184fd0dab236dcb4889b5824ef2577577a34be3057e7d113c1eed7ef515b1e4e

Resubmissions

07/07/2026, 04:09

260707-eq4ahshw3t10

07/07/2026, 04:07

260707-ep6dgsew5m10

07/07/2026, 04:07

260707-epp2hahv9w10

Analysis

user interaction
yes
max time kernel
24s
max time network
26s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/07/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
manji.x86
Size 73KB
Sample260707-epp2hahv9w
SHA256 184fd0dab236dcb4889b5824ef2577577a34be3057e7d113c1eed7ef515b1e4e
MD5 5312ef03df1b88f5eaef031b6e4684c4
SHA1 2e38f615c237870629f8c17e531369465da38a85
SHA512 c3cced3845528cd82ecffab683a6d2f8eadee6132bded130158de2544a1f96eb24f6594d3dd982d7036b6d6a0facc4ea394439326e3ae85fee9f575eaaa01da0
SSDEEP 1536:Rcz8Mfl3USRL+r97S3Tl9ffUr9sFC1qs3vLJ7LZaA14B6Kk3u8Lxg:RcICl3USMsTl9HUrS6qs3TJ7LYK4fQLx
TLSH
T1F3730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA15A515C0A5163AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm discovery

Malware Config

Signatures

Traces itself 5 IoCs

Traces itself to prevent debugging attempts

pid	Process
1492	manji.x86
1492	manji.x86
1492	manji.x86
1492	manji.x86
1492	manji.x86

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	uhttpd	1492	manji.x86
Changes the process name, possibly in an attempt to hide itself	lighttpd	1492	manji.x86

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	manji.x86

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/status	manji.x86
File opened for reading	/proc/mounts	manji.x86

/tmp/manji.x86
/tmp/manji.x86
1⤵
- Traces itself
- Changes its process name
- Checks CPU configuration
- Reads runtime system information
PID:1491

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads