Analysis
- max time kernel
148s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
30/05/2026, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
wife.i686.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target wife.i686.elf
- Size 155KB
- Sample260530-bdjtkacw4v
- SHA256 b1992872509f5048e57e72d2b50223105b0eab9db5358dccac6a83a2f3ddb45c
- MD5 8c903133c328a5c39dcb2f589d32d549
- SHA1 d3f867f4841f2413b4ef5b799dad901777695874
- SHA512 da555be3bd7b4e21fbe766001c49fe13711141b61c86d3ff3bc93748d988b06756d41a1bcd6335e88562663025c1101c353a9c1b0e0c884405e35d53df8c969f
- SSDEEP 3072:FohH0V3JL6BTMTeZRf7tzJVhD7AhstnDx:FI0n6OyTUutnDx
- TLSH T139F32B51FF83CAF3E40304F080EAAB3F5A30ED1A4436C559EB657E6AD6539D5E20A364
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1504 wife.i686.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/78/maps wife.i686.elf File opened for reading /proc/174/maps wife.i686.elf File opened for reading /proc/485/maps wife.i686.elf File opened for reading /proc/2/maps wife.i686.elf File opened for reading /proc/242/maps wife.i686.elf File opened for reading /proc/715/maps wife.i686.elf File opened for reading /proc/202/maps wife.i686.elf File opened for reading /proc/727/maps wife.i686.elf File opened for reading /proc/957/maps wife.i686.elf File opened for reading /proc/993/maps wife.i686.elf File opened for reading /proc/159/maps wife.i686.elf File opened for reading /proc/30/maps wife.i686.elf File opened for reading /proc/157/maps wife.i686.elf File opened for reading /proc/429/maps wife.i686.elf File opened for reading /proc/458/maps wife.i686.elf File opened for reading /proc/612/maps wife.i686.elf File opened for reading /proc/26/maps wife.i686.elf File opened for reading /proc/169/maps wife.i686.elf File opened for reading /proc/583/maps wife.i686.elf File opened for reading /proc/465/maps wife.i686.elf File opened for reading /proc/951/maps wife.i686.elf File opened for reading /proc/165/maps wife.i686.elf File opened for reading /proc/32/maps wife.i686.elf File opened for reading /proc/80/maps wife.i686.elf File opened for reading /proc/677/maps wife.i686.elf File opened for reading /proc/12/maps wife.i686.elf File opened for reading /proc/15/maps wife.i686.elf File opened for reading /proc/19/maps wife.i686.elf File opened for reading /proc/167/maps wife.i686.elf File opened for reading /proc/168/maps wife.i686.elf File opened for reading /proc/504/maps wife.i686.elf File opened for reading /proc/977/maps wife.i686.elf File opened for reading /proc/11/maps wife.i686.elf File opened for reading /proc/20/maps wife.i686.elf File opened for reading /proc/166/maps wife.i686.elf File opened for reading /proc/437/maps wife.i686.elf File opened for reading /proc/918/maps wife.i686.elf File opened for reading /proc/970/maps wife.i686.elf File opened for reading /proc/8/maps wife.i686.elf File opened for reading /proc/24/maps wife.i686.elf File opened for reading /proc/81/maps wife.i686.elf File opened for reading /proc/432/maps wife.i686.elf File opened for reading /proc/533/maps wife.i686.elf File opened for reading /proc/932/maps wife.i686.elf File opened for reading /proc/5/maps wife.i686.elf File opened for reading /proc/16/maps wife.i686.elf File opened for reading /proc/18/maps wife.i686.elf File opened for reading /proc/160/maps wife.i686.elf File opened for reading /proc/721/maps wife.i686.elf File opened for reading /proc/10/maps wife.i686.elf File opened for reading /proc/34/maps wife.i686.elf File opened for reading /proc/35/maps wife.i686.elf File opened for reading /proc/115/maps wife.i686.elf File opened for reading /proc/444/maps wife.i686.elf File opened for reading /proc/658/maps wife.i686.elf File opened for reading /proc/983/maps wife.i686.elf File opened for reading /proc/14/maps wife.i686.elf File opened for reading /proc/23/maps wife.i686.elf File opened for reading /proc/36/maps wife.i686.elf File opened for reading /proc/6/maps wife.i686.elf File opened for reading /proc/17/maps wife.i686.elf File opened for reading /proc/25/maps wife.i686.elf File opened for reading /proc/27/maps wife.i686.elf File opened for reading /proc/83/maps wife.i686.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bash 1504 wife.i686.elf -
