544d81990a0f72730a8321c290324de465ba19e16b7a77ce0e559ffe9d63bdab

Analysis

max time kernel
148s
max time network
141s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/09/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wj0s.x86_64-dbg
Size 62KB
Sample260907-w2xesael5t
SHA256 544d81990a0f72730a8321c290324de465ba19e16b7a77ce0e559ffe9d63bdab
MD5 55376d63b8cfdf54d9b8cc7074705863
SHA1 7dbdba8c546b0bcccbfb1398318e4e0e1dba9be0
SHA512 2780af43e381bf289cfb262d371175da67dbd996ec833da14d09299cd36b7f7473110e49ba95e66a554250484caf64ae552dffb38ccf2ff65bba78cb25915dff
SSDEEP 1536:WRsKc/oTLdQOnYHMf8UEwkINRfaF9o516FocykSVNOnPM4C+3:vKzTLdQOYHRENC9NycykSVoE5g
TLSH
T180530197E92CE2BAC120B974613ECF807A8678638967674F3051317B4D3ABC651A0F72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	wj0s.x86_64-dbg

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ntpd	1481	wj0s.x86_64-dbg

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	wj0s.x86_64-dbg

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	wj0s.x86_64-dbg
File opened for reading	/proc/uptime	wj0s.x86_64-dbg
File opened for reading	/proc/self/status	wj0s.x86_64-dbg
File opened for reading	/proc/self/statm	wj0s.x86_64-dbg
File opened for reading	/proc/self/maps	wj0s.x86_64-dbg

/tmp/wj0s.x86_64-dbg
/tmp/wj0s.x86_64-dbg
1⤵
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1481

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads