417fa8cec3442f12b150e7edaae761d9d97c0bb600dae793e4c726e11797027d

Analysis

geolocation tags

asiadelhiinindia
max time kernel
0s
max time network
897s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20260126-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
08/07/2026, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Discord/updater_bootstrap
Size 4.1MB
Sample260708-rqnahsgt7w
SHA256 417fa8cec3442f12b150e7edaae761d9d97c0bb600dae793e4c726e11797027d
MD5 d31ce7722ff8e3270ba9ba3ba724db49
SHA1 94e37cdfe834493537e4c5e53a2e72925adb57d8
SHA512 d4d4a319225df8a46535e8a48423f47f3f08580cce2dd28c01d8491a8cd40da62aeeab6a54395c348e9ee32b10bdd1a1485f73d3ae2c7f270166ab99f2e52906
SSDEEP 49152:zLFuzIphwIU6iPt9Xsr6DNWt4X4R48vxf5LL1yGI+lQs0w6lyKn2Qcz6O/Odq3xO:zLFzhP+PKfyc36D29RhH4Sge
TLSH
T169167D03F6E148EDC9A9C834835E9133EB36B4994225B6AB27D45B103F2BF609F1D791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	tokio-rt-worker	2053	updater_bootstrap

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	updater_bootstrap
File opened for reading	/sys/fs/cgroup/system.slice/cpu.max	updater_bootstrap
File opened for reading	/sys/fs/cgroup/cpu.max	updater_bootstrap

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	updater_bootstrap
File opened for reading	/proc/self/cgroup	updater_bootstrap

/tmp/Discord/updater_bootstrap
/tmp/Discord/updater_bootstrap
1⤵
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2051

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads