Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
30/09/2026, 12:22
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu1804-amd64-20260513-en
6 signatures
150 seconds
General
- Target x86
- Size 114KB
- Sample260930-pjyfssfa63
- SHA256 d69646fd3d22c5fa656d78976af064b3829ff3d62b9e8e664db96d8c1093fd6a
- MD5 e0a70e2d0f3489ec03afb2a22bde67a1
- SHA1 d5266ed0728c01d753d6ce05f867b3969bec85ea
- SHA512 2e3374964c86f943b39246121b9dd3ac4a563dd332dbaa0858d124432caf11a26d5020c52f96551939ba07b1a1f1908e69686866c5c30a69d13cf37e9c470cbb
- SSDEEP 1536:ao/Gy+rpPSZj6wjP2Lny2xuW7ssStWidvlWsXUJBCM+fhASiPlNFAY:auGFrpS6wqJxn7ssQ/vl1UvC79+aY
- TLSH T199B34A84F64FD0F2E94625B52137A7368732FD3A003DDA53D3A9EA32AC93510DA1A35D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (66217) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Renames itself 1 IoCs
pid Process 1506 x86 - Unexpected DNS network traffic destination 34 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.36.144.87 Destination IP 51.158.108.203 Destination IP 137.220.52.23 Destination IP 64.176.6.48 Destination IP 64.176.6.48 Destination IP 185.181.61.24 Destination IP 178.254.22.166 Destination IP 70.34.254.19 Destination IP 194.36.144.87 Destination IP 70.34.254.19 Destination IP 70.34.254.19 Destination IP 194.36.144.87 Destination IP 185.181.61.24 Destination IP 51.158.108.203 Destination IP 5.161.109.23 Destination IP 178.254.22.166 Destination IP 5.161.109.23 Destination IP 80.152.203.134 Destination IP 80.152.203.134 Destination IP 137.220.52.23 Destination IP 64.176.6.48 Destination IP 152.53.15.127 Destination IP 81.169.136.222 Destination IP 137.220.52.23 Destination IP 202.61.197.122 Destination IP 168.235.111.72 Destination IP 80.152.203.134 Destination IP 81.169.136.222 Destination IP 64.176.6.48 Destination IP 139.84.165.176 Destination IP 51.158.108.203 Destination IP 64.176.6.48 Destination IP 81.169.136.222 Destination IP 51.158.108.203 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /bin/busybox telentd 1506 x86 -
description ioc Process File opened for reading /proc/mounts x86 File opened for reading /proc/1515/status x86 File opened for reading /proc/1/cmdline x86