Analysis
- user interaction
yes - max time kernel
0s - max time network
13s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
20/08/2026, 00:07
Static task
static1
Behavioral task
behavioral1
Sample
perfcc
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target perfcc
- Size 10.6MB
- Sample260820-aejdrayybx
- SHA256 51e42cb2dd6ec6d9cf808eeda2cc6fa5cf8201e9e0e92345655368a9afae7edb
- MD5 0c07475851a9329d988f0059bdf160fe
- SHA1 0cb1ad9633352b3d8eed4fe8af41514756867edd
- SHA512 173abcc24aaf8c390bb9876074708b8e94dc9838bce583303e8be3f96f234e624e4cda0f9098486d2a170d17f010b7f0470516b58fb99eee6866d02b6d168159
- SSDEEP 196608:dIvRNiY2tvHgwwa++T4jspYro3UNdqpri2sM5msk7xO7tpDjOAgnn:dIvRNUBy+T4j+kKY2f5MO7Q
- TLSH T1C5B62347FA405F97C9A9417988D2C7B163F6E208E64247233BD89728FCBF2615F99C81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads list of loaded kernel modules 1 TTPs 1 IoCs
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
description ioc Process File opened for reading /proc/modules perfcc - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo perfcc - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size perfcc -
description ioc Process File opened for reading /proc/1142/task/1148 perfcc File opened for reading /proc/1290/task/1302/fdinfo perfcc File opened for reading /proc/1361/task/1447/net perfcc File opened for reading /proc/948/net perfcc File opened for reading /proc/1122/task/1123/fdinfo perfcc File opened for reading /proc/922/task/922/attr/smack perfcc File opened for reading /proc/1044/task/1094/attr perfcc File opened for reading /proc/1068/task/1070/attr/selinux perfcc File opened for reading /proc/1290/task/1307/attr/smack perfcc File opened for reading /proc/478/task/478/attr perfcc File opened for reading /proc/1055 perfcc File opened for reading /proc/545/task/545/net/netfilter perfcc File opened for reading /proc/1069/task/1111/net/dev_snmp6 perfcc File opened for reading /proc/1437/task/1437 perfcc File opened for reading /proc/170/net/stat perfcc File opened for reading /proc/928/task/930/attr perfcc File opened for reading /proc/98/net perfcc File opened for reading /proc/1013/task/1014/fdinfo perfcc File opened for reading /proc/1173/task/1234/attr perfcc File opened for reading /proc/1472/task/1475/attr perfcc File opened for reading /proc/1067/task/1109/attr perfcc File opened for reading /proc/1290/fd perfcc File opened for reading /proc/172/ns perfcc File opened for reading /proc/509/task/524/attr/selinux perfcc File opened for reading /proc/699/task/896 perfcc File opened for reading /proc/922/task/940/attr/smack perfcc File opened for reading /proc/968/environ perfcc File opened for reading /proc/1049/task/1054/attr/smack perfcc File opened for reading /proc/1275/attr/apparmor perfcc File opened for reading /proc/922/task/925/net perfcc File opened for reading /proc/56/environ perfcc File opened for reading /proc/1013/net/stat perfcc File opened for reading /proc/1068/attr/apparmor perfcc File opened for reading /proc/955/map_files perfcc File opened for reading /proc/1034/ns perfcc File opened for reading /proc/1066/task/1101/ns perfcc File opened for reading /proc/1467/task/1467/net/stat perfcc File opened for reading /proc/17/net/dev_snmp6 perfcc File opened for reading /proc/31/task/31/fdinfo perfcc File opened for reading /proc/945/net/stat perfcc File opened for reading /proc/20/fd perfcc File opened for reading /proc/445/attr/smack perfcc File opened for reading /proc/1055/fd perfcc File opened for reading /proc/1472/attr perfcc File opened for reading /proc/699/task/894/attr/selinux perfcc File opened for reading /proc/7/attr/smack perfcc File opened for reading /proc/1173/task/1173/attr/apparmor perfcc File opened for reading /proc/166/task/166 perfcc File opened for reading /proc/628/fd perfcc File opened for reading /proc/965/task/979/fdinfo perfcc File opened for reading /proc/1027/fd perfcc File opened for reading /proc/627/task/646/fdinfo perfcc File opened for reading /proc/433/attr/smack perfcc File opened for reading /proc/653/task/653/net/dev_snmp6 perfcc File opened for reading /proc/1034/task/1034/fdinfo perfcc File opened for reading /proc/1329/task/1333/net/stat perfcc File opened for reading /proc/1437/task/1444/attr perfcc File opened for reading /proc/1229/task/1232/net/dev_snmp6 perfcc File opened for reading /proc/1322/task/1326/net/dev_snmp6 perfcc File opened for reading /proc/1290/task/1302/attr/smack perfcc File opened for reading /proc/35/task/35/ns perfcc File opened for reading /proc/1001/net/netfilter perfcc File opened for reading /proc/1034/task/1034/net perfcc File opened for reading /proc/1055/task/1086/net/netfilter perfcc