Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/08/2026, 05:03
Static task
static1
Behavioral task
behavioral1
Sample
baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0
- Size 98KB
- Sample260804-fp2wqs1hlc
- SHA256 baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0
- MD5 e2185129f060ca5cac291017fd14b573
- SHA1 50c27e8e31c80afa0a64e89683f6a06c83fd4025
- SHA512 285965246f24cbe73d92ee86c6599880dded4933ad03fda1e9279d242545f7d46404db345437d5289afc31ed94d721c810ba328c3a83948fe2a0585a199f28a9
- SSDEEP 1536:rw1BTbd90hDtZx6O/0c3Ra/oLDQ9VPJU3310vntiZvnwl7/4qKU7yMY7r:qP09tZxac3A/oLDYiClSCBY
- TLSH T1D4A34C86FB93E0F0D94605B1111FF77D9634EE625024DE5AEBD4BEB2AD32602921B31C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 1540 baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 -
description ioc Process File opened for reading /proc/161/exe baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1252/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1316/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1560/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1565/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/404/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/7/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/83/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1553/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1559/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1565/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/14/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/35/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1530/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1181/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/5/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/660/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/34/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/173/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/79/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/175/exe baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1033/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/974/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1421/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/9/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/82/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/83/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1037/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/903/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/171/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/488/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/26/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/170/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/175/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/488/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/977/exe baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1198/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/10/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/420/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/135/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/167/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1050/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1200/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1559/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1578/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1099/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/8/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/161/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/488/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1168/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/30/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1538/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1094/status baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1536/exe baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/164/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/165/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/689/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/988/stat baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1552/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1579/cmdline baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/523/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/944/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0 File opened for reading /proc/1033/comm baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0