Analysis
- max time kernel
140s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
28/06/2026, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu1804-amd64-20260513-en
3 signatures
150 seconds
General
- Target x86
- Size 70KB
- Sample260628-pg3mqsg19x
- SHA256 bf551654165f7b642287c328c261bacf392bd0eb543b7751e44d69263814397a
- MD5 4381757003251f1a2216418625981626
- SHA1 234906608f1db3aa41edb3063aaa42ec6b91397b
- SHA512 8355dc44b1dfd40ec9d79ba2cab2e801e8b0d0dd328ab38efd6c22f9b7b21bb3a3467c4b19015eeaaa80b2a27543536bedc7edd8be915546df0aacb26cddc040
- SSDEEP 768:0xRFULYxeDZ4kkscYf1rJHj/9Feb8oewufg86K8K9NigqzYTSfLXBRaAdpjkgKIF:GRAYxEVDrrJHpue/fg3EupkTSjb8gK
- TLSH T173636C89FB83C4F6E84705B1653B9B728733D5391059EA82C36DB832DC62A52D71B36C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (67127) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Unexpected DNS network traffic destination 44 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 208.67.220.220 Destination IP 1.0.0.1 Destination IP 9.9.9.9 Destination IP 1.0.0.1 Destination IP 208.67.220.220 Destination IP 1.0.0.1 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 9.9.9.9 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 1.0.0.1 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 1.0.0.1 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 208.67.220.220 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 9.9.9.9 Destination IP 1.0.0.1 Destination IP 208.67.222.222 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.220.220 Destination IP 208.67.222.222 Destination IP 1.0.0.1