Analysis
- max time kernel
149s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
11/08/2026, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
main.x86-64-v2.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target main.x86-64-v2.elf
- Size 65KB
- Sample260811-qqbfaaer2x
- SHA256 62f914e09e62bdd18628eb79352ae13ef6a41548065a399a8bd1a51012d66c32
- MD5 ccbb55d87ca1dd884ab7d3609cb560d5
- SHA1 fdcc9076c3803b7c3f7114faddd0b37a43318243
- SHA512 60c72c312cbf49cdb6846c93067ef78f3350fc393854c35e58474bdcffd3889b82e73e512b8084fbe5d1f69a1353409886485c7daace43b83ea3c2e764b78ee0
- SSDEEP 1536:ThbBD+7+IzAWnbJ7p+cYKTXuvxCupxRUfW2IUr:1BFIzAOJ7plu8
- TLSH T15D53E75BB5E3B0BCC247C0B45A9AD5B1B93178B002213D3FA6C8FA322D35E516659F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/961/cmdline main.x86-64-v2.elf File opened for reading /proc/995/cmdline main.x86-64-v2.elf File opened for reading /proc/1041/cmdline main.x86-64-v2.elf File opened for reading /proc/1168/cmdline main.x86-64-v2.elf File opened for reading /proc/26/cmdline main.x86-64-v2.elf File opened for reading /proc/137/cmdline main.x86-64-v2.elf File opened for reading /proc/442/cmdline main.x86-64-v2.elf File opened for reading /proc/450/cmdline main.x86-64-v2.elf File opened for reading /proc/540/cmdline main.x86-64-v2.elf File opened for reading /proc/542/cmdline main.x86-64-v2.elf File opened for reading /proc/1505/cmdline main.x86-64-v2.elf File opened for reading /proc/19/cmdline main.x86-64-v2.elf File opened for reading /proc/21/cmdline main.x86-64-v2.elf File opened for reading /proc/32/cmdline main.x86-64-v2.elf File opened for reading /proc/84/cmdline main.x86-64-v2.elf File opened for reading /proc/10/cmdline main.x86-64-v2.elf File opened for reading /proc/185/cmdline main.x86-64-v2.elf File opened for reading /proc/656/cmdline main.x86-64-v2.elf File opened for reading /proc/1468/cmdline main.x86-64-v2.elf File opened for reading /proc/178/cmdline main.x86-64-v2.elf File opened for reading /proc/424/cmdline main.x86-64-v2.elf File opened for reading /proc/490/cmdline main.x86-64-v2.elf File opened for reading /proc/187/cmdline main.x86-64-v2.elf File opened for reading /proc/664/cmdline main.x86-64-v2.elf File opened for reading /proc/1068/cmdline main.x86-64-v2.elf File opened for reading /proc/1084/cmdline main.x86-64-v2.elf File opened for reading /proc/1499/cmdline main.x86-64-v2.elf File opened for reading /proc/81/cmdline main.x86-64-v2.elf File opened for reading /proc/98/cmdline main.x86-64-v2.elf File opened for reading /proc/175/cmdline main.x86-64-v2.elf File opened for reading /proc/435/cmdline main.x86-64-v2.elf File opened for reading /proc/495/cmdline main.x86-64-v2.elf File opened for reading /proc/1083/cmdline main.x86-64-v2.elf File opened for reading /proc/31/cmdline main.x86-64-v2.elf File opened for reading /proc/89/cmdline main.x86-64-v2.elf File opened for reading /proc/173/cmdline main.x86-64-v2.elf File opened for reading /proc/990/cmdline main.x86-64-v2.elf File opened for reading /proc/1109/cmdline main.x86-64-v2.elf File opened for reading /proc/1188/cmdline main.x86-64-v2.elf File opened for reading /proc/12/cmdline main.x86-64-v2.elf File opened for reading /proc/83/cmdline main.x86-64-v2.elf File opened for reading /proc/86/cmdline main.x86-64-v2.elf File opened for reading /proc/667/cmdline main.x86-64-v2.elf File opened for reading /proc/15/cmdline main.x86-64-v2.elf File opened for reading /proc/20/cmdline main.x86-64-v2.elf File opened for reading /proc/27/cmdline main.x86-64-v2.elf File opened for reading /proc/80/cmdline main.x86-64-v2.elf File opened for reading /proc/176/cmdline main.x86-64-v2.elf File opened for reading /proc/481/cmdline main.x86-64-v2.elf File opened for reading /proc/709/cmdline main.x86-64-v2.elf File opened for reading /proc/1107/cmdline main.x86-64-v2.elf File opened for reading /proc/183/cmdline main.x86-64-v2.elf File opened for reading /proc/473/cmdline main.x86-64-v2.elf File opened for reading /proc/1308/cmdline main.x86-64-v2.elf File opened for reading /proc/1310/cmdline main.x86-64-v2.elf File opened for reading /proc/1519/cmdline main.x86-64-v2.elf File opened for reading /proc/947/cmdline main.x86-64-v2.elf File opened for reading /proc/2/cmdline main.x86-64-v2.elf File opened for reading /proc/24/cmdline main.x86-64-v2.elf File opened for reading /proc/78/cmdline main.x86-64-v2.elf File opened for reading /proc/985/cmdline main.x86-64-v2.elf File opened for reading /proc/1206/cmdline main.x86-64-v2.elf File opened for reading /proc/22/cmdline main.x86-64-v2.elf File opened for reading /proc/82/cmdline main.x86-64-v2.elf - System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1509 lesspipe 1510 basename 1514 dirname - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.Kdat_tmp main.x86-64-v2.elf
Processes
-
/tmp/main.x86-64-v2.elf/tmp/main.x86-64-v2.elf1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:1501 -
/bin/bash/bin/bash2⤵PID:1505
-
/usr/bin/groupsgroups3⤵PID:1507
-
-
/usr/bin/lesspipelesspipe3⤵
- System Network Configuration Discovery
PID:1509 -
/usr/bin/basenamebasename /usr/bin/lesspipe4⤵
- System Network Configuration Discovery
PID:1510
-
-
/usr/bin/dirnamedirname /usr/bin/lesspipe4⤵
- System Network Configuration Discovery
PID:1514
-
-
-
/usr/bin/dircolorsdircolors -b3⤵PID:1516
-
-