Analysis
- max time kernel
83s - max time network
65s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
07/08/2026, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
iran.i486
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target iran.i486
- Size 98KB
- Sample260807-agf2eawzhy
- SHA256 d3fa2dc23f90c19b36828887b0f70b1e1477a3e5229d7ca8b4ef38c6d609f90d
- MD5 2995075d86160acb552dd2819ce5015c
- SHA1 4ac2066f544c3537724b5e8a71c22c7aa515b646
- SHA512 b191f80fc9db2b7a0025107c76a9c9eab992399c8e96dbc8f52488015a8d6e8c92b7504aafd7b4896e6cc073d28a2c0c51ad0876126ea2090efa4487d707731c
- SSDEEP 1536:Tw1BTL1BZv/tlZx60V0c3Ra/oPDQJVrJU/310vntiZvnwl7/4qKU7yuEfr:yPJVlZx2c3A/oPD8GClSC7o
- TLSH T18EA34C86FB93E1F0D94605B1111FF77D9634DE225024DE5AEBD4BEB2AD32A02921B31C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/xs.main iran.i486 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself -sh 1497 iran.i486 -
description ioc Process File opened for reading /proc/22/comm iran.i486 File opened for reading /proc/1043/comm iran.i486 File opened for reading /proc/1078/comm iran.i486 File opened for reading /proc/15/stat iran.i486 File opened for reading /proc/173/stat iran.i486 File opened for reading /proc/173/cmdline iran.i486 File opened for reading /proc/923/status iran.i486 File opened for reading /proc/16/stat iran.i486 File opened for reading /proc/465/cmdline iran.i486 File opened for reading /proc/697/status iran.i486 File opened for reading /proc/990/stat iran.i486 File opened for reading /proc/1152/status iran.i486 File opened for reading /proc/1386/cmdline iran.i486 File opened for reading /proc/1492/stat iran.i486 File opened for reading /proc/1519/status iran.i486 File opened for reading /proc/986/comm iran.i486 File opened for reading /proc/84/stat iran.i486 File opened for reading /proc/86/cmdline iran.i486 File opened for reading /proc/164/cmdline iran.i486 File opened for reading /proc/729/cmdline iran.i486 File opened for reading /proc/1096/status iran.i486 File opened for reading /proc/1505/status iran.i486 File opened for reading /proc/1517/status iran.i486 File opened for reading /proc/486/comm iran.i486 File opened for reading /proc/505/comm iran.i486 File opened for reading /proc/137/cmdline iran.i486 File opened for reading /proc/162/cmdline iran.i486 File opened for reading /proc/327/comm iran.i486 File opened for reading /proc/31/stat iran.i486 File opened for reading /proc/34/status iran.i486 File opened for reading /proc/115/status iran.i486 File opened for reading /proc/163/status iran.i486 File opened for reading /proc/482/cmdline iran.i486 File opened for reading /proc/1086/status iran.i486 File opened for reading /proc/1259/status iran.i486 File opened for reading /proc/1091/comm iran.i486 File opened for reading /proc/1302/comm iran.i486 File opened for reading /proc/36/stat iran.i486 File opened for reading /proc/523/status iran.i486 File opened for reading /proc/560/status iran.i486 File opened for reading /proc/901/cmdline iran.i486 File opened for reading /proc/1526/status iran.i486 File opened for reading /proc/161/exe iran.i486 File opened for reading /proc/174/stat iran.i486 File opened for reading /proc/482/stat iran.i486 File opened for reading /proc/1052/status iran.i486 File opened for reading /proc/1055/cmdline iran.i486 File opened for reading /proc/1492/status iran.i486 File opened for reading /proc/523/cmdline iran.i486 File opened for reading /proc/14/stat iran.i486 File opened for reading /proc/35/status iran.i486 File opened for reading /proc/86/status iran.i486 File opened for reading /proc/416/cmdline iran.i486 File opened for reading /proc/651/cmdline iran.i486 File opened for reading /proc/1093/stat iran.i486 File opened for reading /proc/1296/cmdline iran.i486 File opened for reading /proc/729/comm iran.i486 File opened for reading /proc/3/cmdline iran.i486 File opened for reading /proc/4/cmdline iran.i486 File opened for reading /proc/14/status iran.i486 File opened for reading /proc/98/stat iran.i486 File opened for reading /proc/202/stat iran.i486 File opened for reading /proc/928/status iran.i486 File opened for reading /proc/1520/stat iran.i486