Analysis
- max time kernel
149s - max time network
140s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
01/10/2026, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
main.x86-64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target main.x86-64.elf
- Size 69KB
- Sample261001-se6hdstbla
- SHA256 a33fcc308937d87ed6288e896115c8c55d89e6be080b929101dc945498418706
- MD5 b05d94930a46f045fb0ebcec49412ae2
- SHA1 56cfde92f31a8c2e38341844e4b35178aa57b4b5
- SHA512 b06009d47f98713d8d45d082f01766b313713ba9ec7d7efd487422a0e4fb94a5e48d8993a9a5773e1eebe3691d801a2735e5420ac0bff62c9fe13147eadcf100
- SSDEEP 1536:KFLA+4jUSAD3ZD7L/uoYXOY1WhARt2rCw2Ur:xjUSAND7LsWhDD
- TLSH T16A63E75AB6A3B0BCC24BC0745A5AD5B2B93178B002213D3F67C4FA312935E916769F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1492 main.x86-64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself init 1492 main.x86-64.elf -
description ioc Process File opened for reading /proc/25/cmdline main.x86-64.elf File opened for reading /proc/34/cmdline main.x86-64.elf File opened for reading /proc/81/cmdline main.x86-64.elf File opened for reading /proc/943/cmdline main.x86-64.elf File opened for reading /proc/1482/cmdline main.x86-64.elf File opened for reading /proc/1/cmdline main.x86-64.elf File opened for reading /proc/20/cmdline main.x86-64.elf File opened for reading /proc/24/cmdline main.x86-64.elf File opened for reading /proc/159/cmdline main.x86-64.elf File opened for reading /proc/907/cmdline main.x86-64.elf File opened for reading /proc/986/cmdline main.x86-64.elf File opened for reading /proc/1009/cmdline main.x86-64.elf File opened for reading /proc/1027/cmdline main.x86-64.elf File opened for reading /proc/80/cmdline main.x86-64.elf File opened for reading /proc/1044/cmdline main.x86-64.elf File opened for reading /proc/1091/cmdline main.x86-64.elf File opened for reading /proc/1096/cmdline main.x86-64.elf File opened for reading /proc/1177/cmdline main.x86-64.elf File opened for reading /proc/1196/cmdline main.x86-64.elf File opened for reading /proc/1257/cmdline main.x86-64.elf File opened for reading /proc/1383/cmdline main.x86-64.elf File opened for reading /proc/2/cmdline main.x86-64.elf File opened for reading /proc/29/cmdline main.x86-64.elf File opened for reading /proc/168/cmdline main.x86-64.elf File opened for reading /proc/1049/cmdline main.x86-64.elf File opened for reading /proc/1488/cmdline main.x86-64.elf File opened for reading /proc/1496/cmdline main.x86-64.elf File opened for reading /proc/1508/cmdline main.x86-64.elf File opened for reading /proc/6/cmdline main.x86-64.elf File opened for reading /proc/14/cmdline main.x86-64.elf File opened for reading /proc/482/cmdline main.x86-64.elf File opened for reading /proc/949/cmdline main.x86-64.elf File opened for reading /proc/1058/cmdline main.x86-64.elf File opened for reading /proc/1073/cmdline main.x86-64.elf File opened for reading /proc/1146/cmdline main.x86-64.elf File opened for reading /proc/3/cmdline main.x86-64.elf File opened for reading /proc/10/cmdline main.x86-64.elf File opened for reading /proc/31/cmdline main.x86-64.elf File opened for reading /proc/170/cmdline main.x86-64.elf File opened for reading /proc/178/cmdline main.x86-64.elf File opened for reading /proc/966/cmdline main.x86-64.elf File opened for reading /proc/1494/cmdline main.x86-64.elf File opened for reading /proc/35/cmdline main.x86-64.elf File opened for reading /proc/320/cmdline main.x86-64.elf File opened for reading /proc/999/cmdline main.x86-64.elf File opened for reading /proc/1070/cmdline main.x86-64.elf File opened for reading /proc/1457/cmdline main.x86-64.elf File opened for reading /proc/26/cmdline main.x86-64.elf File opened for reading /proc/12/cmdline main.x86-64.elf File opened for reading /proc/161/cmdline main.x86-64.elf File opened for reading /proc/242/cmdline main.x86-64.elf File opened for reading /proc/602/cmdline main.x86-64.elf File opened for reading /proc/990/cmdline main.x86-64.elf File opened for reading /proc/1019/cmdline main.x86-64.elf File opened for reading /proc/1332/cmdline main.x86-64.elf File opened for reading /proc/413/cmdline main.x86-64.elf File opened for reading /proc/1065/cmdline main.x86-64.elf File opened for reading /proc/79/cmdline main.x86-64.elf File opened for reading /proc/1055/cmdline main.x86-64.elf File opened for reading /proc/1193/cmdline main.x86-64.elf File opened for reading /proc/11/cmdline main.x86-64.elf File opened for reading /proc/167/cmdline main.x86-64.elf File opened for reading /proc/cmdline main.x86-64.elf File opened for reading /proc/902/cmdline main.x86-64.elf - System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1501 lesspipe 1502 basename 1504 dirname - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.Kdat_tmp main.x86-64.elf
Processes
-
/tmp/main.x86-64.elf/tmp/main.x86-64.elf1⤵
- Deletes itself
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
PID:1492 -
/bin/bash/bin/bash2⤵PID:1496
-
/usr/bin/groupsgroups3⤵PID:1498
-
-
/usr/bin/lesspipelesspipe3⤵
- System Network Configuration Discovery
PID:1501 -
/usr/bin/basenamebasename /usr/bin/lesspipe4⤵
- System Network Configuration Discovery
PID:1502
-
-
/usr/bin/dirnamedirname /usr/bin/lesspipe4⤵
- System Network Configuration Discovery
PID:1504
-
-
-
/usr/bin/dircolorsdircolors -b3⤵PID:1506
-
-