Overview
overview
4Static
static
1publish/Ryujinx
ubuntu-18.04-amd64
4publish/Ryujinx.sh
ubuntu-18.04-amd64
1publish/Ryujinx.sh
debian-9-armhf
1publish/Ryujinx.sh
debian-9-mips
1publish/Ryujinx.sh
debian-9-mipsel
1publish/li...arp.so
ubuntu-18.04-amd64
1publish/libSDL3.so
ubuntu-18.04-amd64
1publish/li...arp.so
ubuntu-18.04-amd64
1publish/li....so.60
ubuntu-18.04-amd64
1publish/li....so.58
ubuntu-18.04-amd64
1publish/libglfw.so.3
ubuntu-18.04-amd64
1publish/libsoundio.so
ubuntu-18.04-amd64
1Analysis
- max time kernel
292s - max time network
182s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/06/2026, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
publish/Ryujinx
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
publish/Ryujinx.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral3
Sample
publish/Ryujinx.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral4
Sample
publish/Ryujinx.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral5
Sample
publish/Ryujinx.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral6
Sample
publish/libHarfBuzzSharp.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral7
Sample
publish/libSDL3.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
publish/libSkiaSharp.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral9
Sample
publish/libavcodec.so.60
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
publish/libavutil.so.58
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
publish/libglfw.so.3
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral12
Sample
publish/libsoundio.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
General
- Target publish/Ryujinx
- Size 74.5MB
- Sample260603-ezezaaay6r
- SHA256 1c867062e87fcc7f7ec6b1a5568a8b6781e4b0ab3f1a6ce8b5cb9c485ce2abac
- MD5 085b10dc39e24575353e543b27892f95
- SHA1 22f6f3d3fdfbf86d6c632aec1e07394095594382
- SHA512 57007ab7d6bc437d963dc52ebfb62549577d7ca264f8f409ee1b51446088f3160b2119dd72b0692c5888e9146df991d0920ce969356f154181c6b1140e5e4815
- SSDEEP 393216:ka2gozFTEq0Isb7jayTPPJn/7l94geh2y4IeODIlHnobHoP:j2gmWxj7asPJRmJ4IeOD2nobHY
- TLSH T16408AE15F7D88E2AD1AF87349032102043B5F46B2752EB9F364C92F82F57BD45E296A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Changes its process name 5 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself .NET SynchManag 1491 Ryujinx Changes the process name, possibly in an attempt to hide itself .NET EventPipe 1492 Ryujinx Changes the process name, possibly in an attempt to hide itself .NET DebugPipe 1493 Ryujinx Changes the process name, possibly in an attempt to hide itself .NET Debugger 1494 Ryujinx Changes the process name, possibly in an attempt to hide itself .NET SigHandler 1502 Ryujinx - Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/size Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index0/level Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/level Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/level Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index1/size Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index2/size Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/size Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index3/level Ryujinx File opened for reading /sys/devices/system/cpu/cpu0/cache/index4/size Ryujinx - Enumerates kernel/hardware configuration 1 TTPs 4 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/memory/memory.stat Ryujinx File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Ryujinx File opened for reading /sys/devices/system/node Ryujinx File opened for reading /sys/fs/cgroup/memory/memory.use_hierarchy Ryujinx -
description ioc Process File opened for reading /proc/self/mountinfo Ryujinx File opened for reading /proc/self/maps Ryujinx File opened for reading /proc/self/task/1499/comm Ryujinx File opened for reading /proc/self/task/1501/comm Ryujinx File opened for reading /proc/self/status Ryujinx File opened for reading /proc/self/task/1503/comm Ryujinx File opened for reading /proc/self/cgroup Ryujinx File opened for reading /proc/1490/stat Ryujinx File opened for reading /proc/meminfo Ryujinx File opened for reading /proc/self/task/1495/comm Ryujinx File opened for reading /proc/self/task/1500/comm Ryujinx - Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/sem.clrst000005d2000000000000321f Ryujinx