Analysis
- max time kernel
1s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
17/05/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
dlr.x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
3 signatures
150 seconds
General
- Target dlr.x86_64.elf
- Size 878KB
- Sample260517-vbza1se16n
- SHA256 f634e202e41b5a2cd09477a5dae63f889b69be2d5e6f81d75e7d68957b6ee395
- MD5 89654d813e6bd79e085b4799d7129e3b
- SHA1 29c9df0a8eb2ca8291b338da1ef070bf076a3a97
- SHA512 78f11a74cee5d0d2f2fc80d825cdec35aea80ac8dc00b6756d01c8706411e116dc76514e403fd34a41456e682627736d27e42f03d987638ee273188a4d37e758
- SSDEEP 12288:OoE49Y28I3oxItNsOIS6xBAoKgIyycbm4oedFOhKnetIg:OoE4O28I4xItmOISqBQ4/FDne
- TLSH T1A8156C57B2F334FDC167C031479BCB635836F06601216DBB22C49A392D96EA11B2AF67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
ioc pid Process /tmp/x86 1497 dlr.x86_64.elf /tmp/mips 1503 dlr.x86_64.elf /tmp/mipsel 1505 dlr.x86_64.elf /tmp/armv7l 1507 dlr.x86_64.elf /tmp/armv6l 1509 dlr.x86_64.elf /tmp/armv5l 1511 dlr.x86_64.elf /tmp/i686 1513 dlr.x86_64.elf /tmp/ppc64 1515 dlr.x86_64.elf - System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1503 mips 1505 mipsel - Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/ppc64 dlr.x86_64.elf File opened for modification /tmp/x86 dlr.x86_64.elf File opened for modification /tmp/mips dlr.x86_64.elf File opened for modification /tmp/mipsel dlr.x86_64.elf File opened for modification /tmp/armv7l dlr.x86_64.elf File opened for modification /tmp/armv6l dlr.x86_64.elf File opened for modification /tmp/armv5l dlr.x86_64.elf File opened for modification /tmp/i686 dlr.x86_64.elf
Processes
-
/tmp/dlr.x86_64.elf/tmp/dlr.x86_64.elf1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1496 -
/tmp/x86x86 apexbot2⤵PID:1497
-
-
/tmp/mipsmips apexbot2⤵
- System Network Configuration Discovery
PID:1503
-
-
/tmp/mipselmipsel apexbot2⤵
- System Network Configuration Discovery
PID:1505
-
-
/tmp/armv7larmv7l apexbot2⤵PID:1507
-
-
/tmp/armv6larmv6l apexbot2⤵PID:1509
-
-
/tmp/armv5larmv5l apexbot2⤵PID:1511
-
-
/tmp/i686i686 apexbot2⤵PID:1513
-
-
/tmp/ppc64ppc64 apexbot2⤵PID:1515
-