Analysis
- user interaction
yes - max time kernel
149s - max time network
155s - platform
ubuntu-20.04_amd64 - resource
ubuntu2004-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20260513-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system - submitted
04/08/2026, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
x86_64
Resource
ubuntu2004-amd64-20260513-en
ubuntu-20.04-amd64
4 signatures
150 seconds
General
- Target x86_64
- Size 45KB
- Sample260804-fe17fsdb79
- SHA256 83de8599e0976a6a699f941d86bdbcf0dfb8be5a451090a84d823d842a0cea5d
- MD5 44818a6e59e025ddb427763e3c0a3154
- SHA1 575c06d00bc1d39601c2eb6d1466fd8b5aa67de6
- SHA512 0797d4e2b076f7f354c009f0b0736947dc5a1464a8bd54829055354d4dc555bec47f8919b7509925155a59ffc71900de912548ae983776265b6c3dbfae6ec367
- SSDEEP 768:gGxxeVlNOgp3rZbYZwEdoyRC9oxx9ONPr8MVbprRaC9Z9ZsTOCkDsHFfv5nHBAMD:PIAgp3rZswEdoyRC9oxrO7VbpAC93BgT
- TLSH T18D23F807A58294FCC59AC234076BB53ED533B66E0139F6FABBC8FB232C92D214E19545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/70/maps x86_64 File opened for reading /proc/74/maps x86_64 File opened for reading /proc/91/maps x86_64 File opened for reading /proc/140/maps x86_64 File opened for reading /proc/162/maps x86_64 File opened for reading /proc/177/maps x86_64 File opened for reading /proc/533/maps x86_64 File opened for reading /proc/534/maps x86_64 File opened for reading /proc/118/maps x86_64 File opened for reading /proc/176/maps x86_64 File opened for reading /proc/496/maps x86_64 File opened for reading /proc/606/maps x86_64 File opened for reading /proc/852/maps x86_64 File opened for reading /proc/888/maps x86_64 File opened for reading /proc/902/maps x86_64 File opened for reading /proc/6/maps x86_64 File opened for reading /proc/8/maps x86_64 File opened for reading /proc/75/maps x86_64 File opened for reading /proc/583/maps x86_64 File opened for reading /proc/753/maps x86_64 File opened for reading /proc/982/maps x86_64 File opened for reading /proc/1/maps x86_64 File opened for reading /proc/168/maps x86_64 File opened for reading /proc/523/maps x86_64 File opened for reading /proc/662/maps x86_64 File opened for reading /proc/866/maps x86_64 File opened for reading /proc/881/maps x86_64 File opened for reading /proc/200/maps x86_64 File opened for reading /proc/242/maps x86_64 File opened for reading /proc/498/maps x86_64 File opened for reading /proc/634/maps x86_64 File opened for reading /proc/933/maps x86_64 File opened for reading /proc/22/maps x86_64 File opened for reading /proc/89/maps x86_64 File opened for reading /proc/167/maps x86_64 File opened for reading /proc/454/maps x86_64 File opened for reading /proc/792/maps x86_64 File opened for reading /proc/72/maps x86_64 File opened for reading /proc/13/maps x86_64 File opened for reading /proc/568/maps x86_64 File opened for reading /proc/585/maps x86_64 File opened for reading /proc/775/maps x86_64 File opened for reading /proc/800/maps x86_64 File opened for reading /proc/4/maps x86_64 File opened for reading /proc/159/maps x86_64 File opened for reading /proc/201/maps x86_64 File opened for reading /proc/785/maps x86_64 File opened for reading /proc/20/maps x86_64 File opened for reading /proc/170/maps x86_64 File opened for reading /proc/586/maps x86_64 File opened for reading /proc/681/maps x86_64 File opened for reading /proc/819/maps x86_64 File opened for reading /proc/158/maps x86_64 File opened for reading /proc/169/maps x86_64 File opened for reading /proc/438/maps x86_64 File opened for reading /proc/497/maps x86_64 File opened for reading /proc/19/maps x86_64 File opened for reading /proc/2/maps x86_64 File opened for reading /proc/17/maps x86_64 File opened for reading /proc/84/maps x86_64 File opened for reading /proc/486/maps x86_64 File opened for reading /proc/987/maps x86_64 File opened for reading /proc/11/maps x86_64 File opened for reading /proc/21/maps x86_64 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1432 x86_64 -
