c546f3bdfdfd8c9f1fea82cba068138fbce4a99120cd669a19e599666af7b15d

Analysis

max time kernel
149s
max time network
133s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/08/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Okami.i586.elf
Size 81KB
Sample260830-mvndvstybt
SHA256 c546f3bdfdfd8c9f1fea82cba068138fbce4a99120cd669a19e599666af7b15d
MD5 8045cc8ddbe841fd56a011b586c7be2d
SHA1 078f20de50ed908109bccf72875cf189c636a9cb
SHA512 a3bdd3221308d6f41ae6ffbd82591dd1844b2c1736a92a9c79509964add3de6ec97f008a3d5837cb45e21929a33da1d40cbb99b0b5b039762692196290240042
SSDEEP 1536:fceZplilb33Gwukb3uRbnbnK6DJ9ys08MjgAxVcetuw6KnfZxgOq:XWb0MuR9Vz7Mjdxhe
TLSH
T1EE832982E703DEB3E46311F426FADB614972F93E0823D892F7647EB09E655C1A61532C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

credential_access discovery

Malware Config

Signatures

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	Okami.i586.elf

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 41 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/655/maps	Okami.i586.elf
File opened for reading	/proc/658/maps	Okami.i586.elf
File opened for reading	/proc/966/maps	Okami.i586.elf
File opened for reading	/proc/971/maps	Okami.i586.elf
File opened for reading	/proc/976/maps	Okami.i586.elf
File opened for reading	/proc/440/maps	Okami.i586.elf
File opened for reading	/proc/477/maps	Okami.i586.elf
File opened for reading	/proc/578/maps	Okami.i586.elf
File opened for reading	/proc/638/maps	Okami.i586.elf
File opened for reading	/proc/659/maps	Okami.i586.elf
File opened for reading	/proc/661/maps	Okami.i586.elf
File opened for reading	/proc/923/maps	Okami.i586.elf
File opened for reading	/proc/986/maps	Okami.i586.elf
File opened for reading	/proc/481/maps	Okami.i586.elf
File opened for reading	/proc/724/maps	Okami.i586.elf
File opened for reading	/proc/604/maps	Okami.i586.elf
File opened for reading	/proc/999/maps	Okami.i586.elf
File opened for reading	/proc/433/maps	Okami.i586.elf
File opened for reading	/proc/441/maps	Okami.i586.elf
File opened for reading	/proc/446/maps	Okami.i586.elf
File opened for reading	/proc/450/maps	Okami.i586.elf
File opened for reading	/proc/451/maps	Okami.i586.elf
File opened for reading	/proc/962/maps	Okami.i586.elf
File opened for reading	/proc/968/maps	Okami.i586.elf
File opened for reading	/proc/473/maps	Okami.i586.elf
File opened for reading	/proc/899/maps	Okami.i586.elf
File opened for reading	/proc/909/maps	Okami.i586.elf
File opened for reading	/proc/442/maps	Okami.i586.elf
File opened for reading	/proc/474/maps	Okami.i586.elf
File opened for reading	/proc/537/maps	Okami.i586.elf
File opened for reading	/proc/666/maps	Okami.i586.elf
File opened for reading	/proc/990/maps	Okami.i586.elf
File opened for reading	/proc/426/maps	Okami.i586.elf
File opened for reading	/proc/547/maps	Okami.i586.elf
File opened for reading	/proc/564/maps	Okami.i586.elf
File opened for reading	/proc/928/maps	Okami.i586.elf
File opened for reading	/proc/942/maps	Okami.i586.elf
File opened for reading	/proc/948/maps	Okami.i586.elf
File opened for reading	/proc/901/maps	Okami.i586.elf
File opened for reading	/proc/534/maps	Okami.i586.elf
File opened for reading	/proc/463/maps	Okami.i586.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1487	Okami.i586.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	Okami.i586.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/463/cmdline	Okami.i586.elf
File opened for reading	/proc/948/cmdline	Okami.i586.elf
File opened for reading	/proc/966/comm	Okami.i586.elf
File opened for reading	/proc/999/cmdline	Okami.i586.elf
File opened for reading	/proc/1094/comm	Okami.i586.elf
File opened for reading	/proc/1386/cmdline	Okami.i586.elf
File opened for reading	/proc/1017/maps	Okami.i586.elf
File opened for reading	/proc/1028/maps	Okami.i586.elf
File opened for reading	/proc/1057/cmdline	Okami.i586.elf
File opened for reading	/proc/1074/comm	Okami.i586.elf
File opened for reading	/proc/1132/comm	Okami.i586.elf
File opened for reading	/proc/1343/cmdline	Okami.i586.elf
File opened for reading	/proc/1351/comm	Okami.i586.elf
File opened for reading	/proc/1032/maps	Okami.i586.elf
File opened for reading	/proc/440/cmdline	Okami.i586.elf
File opened for reading	/proc/901/comm	Okami.i586.elf
File opened for reading	/proc/901/cmdline	Okami.i586.elf
File opened for reading	/proc/1069/comm	Okami.i586.elf
File opened for reading	/proc/1080/cmdline	Okami.i586.elf
File opened for reading	/proc/1093/cmdline	Okami.i586.elf
File opened for reading	/proc/1195/comm	Okami.i586.elf
File opened for reading	/proc/659/cmdline	Okami.i586.elf
File opened for reading	/proc/463/comm	Okami.i586.elf
File opened for reading	/proc/554/comm	Okami.i586.elf
File opened for reading	/proc/578/cmdline	Okami.i586.elf
File opened for reading	/proc/659/comm	Okami.i586.elf
File opened for reading	/proc/1092/comm	Okami.i586.elf
File opened for reading	/proc/1256/comm	Okami.i586.elf
File opened for reading	/proc/1310/cmdline	Okami.i586.elf
File opened for reading	/proc/450/cmdline	Okami.i586.elf
File opened for reading	/proc/999/comm	Okami.i586.elf
File opened for reading	/proc/1028/cmdline	Okami.i586.elf
File opened for reading	/proc/1068/cmdline	Okami.i586.elf
File opened for reading	/proc/1088/maps	Okami.i586.elf
File opened for reading	/proc/1310/maps	Okami.i586.elf
File opened for reading	/proc/1386/maps	Okami.i586.elf
File opened for reading	/proc/1459/cmdline	Okami.i586.elf
File opened for reading	/proc/441/comm	Okami.i586.elf
File opened for reading	/proc/474/cmdline	Okami.i586.elf
File opened for reading	/proc/477/comm	Okami.i586.elf
File opened for reading	/proc/537/comm	Okami.i586.elf
File opened for reading	/proc/909/cmdline	Okami.i586.elf
File opened for reading	/proc/1099/comm	Okami.i586.elf
File opened for reading	/proc/1386/comm	Okami.i586.elf
File opened for reading	/proc/1032/comm	Okami.i586.elf
File opened for reading	/proc/1036/comm	Okami.i586.elf
File opened for reading	/proc/655/comm	Okami.i586.elf
File opened for reading	/proc/604/comm	Okami.i586.elf
File opened for reading	/proc/962/cmdline	Okami.i586.elf
File opened for reading	/proc/1014/comm	Okami.i586.elf
File opened for reading	/proc/1094/maps	Okami.i586.elf
File opened for reading	/proc/1196/cmdline	Okami.i586.elf
File opened for reading	/proc/426/cmdline	Okami.i586.elf
File opened for reading	/proc/1050/cmdline	Okami.i586.elf
File opened for reading	/proc/1068/comm	Okami.i586.elf
File opened for reading	/proc/1069/cmdline	Okami.i586.elf
File opened for reading	/proc/1092/maps	Okami.i586.elf
File opened for reading	/proc/1132/cmdline	Okami.i586.elf
File opened for reading	/proc/1315/cmdline	Okami.i586.elf
File opened for reading	/proc/498/comm	Okami.i586.elf
File opened for reading	/proc/1071/comm	Okami.i586.elf
File opened for reading	/proc/1099/cmdline	Okami.i586.elf
File opened for reading	/proc/1147/cmdline	Okami.i586.elf
File opened for reading	/proc/1479/cmdline	Okami.i586.elf

