proc/self/mountinfo apex3.bin File opened for reading /proc/30/stat apex3.bin File opened for reading /proc/31/environ apex3.bin File opened for reading /proc/79/stat apex3.bin File opened for reading /proc/16/environ apex3.bin File opened for reading /proc/25/environ apex3.bin File opened for reading /proc/81/environ apex3.bin File opened for reading /proc/169/environ apex3.bin File opened for reading /proc/21/environ apex3.bin File opened for reading /proc/80/environ apex3.bin File opened for reading /proc/98/stat apex3.bin File opened for reading /proc/137/stat apex3.bin File opened for reading /proc/163/stat apex3.bin File opened for reading /proc/84/environ apex3.bin File opened for reading /proc/12/environ apex3.bin File opened for reading /proc/160/environ apex3.bin File opened for reading /proc/166/stat apex3.bin File opened for reading /proc/78/stat apex3.bin File opened for reading /proc/115/environ apex3.bin File opened for reading /proc/1475/environ apex3.bin File opened for reading /proc/174/environ apex3.bin File opened for reading /proc/29/stat apex3.bin File opened for reading /proc/20/stat apex3.bin File opened for reading /proc/80/stat apex3.bin File opened for reading /proc/84/stat apex3.bin File opened for reading /proc/89/environ apex3.bin File opened for reading /proc/11/stat apex3.bin File opened for reading /proc/166/environ apex3.bin File opened for reading /proc/137/environ apex3.bin File opened for reading /proc/162/stat apex3.bin File opened for reading /proc/17/environ apex3.bin File opened for reading /proc/174/stat apex3.bin File opened for reading /proc/19/stat apex3.bin File opened for reading /proc/24/environ apex3.bin File opened for reading /proc/86/environ apex3.bin File opened for reading /proc/171/environ apex3.bin File opened for reading /proc/22/environ apex3.bin File opened for reading /proc/24/stat apex3.bin File opened for reading /proc/34/environ apex3.bin File opened for reading /proc/34/stat apex3.bin File opened for reading /proc/115/stat apex3.bin File opened for reading /proc/1475/stat apex3.bin File opened for reading /proc/167/environ apex3.bin File opened for reading /proc/7/environ apex3.bin File opened for reading /proc/16/stat apex3.bin File opened for reading /proc/161/environ apex3.bin File opened for reading /proc/162/environ apex3.bin File opened for reading /proc/176/environ apex3.bin File opened for reading /proc/78/environ apex3.bin File opened for reading /proc/10/stat apex3.bin File opened for reading /proc/165/environ apex3.bin File opened for reading /proc/176/stat apex3.bin File opened for reading /proc/89/stat apex3.bin File opened for reading /proc/159/environ apex3.bin File opened for reading /proc/163/environ apex3.bin File opened for reading /proc/164/stat apex3.bin File opened for reading /proc/172/environ apex3.bin File opened for reading /proc/173/environ apex3.bin File opened for reading /proc/27/environ apex3.bin