Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
20/08/2026, 02:08
Static task
static1
General
- Target x86_64.elf
- Size 175KB
- Sample260820-ckskqaah97
- SHA256 dc2a1a46c9f2849eb08496416d5d040b43db95ec52ff5fc49a91ca629dccc756
- MD5 34d6522417db64211bcf226d81aebc2b
- SHA1 9007b83e14c252b3e75d2f95fbf53efbadc347cf
- SHA512 da13471cd009fca653f20c06dd27f15101831a82c72ebd61d3a07faeafc19f3c92be43b6abf6f74119a46224ff6c753e44a1b66a22ee7249a9e8b098b2a9cdd2
- SSDEEP 3072:uFEV5h/EZ9eX9jhYCMtUGI1Zw41GWLsGBQGA4/wzx0quPVMnoOK:15pEg9Rbq21lmoOK
- TLSH T11E045B1775C188FDC8D5C1B44BAFE235EA32F0591138B60F27D8AE262E4DF61AB2D650
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1469 5 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself t.me/flylegit 1469 x86_64.elf Changes the process name, possibly in an attempt to hide itself kworker/0:0 1477 x86_64.elf - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo 5 -
description ioc Process File opened for reading /proc/1545/cmdline x86_64.elf File opened for reading /proc/1629/cmdline x86_64.elf File opened for reading /proc/1816/cmdline x86_64.elf File opened for reading /proc/1823/comm x86_64.elf File opened for reading /proc/1288/comm x86_64.elf File opened for reading /proc/13/cmdline x86_64.elf File opened for reading /proc/89/cmdline x86_64.elf File opened for reading /proc/98/cmdline x86_64.elf File opened for reading /proc/156/cmdline x86_64.elf File opened for reading /proc/115/comm x86_64.elf File opened for reading /proc/429/comm x86_64.elf File opened for reading /proc/21/cmdline x86_64.elf File opened for reading /proc/1845/cmdline x86_64.elf File opened for reading /proc/200/comm x86_64.elf File opened for reading /proc/29/cmdline x86_64.elf File opened for reading /proc/1149/comm x86_64.elf File opened for reading /proc/1504/comm x86_64.elf File opened for reading /proc/665/comm x86_64.elf File opened for reading /proc/1077/comm x86_64.elf File opened for reading /proc/316/cmdline x86_64.elf File opened for reading /proc/445/cmdline x86_64.elf File opened for reading /proc/647/cmdline x86_64.elf File opened for reading /proc/956/cmdline x86_64.elf File opened for reading /proc/1527/cmdline x86_64.elf File opened for reading /proc/1998/comm x86_64.elf File opened for reading /proc/1072/cmdline x86_64.elf File opened for reading /proc/2009/comm x86_64.elf File opened for reading /proc/2050/comm x86_64.elf File opened for reading /proc/98/comm x86_64.elf File opened for reading /proc/169/cmdline x86_64.elf File opened for reading /proc/1055/cmdline x86_64.elf File opened for reading /proc/170/comm x86_64.elf File opened for reading /proc/477/comm x86_64.elf File opened for reading /proc/1017/comm x86_64.elf File opened for reading /proc/1659/cmdline x86_64.elf File opened for reading /proc/18/comm x86_64.elf File opened for reading /proc/1464/cmdline x86_64.elf File opened for reading /proc/1534/comm x86_64.elf File opened for reading /proc/22/cmdline x86_64.elf File opened for reading /proc/78/comm x86_64.elf File opened for reading /proc/83/comm x86_64.elf File opened for