184fd0dab236dcb4889b5824ef2577577a34be3057e7d113c1eed7ef515b1e4e

Analysis

user interaction
yes
max time kernel
28s
max time network
31s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2026, 02:22

Target
ROOTKITSON.x86
Size 73KB
Sample260804-ctme3abe49
SHA256 184fd0dab236dcb4889b5824ef2577577a34be3057e7d113c1eed7ef515b1e4e
MD5 5312ef03df1b88f5eaef031b6e4684c4
SHA1 2e38f615c237870629f8c17e531369465da38a85
SHA512 c3cced3845528cd82ecffab683a6d2f8eadee6132bded130158de2544a1f96eb24f6594d3dd982d7036b6d6a0facc4ea394439326e3ae85fee9f575eaaa01da0
SSDEEP 1536:Rcz8Mfl3USRL+r97S3Tl9ffUr9sFC1qs3vLJ7LZaA14B6Kk3u8Lxg:RcICl3USMsTl9HUrS6qs3TJ7LYK4fQLx
TLSH
T1F3730A826A43DEF3E85710F502B7EB365A32FD3A083AC5C6E774FCA15A515C0A5163AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Traces itself 2 IoCs

Traces itself to prevent debugging attempts

pid	Process
1488	ROOTKITSON.x86
1488	ROOTKITSON.x86

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	uhttpd	1488	ROOTKITSON.x86
Changes the process name, possibly in an attempt to hide itself	apache	1488	ROOTKITSON.x86

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/mounts	ROOTKITSON.x86
File opened for reading	/proc/self/status	ROOTKITSON.x86