Analysis
- max time kernel
150s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/09/2026, 17:15
Static task
static1
Behavioral task
behavioral1
Sample
x86.elf
Resource
ubuntu1804-amd64-20260513-en
2 signatures
150 seconds
General
- Target x86.elf
- Size 5.6MB
- Sample260922-vsn7dabc39
- SHA256 7c785c451917ef7508ae999dc40cdbddc559927cb596f4f458a1e04c3bbbddca
- MD5 8aebe03e0dc3aabaf9c2376f71ee03dc
- SHA1 3c6ca398ca15ab95208bec0e31150bab972090ac
- SHA512 1108a36fc12d6b1924427f10cdbdd031b36f49c7ec87d4ec7541e84315d49c66fba39f854f9ce11805084ab548c6c9718e92228d23abeaed2c5927ea74bfde7a
- SSDEEP 49152:PnB6guk1KDVtS0IZR/j3yJ61xPQjYrAK24D+1OmsSnL4BTO5EW:PQgQDVtUZR/0EQjYcK24ivtEW
- TLSH T143462850FECB54F6E903193145ABA26F63316C058F25DBE7EA447F29F93BA91093220D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us Process not Found File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size Process not Found -
description ioc Process File opened for reading /proc/self/mountinfo x86.elf File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup x86.elf File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo x86.elf File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found File opened for reading /proc/self/mountinfo Process not Found File opened for reading /proc/self/cgroup Process not Found
Processes
-
/tmp/x86.elf/tmp/x86.elf1⤵PID:1491
-
/tmp/x86.elf/tmp/x86.elf2⤵PID:1495
-
/tmp/x86.elf/tmp/x86.elf3⤵PID:1499
-
/tmp/x86.elf/tmp/x86.elf4⤵PID:1503
-
/tmp/x86.elf/tmp/x86.elf5⤵PID:1507
-
/tmp/x86.elf/tmp/x86.elf6⤵PID:1512
-
/tmp/x86.elf/tmp/x86.elf7⤵PID:1516
-
/tmp/x86.elf/tmp/x86.elf8⤵PID:1521
-
/tmp/x86.elf/tmp/x86.elf9⤵PID:1525
-
/tmp/x86.elf/tmp/x86.elf10⤵PID:1529
-
/tmp/x86.elf/tmp/x86.elf11⤵PID:1533
-
/tmp/x86.elf/tmp/x86.elf12⤵PID:1537
-
/tmp/x86.elf/tmp/x86.elf13⤵PID:1541
-
/tmp/x86.elf/tmp/x86.elf14⤵PID:1545
-
/tmp/x86.elf/tmp/x86.elf15⤵PID:1549
-
/tmp/x86.elf/tmp/x86.elf16⤵PID:1553
-
/tmp/x86.elf/tmp/x86.elf17⤵PID:1557
-
/tmp/x86.elf/tmp/x86.elf18⤵PID:1561
-
/tmp/x86.elf/tmp/x86.elf19⤵PID:1565
-
/tmp/x86.elf/tmp/x86.elf20⤵PID:1569
-
/tmp/x86.elf/tmp/x86.elf21⤵PID:1573
-
/tmp/x86.elf/tmp/x86.elf22⤵PID:1577
-
/tmp/x86.elf/tmp/x86.elf23⤵PID:1581
-
/tmp/x86.elf/tmp/x86.elf24⤵PID:1585
-
/tmp/x86.elf/tmp/x86.elf25⤵PID:1589
-
/tmp/x86.elf/tmp/x86.elf26⤵PID:1593
-
/tmp/x86.elf/tmp/x86.elf27⤵PID:1597
-
/tmp/x86.elf/tmp/x86.elf28⤵PID:1601
-
/tmp/x86.elf/tmp/x86.elf29⤵PID:1604
-
/tmp/x86.elf/tmp/x86.elf30⤵PID:1607
-
/tmp/x86.elf/tmp/x86.elf31⤵PID:1610
-
/tmp/x86.elf/tmp/x86.elf32⤵PID:1615
-
/tmp/x86.elf/tmp/x86.elf33⤵PID:1619
-
/tmp/x86.elf/tmp/x86.elf34⤵PID:1625
-
/tmp/x86.elf/tmp/x86.elf35⤵PID:1629
-
/tmp/x86.elf/tmp/x86.elf36⤵PID:1634
-
/tmp/x86.elf/tmp/x86.elf37⤵PID:1638
-
/tmp/x86.elf/tmp/x86.elf38⤵PID:1642
-
/tmp/x86.elf/tmp/x86.elf39⤵PID:1646
-
/tmp/x86.elf/tmp/x86.elf40⤵PID:1650
-
/tmp/x86.elf/tmp/x86.elf41⤵PID:1654
-
/tmp/x86.elf/tmp/x86.elf42⤵PID:1658
-
/tmp/x86.elf/tmp/x86.elf43⤵PID:1662
-
/tmp/x86.elf/tmp/x86.elf44⤵PID:1666
-
/tmp/x86.elf/tmp/x86.elf45⤵PID:1670
