Analysis
- geolocation tags
asiadelhiinindia - max time kernel
0s - max time network
897s - platform
ubuntu-24.04_amd64 - resource
ubuntu2404-amd64-20260127-en - resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20260127-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system - submitted
08/07/2026, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
discord.tar.gz
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
discord.tar
Resource
ubuntu2404-amd64-20260127-en
ubuntu-24.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
Discord/discord
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
Discord/discord.desktop
Resource
ubuntu2404-amd64-20250619-en
ubuntu-24.04-amd64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
Discord/discord.png
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
Discord/postinst.sh
Resource
ubuntu2404-amd64-20260127-en
ubuntu-24.04-amd64
4 signatures
900 seconds
Behavioral task
behavioral7
Sample
Discord/updater_bootstrap
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
3 signatures
900 seconds
General
- Target Discord/postinst.sh
- Size 1KB
- Sample260708-rqnahsgt7w
- SHA256 df13e478d9b33907df30c453c6876682adfebcf5b2c1b5ce78cb57c377137407
- MD5 d4efca5b59dda36c594100ff68c05163
- SHA1 9f993acd8e8f1e3ed4d87314d9e1a3c25e3a6511
- SHA512 464bae2846c5ca8e4d73c4df7579cf6c39d825bda7f101966f778ba31d71ae9f03ca4db84207b51d0095800b8ee3cf18bc3f68ef3965d4f3620e0a356d34dbc3
- TLSH T14E1166476D09FA3718AB79795381706CBB44611E196B8340B40A252C77349D7F272E4F
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/possible pgrep - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/node pgrep -
description ioc Process File opened for reading /proc/338/cmdline pgrep File opened for reading /proc/389/cgroup pgrep File opened for reading /proc/1306/ctty pgrep File opened for reading /proc/33/status pgrep File opened for reading /proc/129/status pgrep File opened for reading /proc/437/cgroup pgrep File opened for reading /proc/1296/status pgrep File opened for reading /proc/1484/cgroup pgrep File opened for reading /proc/1965/ctty pgrep File opened for reading /proc/14/cgroup pgrep File opened for reading /proc/274/cgroup pgrep File opened for reading /proc/1505/status pgrep File opened for reading /proc/1672/cgroup pgrep File opened for reading /proc/12/stat pgrep File opened for reading /proc/142/ctty pgrep File opened for reading /proc/1060/stat pgrep File opened for reading /proc/1488/cmdline pgrep File opened for reading /proc/575/stat pgrep File opened for reading /proc/814/status pgrep File opened for reading /proc/1798/stat pgrep File opened for reading /proc/15/cgroup pgrep File opened for reading /proc/49/stat pgrep File opened for reading /proc/1474/cmdline pgrep File opened for reading /proc/756/status pgrep File opened for reading /proc/1756/stat pgrep File opened for reading /proc/15/status pgrep File opened for reading /proc/22/ctty pgrep File opened for reading /proc/132/status pgrep File opened for reading /proc/1296/stat pgrep File opened for reading /proc/1784/stat pgrep File opened for reading /proc/13/stat pgrep File opened for reading /proc/139/cgroup pgrep File opened for reading /proc/20/cgroup pgrep File opened for reading /proc/202/cmdline pgrep File opened for reading /proc/995/stat pgrep File opened for reading /proc/1479/cgroup pgrep File opened for reading /proc/1819/stat pgrep File opened for reading /proc/52/ctty pgrep File opened for reading /proc/135/stat pgrep File opened for reading /proc/139/stat pgrep File opened for reading /proc/793/status pgrep File opened for reading /proc/996/stat pgrep File opened for reading /proc/1802/cmdline pgrep File opened for reading /proc/1841/cmdline pgrep File opened for reading /proc/33/ctty pgrep File opened for reading /proc/417/stat pgrep File opened for reading /proc/1073/cmdline pgrep File opened for reading /proc/1/status pgrep File opened for reading /proc/13/status pgrep File opened for reading /proc/861/cgroup pgrep File opened for reading /proc/1484/cmdline pgrep File opened for reading /proc/14/cmdline pgrep File opened for reading /proc/33/cmdline pgrep File opened for reading /proc/52/cgroup pgrep File opened for reading /proc/1045/cmdline pgrep File opened for reading /proc/789/status pgrep File opened for reading /proc/791/ctty pgrep File opened for reading /proc/1474/cgroup pgrep File opened for reading /proc/1774/ctty pgrep File opened for reading /proc/778/cmdline pgrep File opened for reading /proc/1051/cmdline pgrep File opened for reading /proc/1285/status pgrep File opened for reading /proc/1774/stat pgrep File opened for reading /proc/2028/stat pgrep
Processes
-
/tmp/Discord/postinst.sh/tmp/Discord/postinst.sh1⤵PID:2031
-
/usr/bin/systemctlsystemctl reload apparmor2⤵PID:2032
-
-
/usr/bin/update-desktop-databaseupdate-desktop-database -q /usr/share/applications2⤵PID:2153
-
-
/usr/bin/pgreppgrep Discord2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2154
-
-
/usr/bin/rmrm -rf /home/user/.config/discord/Cache2⤵PID:2155
-
-
/usr/bin/rmrm -rf /home/user/.config/discord/GPUCache2⤵PID:2156
-
-
/usr/bin/rmrm -f /tmp/discord.sock2⤵PID:2157
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /usr/share/applications/.mimeinfo.cache.K7YNR3
- Size 28KB
- SHA256 b4d098122fd5ee5b808dad98405fd288ae29852229d42530695ee985bc3a5bf5
- MD5 b807b1dcaf17e735d292c989dc4a9e5c
- SHA1 e1422a548a91e04eb3d4d9fb2a04e7ac5ac87ef3
- SHA512 b6a39d36068721de2d05c6a5c176c58cce7af9f4cecf5044c0269fe89b15aa0a153589dcd29cce520a2bead5f3506df685c40bce8e0a639eb8637ee629db329e
- SSDEEP 96:U4e+OaxRizzu9oDOZO0UI3IOINIBIa9IVIzIRo4OT8OqoF0h05vH9OS8Ek/9ecBt:U4eYxRizzucsTQGx9SCEoT52DqsCFvyD
- TLSH T190D2CDEF4C8552992BB6503FFCBFE192BF3F2E6C88D85580F3D6A2091405D6C16B6984
- MD5 SHA1 SHA512 SSDEEP TLSH