reading /proc/416/comm x86_64.elf File opened for reading /proc/1075/comm x86_64.elf File opened for reading /proc/949/comm x86_64.elf File opened for reading /proc/999/cmdline x86_64.elf File opened for reading /proc/1471/cmdline x86_64.elf File opened for reading /proc/160/cmdline x86_64.elf File opened for reading /proc/171/cmdline x86_64.elf File opened for reading /proc/1471/comm x86_64.elf File opened for reading /proc/1693/cmdline x86_64.elf File opened for reading /proc/1463/comm x86_64.elf File opened for reading /proc/1586/cmdline x86_64.elf File opened for reading /proc/162/comm x86_64.elf File opened for reading /proc/985/comm x86_64.elf File opened for reading /proc/1070/comm x86_64.elf File opened for reading /proc/1273/cmdline x86_64.elf File opened for reading /proc/25/comm x86_64.elf File opened for reading /proc/1326/comm x86_64.elf File opened for reading /proc/1040/cmdline x86_64.elf File opened for reading /proc/1062/cmdline x86_64.elf File opened for reading /proc/1130/cmdline x86_64.elf File opened for reading /proc/972/cmdline x86_64.elf File opened for reading /proc/1025/cmdline x86_64.elf File opened for reading /proc/2/comm x86_64.elf
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /run/.disabled.list
- Size 13B
- SHA256 28cc62c98b48bed3beca77ada5711df900365685c0c24362831decac4147b6e6
- MD5 4d3eb3aa664f8b13e009956c510978a8
- SHA1 856853c4b7c03976f235b3ac46a42c960a7553d1
- SHA512 793aae6214e4d306834ec4407f76ff078c1f83ba71b4f9a32a5caeeacc1443c9da17386b3d384f306f3d83eb4822adeb080dd72efdf792f90be08ec2289de433
- MD5 SHA1 SHA512
- Path /run/.disabled.list
- Size 28B
- SHA256 ee1b8469298c3a0f7893092a0b87371dcc76970f494298339d5eaf9a73113a46
- MD5 5f5d3495c4a2d24b2511d9cd8de2785d
- SHA1 72cb0c68cd5cd3ba2ab6dcd073c9330ec9b3a900
- SHA512 d969c34eb7fa3203ba23b2c6d5912e858c405d44039a22276ba8522dd425740360c485eade9b5ed558fc8ac1f394a8c3381a128648e9d62e029d188cb7146338
- MD5 SHA1 SHA512
- Path /run/.disabled.list
- Size 41B
- SHA256 222260ceec44631991e914d897f699100498c3b3967c9033580c97c71b8e1f49
- MD5 b9bdf4d788858c7b93e5c8d3f448fa9d
- SHA1 3524a6db4a8ed2f4db095b7688d9acf383f4a058
- SHA512 ee74bf7aabd76d8b6d6657802383dc57d864bc847e63aa92dbe4fa87702e99efac6e340cada9bb643814d67f649fba01fe8038655e210fe38a474f0010bf02e6
- MD5 SHA1 SHA512
- Path /run/.disabled.list
- Size 54B
- SHA256 e84c0150ec7fe999e90d35732e0df28e1a0970d4bf5a7b30007d0380f566d671
- MD5 1d6cd937bd675a052fd3f3c0582e1259
- SHA1 9c4ff7d8c394fe76d1ae2688af0305911de07fa3
- SHA512 4afe14aa6362b2524903dcfe946651da242a74f277280061a0eac8deecc0ec815d2ff7fff40e3aebf3e7d727d1ccd08ffca765601386902efc17e789df2ef410
- TLSH T1F4900401F40C033DCC040D374500031550C101401C10FF1004D15505C5373D33310C3D
- MD5 SHA1 SHA512 TLSH
- Path /run/.locker.pid.tmp
- Size 4B
- SHA256 e5ce886c0b0869006dc9a2da28fcd4f1f291f4a90835b75edb74587b66e5acc9
- MD5 78b9cab19959e4af8ff46156ee460c74
- SHA1 7c8d848f32fa1c53815556ee08aa8ee5994c5a51
- SHA512 adf7e3718491f26a2853ea8e397727be1f0cb8abcae556f9e2acfeab0ccfdef721614361a09c84d9cfbcea9533d1d6a93be3f870611a13d8e0cbf9ca192e2987
- MD5 SHA1 SHA512