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.okami.lock	Okami.i586.elf
File opened for modification	/tmp/.okami_key	Okami.i586.elf
File opened for modification	/tmp/.okami_token	Okami.i586.elf

/tmp/Okami.i586.elf
/tmp/Okami.i586.elf
1⤵
- Enumerates active TCP sockets
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1487

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.okami_key

Path /tmp/.okami_key
Size 32B
SHA256 44d93ab74b4057abb79665d8d9c44ae9811e3b8fb1eb4c7b64308240d995199b
MD5 1f72a2b637fe19bb41d651ecc932831a
SHA1 9e6f05f52434b118f000147fcbd2b6e089f963bf
SHA512 02ab8922edf35bab712c95b0707dae9f61b9ff417562af00d4b3716ce33fb9f56aaeeb6e1733e5d25049e798f2e3c949708bbebe0da5334a4b86e92900b762e0
MD5 SHA1 SHA512

Submit Download

.okami_token

Path /tmp/.okami_token
Size 32B
SHA256 81a1a1c9b77e8699b677b1a91c6c0622249f98f9ed642e0c95f4f79b6d763f55
MD5 072717c046048de4f9f66a85996e2c51
SHA1 0d993eb2de37c136f5bf206c695764e608ede38b
SHA512 e138713a35ba0efb6cb94aec23ccc52d657a0a4c4571c960602d9c010c2599aa5f149072eb354f1a1c87e67866e1270d1a2bb195e4a194d2268fbe668ccd3618
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads