Analysis
- max time kernel
149s - max time network
152s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
07/07/2026, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target x86
- Size 6.9MB
- Sample260707-pdvsqaev9k
- SHA256 96a8433d7aea4545074f17727439e3c46231b4d36b69c763043972a09e870856
- MD5 ceb55e44792cf44199ea2736a40b74c0
- SHA1 071ea9358b9197baecfec85df9eadb38aa0675f0
- SHA512 b29089acef3e5e3cb5cdf43bba5434d25e4e1f51864dc65c74377c81246f3b421292377ad937dec5e9669e3f901911c5c068dc7dfce79b26a9196e244d01efa3
- SSDEEP 49152:HTZXXp+A9M8E2yxWaMYyGF2ul3Db/JOZ7WjHSWJXJsw21xAfwj17WUXWEcmCLpHr:zx5+KMxDMYyQhOVwH15sjvhjiEc
- TLSH T1B7762751FE8B50F6E9030D3105ABB22F63325D064F29EBE3EA407F29F97B6911936149
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/NetworkManager 1495 x86 - Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us x86 File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size x86 File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us x86 -
description ioc Process File opened for reading /proc/156/environ x86 File opened for reading /proc/31/environ x86 File opened for reading /proc/89/environ x86 File opened for reading /proc/175/environ x86 File opened for reading /proc/83/environ x86 File opened for reading /proc/158/environ x86 File opened for reading /proc/162/environ x86 File opened for reading /proc/164/environ x86 File opened for reading /proc/171/stat x86 File opened for reading /proc/20/environ x86 File opened for reading /proc/159/environ x86 File opened for reading /proc/175/stat x86 File opened for reading /proc/200/stat x86 File opened for reading /proc/23/environ x86 File opened for reading /proc/24/stat x86 File opened for reading /proc/32/environ x86 File opened for reading /proc/14/environ x86 File opened for reading /proc/7/environ x86 File opened for reading /proc/84/environ x86 File opened for reading /proc/9/stat x86 File opened for reading /proc/157/stat x86 File opened for reading /proc/17/stat x86 File opened for reading /proc/170/stat x86 File opened for reading /proc/80/environ x86 File opened for reading /proc/82/environ x86 File opened for reading /proc/11/environ x86 File opened for reading /proc/157/environ x86 File opened for reading /proc/162/stat x86 File opened for reading /proc/171/environ x86 File opened for reading /proc/27/stat x86 File opened for reading /proc/29/stat x86 File opened for reading /proc/6/environ x86 File opened for reading /proc/16/environ x86 File opened for reading /proc/18/stat x86 File opened for reading /proc/115/environ x86 File opened for reading /proc/1484/environ x86 File opened for reading /proc/1486/stat x86 File opened for reading /proc/2/environ x86 File opened for reading /proc/2/stat x86 File opened for reading /proc/25/environ x86 File opened for reading /proc/81/environ x86 File opened for reading /proc/10/environ x86 File opened for reading /proc/13/stat x86 File opened for reading /proc/172/environ x86 File opened for reading /proc/21/environ x86 File opened for reading /proc/84/stat x86 File opened for reading /proc/14/stat x86 File opened for reading /proc/15/stat x86 File opened for reading /proc/160/environ x86 File opened for reading /proc/166/stat x86 File opened for reading /proc/31/stat x86 File opened for reading /proc/12/environ x86 File opened for reading /proc/166/environ x86 File opened for reading /proc/167/stat x86 File opened for reading /proc/168/environ x86 File opened for reading /proc/19/stat x86 File opened for reading /proc/86/environ x86 File opened for reading /proc/163/environ x86 File opened for reading /proc/201/environ x86 File opened for reading /proc/27/environ x86 File opened for reading /proc/30/environ x86 File opened for reading /proc/79/stat x86 File opened for reading /proc/11/stat x86 File opened for reading /proc/15/environ x86