Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/07/2026, 19:22
Static task
static1
General
- Target x86_64.elf
- Size 142KB
- Sample260729-x3fzvsdf28
- SHA256 ddfc434ed42759bb027f8aa7ba857e1955a462000d7f128b8f2987995864e4eb
- MD5 addddd198dd0a396b85c6cb91caf64a4
- SHA1 5820f36c43394c42807045dce087fd68cd72ec75
- SHA512 9a6fcaa847a91e66578af8c69eb9af63c1085cd43ae21f71fc3f7adec971921e0d2e656ac18ab380f9be8e92b1efb9e394c992c4eea905e29776c55dde6c6ac1
- SSDEEP 3072:qm73/ShoBu/N99181+A1vlzkYsmEq3jQELBKwlua4TEM:QiF1zrfJX4nTEM
- TLSH T1D0E35B17B5C190FEC8D9D1B88BEAF626DA33B4291134721E27C86F2B2E4DE205F5D650
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1510 x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 1510 x86_64.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo x86_64.elf -
description ioc Process File opened for reading /proc/18/comm x86_64.elf File opened for reading /proc/1068/comm x86_64.elf File opened for reading /proc/31/status x86_64.elf File opened for reading /proc/944/cmdline x86_64.elf File opened for reading /proc/1510/task/1510/children x86_64.elf File opened for reading /proc/187/comm x86_64.elf File opened for reading /proc/1119/comm x86_64.elf File opened for reading /proc/3/stat x86_64.elf File opened for reading /proc/89/cmdline x86_64.elf File opened for reading /proc/1192/status x86_64.elf File opened for reading /proc/992/comm x86_64.elf File opened for reading /proc/12/status x86_64.elf File opened for reading /proc/184/stat x86_64.elf File opened for reading /proc/735/status x86_64.elf File opened for reading /proc/1273/stat x86_64.elf File opened for reading /proc/438/comm x86_64.elf File opened for reading /proc/35/cmdline x86_64.elf File opened for reading /proc/515/stat x86_64.elf File opened for reading /proc/1106/stat x86_64.elf File opened for reading /proc/1510/status x86_64.elf File opened for reading /proc/1069/status x86_64.elf File opened for reading /proc/1177/stat x86_64.elf File opened for reading /proc/1282/stat x86_64.elf File opened for reading /proc/288/stat x86_64.elf File opened for reading /proc/28/comm x86_64.elf File opened for reading /proc/509/comm x86_64.elf File opened for reading /proc/518/comm x86_64.elf File opened for reading /proc/2/stat x86_64.elf File opened for reading /proc/28/status x86_64.elf File opened for reading /proc/185/stat x86_64.elf File opened for reading /proc/695/cmdline x86_64.elf File opened for reading /proc/178/comm x86_64.elf File opened for reading /proc/969/comm x86_64.elf File opened for reading /proc/1211/comm x86_64.elf File opened for reading /proc/84/status x86_64.elf File opened for reading /proc/86/status x86_64.elf File opened for reading /proc/1064/cmdline x86_64.elf File opened for reading /proc/1152/status x86_64.elf File opened for reading /proc/1366/status x86_64.elf File opened for reading /proc/16/comm x86_64.elf File opened for reading /proc/83/stat x86_64.elf File opened for reading /proc/186/cmdline x86_64.elf File opened for reading /proc/22/comm x86_64.elf File opened for reading /proc/922/comm x86_64.elf File opened for reading /proc/1006/comm x86_64.elf File opened for reading /proc/1505/comm x86_64.elf File opened for reading /proc/8/status x86_64.elf File opened for reading /proc/18/cmdline x86_64.elf File opened for reading /proc/30/task/30/children x86_64.elf File opened for reading /proc/11/comm x86_64.elf File opened for reading /proc/513/comm x86_64.elf File opened for reading /proc/3/status x86_64.elf File opened for reading /proc/27/status x86_64.elf File opened for reading /proc/196/stat x86_64.elf File opened for reading /proc/949/stat x86_64.elf File opened for reading /proc/1010/status x86_64.elf File opened for reading /proc/1068/stat x86_64.elf File opened for reading /proc/513/stat x86_64.elf File opened for reading /proc/7/comm x86_64.elf File opened for reading /proc/84/comm x86_64.elf File opened for reading /proc/1064/comm x86_64.elf File opened for reading /proc/9/cmdline x86_64.elf File opened for reading /proc/26/stat x86_64.elf File opened for reading /proc/81/stat x86_64.elf