description ioc Process File opened for reading /proc/1357/maps wife.i686.elf File opened for reading /proc/583/cmdline wife.i686.elf File opened for reading /proc/974/cmdline wife.i686.elf File opened for reading /proc/1495/maps wife.i686.elf File opened for reading /proc/18/cmdline wife.i686.elf File opened for reading /proc/29/cmdline wife.i686.elf File opened for reading /proc/84/cmdline wife.i686.elf File opened for reading /proc/137/cmdline wife.i686.elf File opened for reading /proc/727/cmdline wife.i686.elf File opened for reading /proc/1042/cmdline wife.i686.elf File opened for reading /proc/1086/cmdline wife.i686.elf File opened for reading /proc/1153/maps wife.i686.elf File opened for reading /proc/8/cmdline wife.i686.elf File opened for reading /proc/17/cmdline wife.i686.elf File opened for reading /proc/21/cmdline wife.i686.elf File opened for reading /proc/36/cmdline wife.i686.elf File opened for reading /proc/161/cmdline wife.i686.elf File opened for reading /proc/715/cmdline wife.i686.elf File opened for reading /proc/978/cmdline wife.i686.elf File opened for reading /proc/1055/maps wife.i686.elf File opened for reading /proc/162/cmdline wife.i686.elf File opened for reading /proc/444/cmdline wife.i686.elf File opened for reading /proc/1022/cmdline wife.i686.elf File opened for reading /proc/1063/maps wife.i686.elf File opened for reading /proc/1097/cmdline wife.i686.elf File opened for reading /proc/1098/cmdline wife.i686.elf File opened for reading /proc/1099/maps wife.i686.elf File opened for reading /proc/1318/cmdline wife.i686.elf File opened for reading /proc/98/cmdline wife.i686.elf File opened for reading /proc/157/cmdline wife.i686.elf File opened for reading /proc/174/cmdline wife.i686.elf File opened for reading /proc/467/cmdline wife.i686.elf File opened for reading /proc/611/cmdline wife.i686.elf File opened for reading /proc/977/cmdline wife.i686.elf File opened for reading /proc/1078/maps wife.i686.elf File opened for reading /proc/1337/cmdline wife.i686.elf File opened for reading /proc/34/cmdline wife.i686.elf File opened for reading /proc/35/cmdline wife.i686.elf File opened for reading /proc/81/cmdline wife.i686.elf File opened for reading /proc/417/cmdline wife.i686.elf File opened for reading /proc/1105/maps wife.i686.elf File opened for reading /proc/1210/maps wife.i686.elf File opened for reading /proc/1258/maps wife.i686.elf File opened for reading /proc/1333/cmdline wife.i686.elf File opened for reading /proc/7/cmdline wife.i686.elf File opened for reading /proc/169/cmdline wife.i686.elf File opened for reading /proc/202/cmdline wife.i686.elf File opened for reading /proc/918/cmdline wife.i686.elf File opened for reading /proc/1022/maps wife.i686.elf File opened for reading /proc/1038/maps wife.i686.elf File opened for reading /proc/1098/maps wife.i686.elf File opened for reading /proc/1467/maps wife.i686.elf File opened for reading /proc/163/cmdline wife.i686.elf File opened for reading /proc/437/cmdline wife.i686.elf File opened for reading /proc/455/cmdline wife.i686.elf File opened for reading /proc/1042/maps wife.i686.elf File opened for reading /proc/1075/cmdline wife.i686.elf File opened for reading /proc/1493/cmdline wife.i686.elf File opened for reading /proc/1493/maps wife.i686.elf File opened for reading /proc/1495/cmdline wife.i686.elf File opened for reading /proc/10/cmdline wife.i686.elf File opened for reading /proc/13/cmdline wife.i686.elf File opened for reading /proc/26/cmdline wife.i686.elf File opened for reading /proc/465/cmdline wife.i686.elf