-
/tmp/x86.elf/tmp/x86.elf46⤵PID:1674
-
/tmp/x86.elf/tmp/x86.elf47⤵PID:1678
-
/tmp/x86.elf/tmp/x86.elf48⤵PID:1682
-
/tmp/x86.elf/tmp/x86.elf49⤵PID:1686
-
/tmp/x86.elf/tmp/x86.elf50⤵PID:1690
-
/tmp/x86.elf/tmp/x86.elf51⤵PID:1694
-
/tmp/x86.elf/tmp/x86.elf52⤵PID:1698
-
/tmp/x86.elf/tmp/x86.elf53⤵PID:1702
-
/tmp/x86.elf/tmp/x86.elf54⤵PID:1706
-
/tmp/x86.elf/tmp/x86.elf55⤵PID:1710
-
/tmp/x86.elf/tmp/x86.elf56⤵PID:1714
-
/tmp/x86.elf/tmp/x86.elf57⤵PID:1718
-
/tmp/x86.elf/tmp/x86.elf58⤵PID:1722
-
/tmp/x86.elf/tmp/x86.elf59⤵PID:1726
-
/tmp/x86.elf/tmp/x86.elf60⤵PID:1730
-
/tmp/x86.elf/tmp/x86.elf61⤵PID:1734
-
/tmp/x86.elf/tmp/x86.elf62⤵PID:1738
-
/tmp/x86.elf/tmp/x86.elf63⤵PID:1742
-
/tmp/x86.elf/tmp/x86.elf64⤵PID:1746
-
/tmp/x86.elf/tmp/x86.elf65⤵PID:1750
-
/tmp/x86.elf/tmp/x86.elf66⤵PID:1754
-
/tmp/x86.elf/tmp/x86.elf67⤵PID:1758
-
/tmp/x86.elf/tmp/x86.elf68⤵PID:1762
-
/tmp/x86.elf/tmp/x86.elf69⤵PID:1766
-
/tmp/x86.elf/tmp/x86.elf70⤵PID:1770
-
/tmp/x86.elf/tmp/x86.elf71⤵PID:1774
-
/tmp/x86.elf/tmp/x86.elf72⤵PID:1778
-
/tmp/x86.elf/tmp/x86.elf73⤵PID:1782
-
/tmp/x86.elf/tmp/x86.elf74⤵PID:1786
-
/tmp/x86.elf/tmp/x86.elf75⤵PID:1790
-
/tmp/x86.elf/tmp/x86.elf76⤵PID:1794
-
/tmp/x86.elf/tmp/x86.elf77⤵PID:1798
-
/tmp/x86.elf/tmp/x86.elf78⤵PID:1802
-
/tmp/x86.elf/tmp/x86.elf79⤵PID:1806
-
/tmp/x86.elf/tmp/x86.elf80⤵PID:1810
-
/tmp/x86.elf/tmp/x86.elf81⤵PID:1814
-
/tmp/x86.elf/tmp/x86.elf82⤵PID:1818
-
/tmp/x86.elf/tmp/x86.elf83⤵PID:1822
-
/tmp/x86.elf/tmp/x86.elf84⤵PID:1826
-
/tmp/x86.elf/tmp/x86.elf85⤵PID:1830
-
/tmp/x86.elf/tmp/x86.elf86⤵PID:1834
-
/tmp/x86.elf/tmp/x86.elf87⤵PID:1838
-
/tmp/x86.elf/tmp/x86.elf88⤵PID:1842
-
/tmp/x86.elf/tmp/x86.elf89⤵PID:1846
-
/tmp/x86.elf/tmp/x86.elf90⤵PID:1850
-
/tmp/x86.elf/tmp/x86.elf91⤵PID:1854
-
/tmp/x86.elf/tmp/x86.elf92⤵PID:1858
-
/tmp/x86.elf/tmp/x86.elf93⤵PID:1862
-
/tmp/x86.elf/tmp/x86.elf94⤵PID:1866
-
/tmp/x86.elf/tmp/x86.elf95⤵PID:1870
-
/tmp/x86.elf/tmp/x86.elf96⤵PID:1874
-
/tmp/x86.elf/tmp/x86.elf97⤵PID:1878
-
/tmp/x86.elf/tmp/x86.elf98⤵PID:1882
-
/tmp/x86.elf/tmp/x86.elf99⤵PID:1886
-
/tmp/x86.elf/tmp/x86.elf100⤵PID:1890
-
/tmp/x86.elf/tmp/x86.elf101⤵PID:1894
-
/tmp/x86.elf/tmp/x86.elf102⤵PID:1898
-
/tmp/x86.elf/tmp/x86.elf103⤵PID:1902
-
/tmp/x86.elf/tmp/x86.elf104⤵PID:1906
-
/tmp/x86.elf/tmp/x86.elf105⤵PID:1910
-
/tmp/x86.elf/tmp/x86.elf106⤵PID:1914
-
/tmp/x86.elf/tmp/x86.elf107⤵PID:1918
-
/tmp/x86.elf/tmp/x86.elf108⤵PID:1922
-
/tmp/x86.elf/tmp/x86.elf109⤵PID:1926
-
/tmp/x86.elf/tmp/x86.elf110⤵PID:1930
-
/tmp/x86.elf/tmp/x86.elf111⤵PID:1934
-
/tmp/x86.elf/tmp/x86.elf112⤵PID:1938
-
/tmp/x86.elf/tmp/x86.elf113⤵PID:1942
-
/tmp/x86.elf/tmp/x86.elf114⤵PID:1946
-
/tmp/x86.elf/tmp/x86.elf115⤵PID:1950
-
/tmp/x86.elf/tmp/x86.elf116⤵PID:1954
-
/tmp/x86.elf/tmp/x86.elf117⤵PID:1958
-
/tmp/x86.elf/tmp/x86.elf118⤵PID:1962
-
/tmp/x86.elf/tmp/x86.elf119⤵PID:1966
-
/tmp/x86.elf/tmp/x86.elf120⤵PID:1970
-
/tmp/x86.elf/tmp/x86.elf121⤵PID:1974
-
/tmp/x86.elf/tmp/x86.elf122⤵PID:1978
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-