Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/09/2026, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
150 seconds
General
- Target x86_64.elf
- Size 117KB
- Sample260922-e6mygaxgjg
- SHA256 f881db27f82e58f72bf6475130f23a3cf12dbec3688fcf7b15901fbb543d8c79
- MD5 cd14ed67799f6bd9358b5083e09d9dff
- SHA1 9e20ae268fb09db0a3440167a360834097e80b4a
- SHA512 b4ac6d15dc860acc5ad6b429a5599d0f83725a726e6c04634be2704200d2ecaed6f7ce106c7c2e22c1203473138949da856776bfa52e9d2167c8d3c45cda407c
- SSDEEP 1536:ehpHFQrfa7jGGFhwuEdx3UlmTZ98cyngOEK4Ybh3a/C/NqaPzgs7P+0UHregKjq:ox7hCJZWcyYO3aAJPjtULegKjq
- TLSH T15CC33B03B5D24CFAC0C7C639935B9221E537F87523126A272398AE763E2EF141F49769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Contacts a large (1840) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ksoftirqd/0 1497 x86_64.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp x86_64.elf -
description ioc Process File opened for reading /proc/1069/stat x86_64.elf File opened for reading /proc/172/stat x86_64.elf File opened for reading /proc/1348/stat x86_64.elf File opened for reading /proc/16/comm x86_64.elf File opened for reading /proc/17/comm x86_64.elf File opened for reading /proc/79/cmdline x86_64.elf File opened for reading /proc/202/comm x86_64.elf File opened for reading /proc/1072/fd x86_64.elf File opened for reading /proc/1045/stat x86_64.elf File opened for reading /proc/1071/comm x86_64.elf File opened for reading /proc/560/fd x86_64.elf File opened for reading /proc/4/comm x86_64.elf File opened for reading /proc/78/stat x86_64.elf File opened for reading /proc/81/stat x86_64.elf File opened for reading /proc/648/comm x86_64.elf File opened for reading /proc/1099/cmdline x86_64.elf File opened for reading /proc/5/stat x86_64.elf File opened for reading /proc/89/stat x86_64.elf File opened for reading /proc/175/comm x86_64.elf File opened for reading /proc/1166/comm x86_64.elf File opened for reading /proc/1289/cmdline x86_64.elf File opened for reading /proc/10/fd x86_64.elf File opened for reading /proc/28/fd x86_64.elf File opened for reading /proc/1090/fd x86_64.elf File opened for reading /proc/15/stat x86_64.elf File opened for reading /proc/170/stat x86_64.elf File opened for reading /proc/82/comm x86_64.elf File opened for reading /proc/89/cmdline x86_64.elf File opened for reading /proc/158/cmdline x86_64.elf File opened for reading /proc/174/cmdline x86_64.elf File opened for reading /proc/1094/fd x86_64.elf File opened for reading /proc/82/stat x86_64.elf File opened for reading /proc/83/stat x86_64.elf File opened for reading /proc/1490/stat x86_64.elf File opened for reading /proc/21/cmdline x86_64.elf File opened for reading /proc/27/cmdline x86_64.elf File opened for reading /proc/1036/fd x86_64.elf File opened for reading /proc/32/stat x86_64.elf File opened for reading /proc/159/stat x86_64.elf File opened for reading /proc/971/stat x86_64.elf File opened for reading /proc/22/cmdline x86_64.elf File opened for reading /proc/78/comm x86_64.elf File opened for reading /proc/203/cmdline x86_64.elf File opened for reading /proc/202/fd x86_64.elf File opened for reading /proc/1054/fd x86_64.elf File opened for reading /proc/314/stat x86_64.elf File opened for reading /proc/15/comm x86_64.elf File opened for reading /proc/909/cmdline x86_64.elf File opened for reading /proc/1072/cmdline x86_64.elf File opened for reading /proc/18/fd x86_64.elf File opened for reading /proc/171/fd x86_64.elf File opened for reading /proc/648/fd x86_64.elf File opened for reading /proc/1387/fd x86_64.elf File opened for reading /proc/86/comm x86_64.elf File opened for reading /proc/246/comm x86_64.elf File opened for reading /proc/901/comm x86_64.elf File opened for reading /proc/966/fd x86_64.elf File opened for reading /proc/5/comm x86_64.elf File opened for reading /proc/23/cmdline x86_64.elf File opened for reading /proc/79/comm x86_64.elf File opened for reading /proc/82/cmdline x86_64.elf File opened for reading /proc/1051/stat x86_64.elf File opened for reading /proc/478/cmdline x86_64.elf File opened for reading /proc/962/cmdline x86_64.elf