Analysis
- user interaction
yes - max time kernel
149s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/07/2026, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
- Target F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587
- Size 3.2MB
- Sample260719-2eppbaes2n
- SHA256 f3f7cafb3fb9fef228d6fc42c57bfd85879e0e52988f6fdf0286a8f53da94587
- MD5 22ea4162c6c20d1c08e9d1cf10e8af9e
- SHA1 2e5c0d7c4de8669a9b2796ece44d5a41691785c2
- SHA512 805353eca82491532f62d7a350fbc218b3c5edc53224a99cf74cc9bc4411f30f7b7cfdfe6717d0865d08930ec6051887035ffae0356d46233e94a1456e603d9b
- SSDEEP 49152:CRvNrM5tNDwSeHexeKNX0RzNIScsXebNCOJi01O1XwAUoYQAI:CR5ktlt6ZebNCOiDGArd
- TLSH T132F57B57FCD118E6C0AAA23289A352927B71BC491F3263C76F50B2782E73BD49D39744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 -
description ioc Process File opened for reading /proc/1079/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1266/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/31/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/731/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/912/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1102/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1052/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1057/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/176/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/24/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1517/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1093/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1105/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1112/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/12/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/29/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/34/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/914/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/98/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/115/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1271/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/17/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/170/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/440/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/89/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/961/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/984/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/178/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/203/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/653/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/671/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/81/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/84/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1516/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1071/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1210/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/168/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/426/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/499/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/606/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/9/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1174/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/955/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/10/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1153/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/13/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1496/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/549/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1099/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/270/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/36/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1087/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1026/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/15/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/165/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/166/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/167/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/169/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/495/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1397/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1062/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1069/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/1336/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587 File opened for reading /proc/163/cmdline F3F7CAFB3FB9FEF228D6FC42C57BFD85879E0E52988F6FDF0286A8F53DA94587