description ioc Process File opened for reading /proc/158tX۾ŧ7W4 x86_64 File opened for reading /proc/169tX۾ŧ7W4 x86_64 File opened for reading /proc/175tX۾ŧ7W4 x86_64 File opened for reading /proc/201/cmdline x86_64 File opened for reading /proc/505tX۾ŧ7W4 x86_64 File opened for reading /proc/866tX۾ŧ7W4/maps x86_64 File opened for reading /proc/881tX۾ŧ7W4 x86_64 File opened for reading /proc/881tX۾ŧ7W4/maps x86_64 File opened for reading /proc/24tX۾ŧ7W4/maps x86_64 File opened for reading /proc/173/cmdline x86_64 File opened for reading /proc/537/cmdline x86_64 File opened for reading /proc/583tX۾ŧ7W4 x86_64 File opened for reading /proc/852tX۾ŧ7W4/maps x86_64 File opened for reading /proc/997/cmdline x86_64 File opened for reading /proc/1019/maps x86_64 File opened for reading /proc/1234tX۾ŧ7W4/maps x86_64 File opened for reading /proc/165tX۾ŧ7W4 x86_64 File opened for reading /proc/496tX۾ŧ7W4 x86_64 File opened for reading /proc/888tX۾ŧ7W4 x86_64 File opened for reading /proc/79/cmdline x86_64 File opened for reading /proc/88/cmdline x86_64 File opened for reading /proc/89/cmdline x86_64 File opened for reading /proc/166/cmdline x86_64 File opened for reading /proc/438/cmdline x86_64 File opened for reading /proc/634tX۾ŧ7W4/maps x86_64 File opened for reading /proc/1375/maps x86_64 File opened for reading /proc/1403tX۾ŧ7W4/maps x86_64 File opened for reading /proc/933tX۾ŧ7W4 x86_64 File opened for reading /proc/1376tX۾ŧ7W4 x86_64 File opened for reading /proc/81/cmdline x86_64 File opened for reading /proc/1121tX۾ŧ7W4/maps x86_64 File opened for reading /proc/1191tX۾ŧ7W4/maps x86_64 File opened for reading /proc/1481tX۾ŧ7W4/maps x86_64 File opened for reading /proc/72tX۾ŧ7W4/maps x86_64 File opened for reading /proc/174tX۾ŧ7W4 x86_64 File opened for reading /proc/1114tX۾ŧ7W4/maps x86_64 File opened for reading /proc/1370tX۾ŧ7W4 x86_64 File opened for reading /proc/1490/maps x86_64 File opened for reading /proc/161/cmdline x86_64 File opened for reading /proc/170tX۾ŧ7W4 x86_64 File opened for reading /proc/486/cmdline x86_64 File opened for reading /proc/1367tX۾ŧ7W4/maps x86_64 File opened for reading /proc/1378tX۾ŧ7W4/maps x86_64 File opened for reading /proc/1485tX۾ŧ7W4 x86_64 File opened for reading /proc/166tX۾ŧ7W4/maps x86_64 File opened for reading /proc/533tX۾ŧ7W4 x86_64 File opened for reading /proc/1tX۾ŧ7W4/maps x86_64 File opened for reading /proc/785tX۾ŧ7W4 x86_64 File opened for reading /proc/855tX۾ŧ7W4 x86_64 File opened for reading /proc/1106tX۾ŧ7W4/maps x86_64 File opened for reading /proc/1115tX۾ŧ7W4 x86_64 File opened for reading /proc/1481/cmdline x86_64 File opened for reading /proc/7/cmdline x86_64 File opened for reading /proc/1027tX۾ŧ7W4/maps x86_64 File opened for reading /proc/1120/maps x86_64 File opened for reading /proc/1158tX۾ŧ7W4 x86_64 File opened for reading /proc/1372/maps x86_64 File opened for reading /proc/176tX۾ŧ7W4 x86_64 File opened for reading /proc/770tX۾ŧ7W4 x86_64 File opened for reading /proc/1486tX۾ŧ7W4 x86_64 File opened for reading /proc/8/cmdline x86_64 File opened for reading /proc/90tX۾ŧ7W4 x86_64 File opened for reading /proc/91tX۾ŧ7W4/maps x86_64 File opened for reading /proc/163tX۾ŧ7W4/maps x86_64