Analysis
- max time kernel
150s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/07/2026, 00:22
Behavioral task
behavioral1
Sample
debug.dbg
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target debug.dbg
- Size 58KB
- Sample260722-apdk9agg87
- SHA256 72b352a3c0a6763a425912736b369697387aa12f25f297d078511480e8b2306b
- MD5 60a807c70d90ce3d10385b7874121a0c
- SHA1 9404f71db224c85623e34959a33fb2bf5e8a2c97
- SHA512 9200d02e4003089a2dc0b44257d5189fd314337114465305b2cca25c3e070fe16902dc94e75d7c6cd35c76a642ff2d48291ddfa3aba7e10f64df5d85ec35676c
- SSDEEP 1536:DIqD1xfYqyDgZtmYX38pJspYUz2jMY5ts0Aj+ISeWYeeu:DIqDXfYqykZ4YX3IJsplsMytzG+MWYeR
- TLSH T118436DC6D143D8F6E80B0570603BE72BAE71E8EA2219FF47C7689631FC86641A5179DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1478 debug.dbg - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bash 1479 debug.dbg Changes the process name, possibly in an attempt to hide itself inetd 1481 debug.dbg Changes the process name, possibly in an attempt to hide itself nginx 1480 debug.dbg Changes the process name, possibly in an attempt to hide itself sshd 1482 debug.dbg -
description ioc Process File opened for reading /proc/923/cmdline debug.dbg File opened for reading /proc/2/cmdline debug.dbg File opened for reading /proc/5/cmdline debug.dbg File opened for reading /proc/36/cmdline debug.dbg File opened for reading /proc/86/cmdline debug.dbg File opened for reading /proc/1038/cmdline debug.dbg File opened for reading /proc/4/cmdline debug.dbg File opened for reading /proc/78/cmdline debug.dbg File opened for reading /proc/84/cmdline debug.dbg File opened for reading /proc/176/cmdline debug.dbg File opened for reading /proc/246/cmdline debug.dbg File opened for reading /proc/901/cmdline debug.dbg File opened for reading /proc/965/cmdline debug.dbg File opened for reading /proc/1034/cmdline debug.dbg File opened for reading /proc/19/cmdline debug.dbg File opened for reading /proc/551/cmdline debug.dbg File opened for reading /proc/970/cmdline debug.dbg File opened for reading /proc/1047/cmdline debug.dbg File opened for reading /proc/1057/cmdline debug.dbg File opened for reading /proc/159/cmdline debug.dbg File opened for reading /proc/174/cmdline debug.dbg File opened for reading /proc/712/cmdline debug.dbg File opened for reading /proc/1054/cmdline debug.dbg File opened for reading /proc/1141/cmdline debug.dbg File opened for reading /proc/1464/cmdline debug.dbg File opened for reading /proc/325/cmdline debug.dbg File opened for reading /proc/487/cmdline debug.dbg File opened for reading /proc/16/cmdline debug.dbg File opened for reading /proc/20/cmdline debug.dbg File opened for reading /proc/137/cmdline debug.dbg File opened for reading /proc/559/cmdline debug.dbg File opened for reading /proc/906/cmdline debug.dbg File opened for reading /proc/985/cmdline debug.dbg File opened for reading /proc/14/cmdline debug.dbg File opened for reading /proc/23/cmdline debug.dbg File opened for reading /proc/98/cmdline debug.dbg File opened for reading /proc/166/cmdline debug.dbg File opened for reading /proc/1085/cmdline debug.dbg File opened for reading /proc/31/cmdline debug.dbg File opened for reading /proc/32/cmdline debug.dbg File opened for reading /proc/18/cmdline debug.dbg File opened for reading /proc/34/cmdline debug.dbg File opened for reading /proc/522/cmdline debug.dbg File opened for reading /proc/1064/cmdline debug.dbg File opened for reading /proc/26/cmdline debug.dbg File opened for reading /proc/28/cmdline debug.dbg File opened for reading /proc/29/cmdline debug.dbg File opened for reading /proc/441/cmdline debug.dbg File opened for reading /proc/660/cmdline debug.dbg File opened for reading /proc/892/cmdline debug.dbg File opened for reading /proc/942/cmdline debug.dbg File opened for reading /proc/1022/cmdline debug.dbg File opened for reading /proc/13/cmdline debug.dbg File opened for reading /proc/164/cmdline debug.dbg File opened for reading /proc/1030/cmdline debug.dbg File opened for reading /proc/1090/cmdline debug.dbg File opened for reading /proc/1255/cmdline debug.dbg File opened for reading /proc/1257/cmdline debug.dbg File opened for reading /proc/1373/cmdline debug.dbg File opened for reading /proc/165/cmdline debug.dbg File opened for reading /proc/171/cmdline debug.dbg File opened for reading /proc/482/cmdline debug.dbg File opened for reading /proc/521/cmdline debug.dbg File opened for reading /proc/1091/cmdline debug.dbg