Analysis
- max time kernel
149s - max time network
139s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
30/09/2026, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
bot.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
- Target bot.elf
- Size 2.4MB
- Sample260930-vcdqpsy12k
- SHA256 5401b5072072b0d8a3469f3dbc7fc62ad67f22519d029c981ed6230af40fab8a
- MD5 e30185fe71c9246f5b73e4fca18214de
- SHA1 79eb0ad141f5656bb33710e6ab038176ae26fe51
- SHA512 6013cd7c3d3ba156e26f1527a593f52e09ad09348f8d49b8f403c9a03f10312d8644a7252af5d4eb1c6d15404cc94887c573eb6d51e9b3f87ac1a1cfe82b2c9d
- SSDEEP 49152:be4sapS01jYZYGYEY4YG1S/N4Pi9u6uHb9QpToZbCpNk0e+NdHyFIj+CM6ngi48:UQUsNkkhymh2
- TLSH T1E2B55C03F66240A9D969C834835E6533B730B85A47107BEB2BD4AB103F2AFE15F39B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scan-banner 1503 bot.elf Changes the process name, possibly in an attempt to hide itself scan-telnet 1502 bot.elf Changes the process name, possibly in an attempt to hide itself killer 1501 bot.elf Changes the process name, possibly in an attempt to hide itself locker 1500 bot.elf -
description ioc Process File opened for reading /proc/1036/fd bot.elf File opened for reading /proc/166/cmdline bot.elf File opened for reading /proc/948/cmdline bot.elf File opened for reading /proc/414/fd bot.elf File opened for reading /proc/436/status bot.elf File opened for reading /proc/560/fd bot.elf File opened for reading /proc/1348/fd bot.elf File opened for reading /proc/32/cmdline bot.elf File opened for reading /proc/969/cmdline bot.elf File opened for reading /proc/1017/status bot.elf File opened for reading /proc/1335/status bot.elf File opened for reading /proc/314/cmdline bot.elf File opened for reading /proc/427/status bot.elf File opened for reading /proc/1049/fd bot.elf File opened for reading /proc/1505/fd bot.elf File opened for reading /proc/466/cmdline bot.elf File opened for reading /proc/314/status bot.elf File opened for reading /proc/1014/fd bot.elf File opened for reading /proc/161/cmdline bot.elf File opened for reading /proc/478/cmdline bot.elf File opened for reading /proc/1099/cmdline bot.elf File opened for reading /proc/672/fd bot.elf File opened for reading /proc/1387/status bot.elf File opened for reading /proc/1051/cmdline bot.elf File opened for reading /proc/1072/cmdline bot.elf File opened for reading /proc/539/fd bot.elf File opened for reading /proc/672/cmdline bot.elf File opened for reading /proc/703/fd bot.elf File opened for reading /proc/986/status bot.elf File opened for reading /proc/1024/fd bot.elf File opened for reading /proc/1057/fd bot.elf File opened for reading /proc/11/cmdline bot.elf File opened for reading /proc/536/fd bot.elf File opened for reading /proc/1089/fd bot.elf File opened for reading /proc/1093/status bot.elf File opened for reading /proc/1329/status bot.elf File opened for reading /proc/137/cmdline bot.elf File opened for reading /proc/246/cmdline bot.elf File opened for reading /proc/999/status bot.elf File opened for reading /proc/1165/status bot.elf File opened for reading /proc/1488/status bot.elf File opened for reading /proc/446/cmdline bot.elf File opened for reading /proc/536/cmdline bot.elf File opened for reading /proc/536/status bot.elf File opened for reading /proc/567/status bot.elf File opened for reading /proc/906/status bot.elf File opened for reading /proc/1166/status bot.elf File opened for reading /proc/491/cmdline bot.elf File opened for reading /proc/614/fd bot.elf File opened for reading /proc/1080/status bot.elf File opened for reading /proc/1147/fd bot.elf File opened for reading /proc/4/cmdline bot.elf File opened for reading /proc/24/cmdline bot.elf File opened for reading /proc/160/cmdline bot.elf File opened for reading /proc/500/status bot.elf File opened for reading /proc/909/status bot.elf File opened for reading /proc/999/fd bot.elf File opened for reading /proc/174/cmdline bot.elf File opened for reading /proc/1493/cmdline bot.elf File opened for reading /proc/246/status bot.elf File opened for reading /proc/34/cmdline bot.elf File opened for reading /proc/98/cmdline bot.elf File opened for reading /proc/173/cmdline bot.elf File opened for reading /proc/503/status bot.elf