Analysis
- max time kernel
141s - max time network
137s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
28/08/2026, 19:09
Behavioral task
behavioral1
Sample
x86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target x86.elf
- Size 40KB
- Sample260828-xt2j7ssdrf
- SHA256 2d906364a04607ff90a84bbda506f0bbb9c657d3b91a749e31b3b8cd7d8a5470
- MD5 01d5fb407826fd012d823647d0b697b1
- SHA1 7bca4dc5f092f17d20d9701b3e0db86b5c8b6725
- SHA512 020a6a1bb6fe0ad430b925de229cce9ced1fe0aac18db0beb23f97b90bad5f545ed6e0e4416a538612ed35f5e07d3c72e66c42813de76dca169fdfe440c5ff3a
- SSDEEP 768:QXUEJfiLeXq3uUFMkf8VahvvGOGm6/nbmdEQC7gQRESueMKaaWpKGnbcuyD7UHQn:2xUuUFdDZGm6DmdEQC7NRLuenaaYKGnU
- TLSH T1A313F12B8151ACD1DF1F523BDA6E9C9F1980D20EF580B4E179C92772AA15FD90C483E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
idknotherefucku.followz.st
-
45.131.64.158
Signatures
- Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 1484 x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/23/mem x86.elf File opened for reading /proc/30/maps x86.elf File opened for reading /proc/5/maps x86.elf File opened for reading /proc/6/maps x86.elf File opened for reading /proc/8/mem x86.elf File opened for reading /proc/29/mem x86.elf File opened for reading /proc/173/maps x86.elf File opened for reading /proc/423/maps x86.elf File opened for reading /proc/664/maps x86.elf File opened for reading /proc/164/maps x86.elf File opened for reading /proc/169/maps x86.elf File opened for reading /proc/169/mem x86.elf File opened for reading /proc/176/mem x86.elf File opened for reading /proc/934/mem x86.elf File opened for reading /proc/24/mem x86.elf File opened for reading /proc/270/mem x86.elf File opened for reading /proc/901/maps x86.elf File opened for reading /proc/27/mem x86.elf File opened for reading /proc/137/maps x86.elf File opened for reading /proc/14/mem x86.elf File opened for reading /proc/81/mem x86.elf File opened for reading /proc/176/maps x86.elf File opened for reading /proc/957/maps x86.elf File opened for reading /proc/21/mem x86.elf File opened for reading /proc/29/maps x86.elf File opened for reading /proc/80/mem x86.elf File opened for reading /proc/423/mem x86.elf File opened for reading /proc/980/maps x86.elf File opened for reading /proc/14/maps x86.elf File opened for reading /proc/86/mem x86.elf File opened for reading /proc/514/mem x86.elf File opened for reading /proc/653/mem x86.elf File opened for reading /proc/324/mem x86.elf File opened for reading /proc/636/mem x86.elf File opened for reading /proc/714/mem x86.elf File opened for reading /proc/15/maps x86.elf File opened for reading /proc/34/maps x86.elf File opened for reading /proc/467/mem x86.elf File opened for reading /proc/920/maps x86.elf File opened for reading /proc/6/mem x86.elf File opened for reading /proc/18/maps x86.elf File opened for reading /proc/173/mem x86.elf File opened for reading /proc/317/mem x86.elf File opened for reading /proc/324/maps x86.elf File opened for reading /proc/466/maps x86.elf File opened for reading /proc/532/mem x86.elf File opened for reading /proc/4/maps x86.elf File opened for reading /proc/83/mem x86.elf File opened for reading /proc/4/mem x86.elf File opened for reading /proc/11/maps x86.elf File opened for reading /proc/636/maps x86.elf File opened for reading /proc/10/mem x86.elf File opened for reading /proc/16/mem x86.elf File opened for reading /proc/24/maps x86.elf File opened for reading /proc/694/mem x86.elf File opened for reading /proc/989/maps x86.elf File opened for reading /proc/597/maps x86.elf File opened for reading /proc/8/maps x86.elf File opened for reading /proc/167/mem x86.elf File opened for reading /proc/664/mem x86.elf File opened for reading /proc/891/maps x86.elf File opened for reading /proc/898/maps x86.elf File opened for reading /proc/20/maps x86.elf File opened for reading /proc/31/maps x86.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself gpioc_daemon 1484 x86.elf -
description ioc Process File opened for reading /proc/915/comm x86.elf File opened for reading /proc/1044/mem x86.elf File opened for reading /proc/1072/mem x86.elf File opened for reading /proc/89/comm x86.elf File opened for reading /proc/1299/comm x86.elf File opened for reading /proc/404/comm x86.elf File opened for reading /proc/465/comm x86.elf File opened for reading /proc/901/comm x86.elf File opened for reading /proc/714/comm x86.elf File opened for reading /proc/920/comm x86.elf File opened for reading /proc/19/comm x86.elf File opened for reading /proc/480/comm x86.elf File opened for reading /proc/1003/mem x86.elf File opened for reading /proc/1067/mem x86.elf File opened for reading /proc/1296/mem x86.elf File opened for reading /proc/1299/maps x86.elf File opened for reading /proc/270/comm x86.elf File opened for reading /proc/1056/comm x86.elf File opened for reading /proc/1164/comm x86.elf File opened for reading /proc/1145/maps x86.elf File opened for reading /proc/161/comm x86.elf File opened for reading /proc/597/comm x86.elf File opened for reading /proc/1320/comm x86.elf File opened for reading /proc/1080/maps x86.elf File opened for reading /proc/551/comm x86.elf File opened for reading /proc/1004/comm x86.elf File opened for reading /proc/1134/maps x86.elf File opened for reading /proc/1373/mem x86.elf File opened for reading /proc/11/comm x86.elf File opened for reading /proc/115/comm x86.elf File opened for reading /proc/447/comm x86.elf File opened for reading /proc/473/comm x86.elf File opened for reading /proc/9/comm x86.elf File opened for reading /proc/1011/comm x86.elf File opened for reading /proc/163/comm x86.elf File opened for reading /proc/1036/comm x86.elf File opened for reading /proc/1032/mem x86.elf File opened for reading /proc/493/comm x86.elf File opened for reading /proc/1481/comm x86.elf File opened for reading /proc/1004/mem x86.elf File opened for reading /proc/1479/mem x86.elf File opened for reading /proc/891/comm x86.elf File opened for reading /proc/1086/comm x86.elf File opened for reading /proc/1055/maps x86.elf File opened for reading /proc/1058/maps x86.elf File opened for reading /proc/1072/maps x86.elf File opened for reading /proc/1084/mem x86.elf File opened for reading /proc/29/comm x86.elf File opened for reading /proc/653/comm x86.elf File opened for reading /proc/1015/comm x86.elf File opened for reading /proc/1036/maps x86.elf File opened for reading /proc/1058/mem x86.elf File opened for reading /proc/1079/maps x86.elf File opened for reading /proc/1086/maps x86.elf File opened for reading /proc/1180/maps x86.elf File opened for reading /proc/3/comm x86.elf File opened for reading /proc/159/comm x86.elf File opened for reading /proc/160/comm x86.elf File opened for reading /proc/1023/comm x86.elf File opened for reading /proc/1019/maps x86.elf File opened for reading /proc/1492/comm x86.elf File opened for reading /proc/22/comm x86.elf File opened for reading /proc/980/comm x86.elf File opened for reading /proc/21/comm x86.elf