Analysis
- max time kernel
144s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/05/2026, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
iran.x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target iran.x86_64.elf
- Size 120KB
- Sample260522-j1sc8aax2s
- SHA256 3980c142848c11d0ee84921baed3674d7c8a28dea890291628387d4fefd229b2
- MD5 c1d18db0bda7a1f45f2e811e8344a6be
- SHA1 4804ee642829b920caff76b1ca4e153506b673be
- SHA512 0635ee74f7b5dccd2415f4a6055d32218eab444027b0769c9e1bdf62f9cf4ff0d61070cc70b85540a4379a9cc58d443f56b5846629ad3df0812ced17404c2d2a
- SSDEEP 1536:UTAFOGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK33W:U8FOSmviqS1Bs0+Nd6lAqktNMxSNbmG
- TLSH T124C35C1775D180FDC8DAC1B49FEAE226EA33B4295138B21E27C86A671F4DE205F5D620
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1490 iran.x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 1490 iran.x86_64.elf -
description ioc Process File opened for reading /proc/23/comm iran.x86_64.elf File opened for reading /proc/115/comm iran.x86_64.elf File opened for reading /proc/177/comm iran.x86_64.elf File opened for reading /proc/240/comm iran.x86_64.elf File opened for reading /proc/475/comm iran.x86_64.elf File opened for reading /proc/997/comm iran.x86_64.elf File opened for reading /proc/1020/comm iran.x86_64.elf File opened for reading /proc/25/comm iran.x86_64.elf File opened for reading /proc/941/comm iran.x86_64.elf File opened for reading /proc/31/comm iran.x86_64.elf File opened for reading /proc/547/comm iran.x86_64.elf File opened for reading /proc/555/comm iran.x86_64.elf File opened for reading /proc/1045/comm iran.x86_64.elf File opened for reading /proc/1050/comm iran.x86_64.elf File opened for reading /proc/3/comm iran.x86_64.elf File opened for reading /proc/11/comm iran.x86_64.elf File opened for reading /proc/715/comm iran.x86_64.elf File opened for reading /proc/961/comm iran.x86_64.elf File opened for reading /proc/1015/comm iran.x86_64.elf File opened for reading /proc/1088/comm iran.x86_64.elf File opened for reading /proc/1144/comm iran.x86_64.elf File opened for reading /proc/8/comm iran.x86_64.elf File opened for reading /proc/12/comm iran.x86_64.elf File opened for reading /proc/28/comm iran.x86_64.elf File opened for reading /proc/1071/comm iran.x86_64.elf File opened for reading /proc/1085/comm iran.x86_64.elf File opened for reading /proc/1484/comm iran.x86_64.elf File opened for reading /proc/19/comm iran.x86_64.elf File opened for reading /proc/166/comm iran.x86_64.elf File opened for reading /proc/492/comm iran.x86_64.elf File opened for reading /proc/984/comm iran.x86_64.elf File opened for reading /proc/1251/comm iran.x86_64.elf File opened for reading /proc/1292/comm iran.x86_64.elf File opened for reading /proc/15/comm iran.x86_64.elf File opened for reading /proc/171/comm iran.x86_64.elf File opened for reading /proc/175/comm iran.x86_64.elf File opened for reading /proc/413/comm iran.x86_64.elf File opened for reading /proc/1342/comm iran.x86_64.elf File opened for reading /proc/1476/comm iran.x86_64.elf File opened for reading /proc/433/comm iran.x86_64.elf File opened for reading /proc/1195/comm iran.x86_64.elf File opened for reading /proc/18/comm iran.x86_64.elf File opened for reading /proc/573/comm iran.x86_64.elf File opened for reading /proc/645/comm iran.x86_64.elf File opened for reading /proc/657/comm iran.x86_64.elf File opened for reading /proc/1311/comm iran.x86_64.elf File opened for reading /proc/1382/comm iran.x86_64.elf File opened for reading /proc/927/comm iran.x86_64.elf File opened for reading /proc/13/comm iran.x86_64.elf File opened for reading /proc/79/comm iran.x86_64.elf File opened for reading /proc/414/comm iran.x86_64.elf File opened for reading /proc/436/comm iran.x86_64.elf File opened for reading /proc/1177/comm iran.x86_64.elf File opened for reading /proc/1193/comm iran.x86_64.elf File opened for reading /proc/1482/comm iran.x86_64.elf File opened for reading /proc/4/comm iran.x86_64.elf File opened for reading /proc/27/comm iran.x86_64.elf File opened for reading /proc/86/comm iran.x86_64.elf File opened for reading /proc/650/comm iran.x86_64.elf File opened for reading /proc/658/comm iran.x86_64.elf File opened for reading /proc/922/comm iran.x86_64.elf File opened for reading /proc/7/comm iran.x86_64.elf File opened for reading /proc/26/comm iran.x86_64.elf File opened for reading /proc/29/comm iran.x86_64.elf