5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/08/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627
Size 54KB
Sample260822-3m33ca1arc
SHA256 5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627
MD5 8a203f7c06e94fdf820afeb86e038898
SHA1 26ef4dde2ddb21a694fc0872015818da3079c9c0
SHA512 2e103c20473ca323ba82e00662de3c277011723413ffc411329e4359d6289b86ae7695a9e79f8cb8501405694430f8fc2daa72bd97a7892b676aee7d9661253c
SSDEEP 768:138zgWMUp9MN6nuZrWVrnRv7P7lKLy2wEyMBexxx/4Jj2Ywf+6DwbJ04jtlOyj:138cJUDnZ9RDEyMcx/4EYwfF++qV
TLSH
T19D43F17E8297B27AD93114BF7A6E16C4FF86442FD323633B4CE565BE48965810F20D48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm discovery

Malware Config

Signatures

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
1489	5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627

Checks hardware identifiers (DMI) 1 TTPs 1 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/uptime	5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627

/tmp/5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627
/tmp/5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627
1⤵
- Traces itself
- Checks hardware identifiers (DMI)
- Reads runtime system information
PID:1489

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads