Analysis
- max time kernel
39s - max time network
41s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
24/09/2026, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
bot.i686
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
40 seconds
General
- Target bot.i686
- Size 1.0MB
- Sample260924-cbgrvsbf44
- SHA256 6e171f9d5c71b0de9c5b175ade5dca727f9afc6d2791a8e016784aa27768de29
- MD5 8f3fa9fa724c37aaa8337ea5edf0b150
- SHA1 62ae6144eee8fecc7adae3e6a2d1c3f49931c4a2
- SHA512 f240321206d9406bf1a96b10e50a56f7a23e6a9761af60225505f5c04cce99635d62e05b2fc642b33582e5a0495d75e92f856d40faa56d3b000ce54a25d4e4ef
- SSDEEP 24576:WyC+yjhA46eTu4cEVoftSjJoIPtTi6Qtq7CIb8/h:WFG46efolSftTVQtqmIbgh
- TLSH T1EF354C5BB2A374BCC557C430839BDA72AD35B46502126E7FA5C4DB302E26E702729F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/class/dmi/id/sys_vendor bot.i686 File opened for reading /sys/class/dmi/id/bios_vendor bot.i686 File opened for reading /sys/class/dmi/id/board_vendor bot.i686 File opened for reading /sys/class/dmi/id/product_name bot.i686 - Enumerates running processes
Discovers information about currently running processes on the system
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/lo/address bot.i686 File opened for reading /sys/class/net/ens3/address bot.i686 - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo bot.i686 - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/net bot.i686 -
description ioc Process File opened for reading /proc/1/cmdline bot.i686 File opened for reading /proc/2/cmdline bot.i686 File opened for reading /proc/1091/cmdline bot.i686 File opened for reading /proc/1267/cmdline bot.i686 File opened for reading /proc/173/cmdline bot.i686 File opened for reading /proc/712/cmdline bot.i686 File opened for reading /proc/910/cmdline bot.i686 File opened for reading /proc/1010/cmdline bot.i686 File opened for reading /proc/1084/cmdline bot.i686 File opened for reading /proc/25/cmdline bot.i686 File opened for reading /proc/86/cmdline bot.i686 File opened for reading /proc/972/cmdline bot.i686 File opened for reading /proc/991/cmdline bot.i686 File opened for reading /proc/1152/cmdline bot.i686 File opened for reading /proc/1381/cmdline bot.i686 File opened for reading /proc/23/cmdline bot.i686 File opened for reading /proc/32/cmdline bot.i686 File opened for reading /proc/167/cmdline bot.i686 File opened for reading /proc/175/cmdline bot.i686 File opened for reading /proc/1039/cmdline bot.i686 File opened for reading /proc/1302/cmdline bot.i686 File opened for reading /proc/6/cmdline bot.i686 File opened for reading /proc/35/cmdline bot.i686 File opened for reading /proc/248/cmdline bot.i686 File opened for reading /proc/1044/cmdline bot.i686 File opened for reading /proc/13/cmdline bot.i686 File opened for reading /proc/18/cmdline bot.i686 File opened for reading /proc/161/cmdline bot.i686 File opened for reading /proc/489/cmdline bot.i686 File opened for reading /proc/664/cmdline bot.i686 File opened for reading /proc/83/cmdline bot.i686 File opened for reading /proc/317/cmdline bot.i686 File opened for reading /proc/34/cmdline bot.i686 File opened for reading /proc/137/cmdline bot.i686 File opened for reading /proc/455/cmdline bot.i686 File opened for reading /proc/607/cmdline bot.i686 File opened for reading /proc/115/cmdline bot.i686 File opened for reading /proc/176/cmdline bot.i686 File opened for reading /proc/900/cmdline bot.i686 File opened for reading /proc/1023/cmdline bot.i686 File opened for reading /proc/27/cmdline bot.i686 File opened for reading /proc/82/cmdline bot.i686 File opened for reading /proc/421/cmdline bot.i686 File opened for reading /proc/527/cmdline bot.i686 File opened for reading /proc/554/cmdline bot.i686 File opened for reading /proc/10/cmdline bot.i686 File opened for reading /proc/5/cmdline bot.i686 File opened for reading /proc/84/cmdline bot.i686 File opened for reading /proc/170/cmdline bot.i686 File opened for reading /proc/547/cmdline bot.i686 File opened for reading /proc/1019/cmdline bot.i686 File opened for reading /proc/1052/cmdline bot.i686 File opened for reading /proc/1327/cmdline bot.i686 File opened for reading /proc/9/cmdline bot.i686 File opened for reading /proc/79/cmdline bot.i686 File opened for reading /proc/81/cmdline bot.i686 File opened for reading /proc/313/cmdline bot.i686 File opened for reading /proc/1066/cmdline bot.i686 File opened for reading /proc/1333/cmdline bot.i686 File opened for reading /proc/1490/cmdline bot.i686 File opened for reading /proc/1549/cmdline bot.i686 File opened for reading /proc/29/cmdline bot.i686 File opened for reading /proc/160/cmdline bot.i686 File opened for reading /proc/204/cmdline bot.i686 - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.zl bot.i686