Analysis
- max time kernel
149s - max time network
137s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
01/10/2026, 15:13
Static task
static1
Behavioral task
behavioral1
Sample
main.i486.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target main.i486.elf
- Size 33KB
- Sample261001-slvdpsty2p
- SHA256 eeafc43bb1ff4f056d0e5e8c40b6b0561889c430a27ada2e87b5f8b57df9c1ab
- MD5 c9e7088596b0b9553ff92fe59dac50bd
- SHA1 e04691c653889f0088eac8352117fdd7dec96b90
- SHA512 354c02b8442d8eb836c127083246a64a4a3540898ef6098a434a2bf9d316e712a2dd840c820dcd37adf89138ee764ed9451a14f7af412cb0bee4342dc4c6eb5f
- SSDEEP 384:fYCD2LEqB0M67wTnNJZJ6v3lzQAbuAVl8jMPWA5LaZkOfXi9yCpIUWr4doo:8LEqSDUFJ6v3lz5y+zpEvwIU
- TLSH T196E2B70ABA93C472C50330B112F29BB64531FDB765249616CB74AFB1EB156C0A2973BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1468 main.i486.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself init 1468 main.i486.elf -
description ioc Process File opened for reading /proc/969/cmdline main.i486.elf File opened for reading /proc/1176/cmdline main.i486.elf File opened for reading /proc/1471/cmdline main.i486.elf File opened for reading /proc/12/cmdline main.i486.elf File opened for reading /proc/24/cmdline main.i486.elf File opened for reading /proc/98/cmdline main.i486.elf File opened for reading /proc/665/cmdline main.i486.elf File opened for reading /proc/1007/cmdline main.i486.elf File opened for reading /proc/1236/cmdline main.i486.elf File opened for reading /proc/1464/cmdline main.i486.elf File opened for reading /proc/8/cmdline main.i486.elf File opened for reading /proc/35/cmdline main.i486.elf File opened for reading /proc/1116/cmdline main.i486.elf File opened for reading /proc/1332/cmdline main.i486.elf File opened for reading /proc/7/cmdline main.i486.elf File opened for reading /proc/165/cmdline main.i486.elf File opened for reading /proc/484/cmdline main.i486.elf File opened for reading /proc/1/cmdline main.i486.elf File opened for reading /proc/31/cmdline main.i486.elf File opened for reading /proc/164/cmdline main.i486.elf File opened for reading /proc/465/cmdline main.i486.elf File opened for reading /proc/989/cmdline main.i486.elf File opened for reading /proc/1079/cmdline main.i486.elf File opened for reading /proc/1435/cmdline main.i486.elf File opened for reading /proc/478/cmdline main.i486.elf File opened for reading /proc/1146/cmdline main.i486.elf File opened for reading /proc/173/cmdline main.i486.elf File opened for reading /proc/633/cmdline main.i486.elf File opened for reading /proc/1024/cmdline main.i486.elf File opened for reading /proc/1054/cmdline main.i486.elf File opened for reading /proc/1061/cmdline main.i486.elf File opened for reading /proc/1133/cmdline main.i486.elf File opened for reading /proc/19/cmdline main.i486.elf File opened for reading /proc/20/cmdline main.i486.elf File opened for reading /proc/166/cmdline main.i486.elf File opened for reading /proc/167/cmdline main.i486.elf File opened for reading /proc/900/cmdline main.i486.elf File opened for reading /proc/962/cmdline main.i486.elf File opened for reading /proc/1293/cmdline main.i486.elf File opened for reading /proc/1309/cmdline main.i486.elf File opened for reading /proc/163/cmdline main.i486.elf File opened for reading /proc/5/cmdline main.i486.elf File opened for reading /proc/169/cmdline main.i486.elf File opened for reading /proc/482/cmdline main.i486.elf File opened for reading /proc/1055/cmdline main.i486.elf File opened for reading /proc/1059/cmdline main.i486.elf File opened for reading /proc/1362/cmdline main.i486.elf File opened for reading /proc/4/cmdline main.i486.elf File opened for reading /proc/11/cmdline main.i486.elf File opened for reading /proc/175/cmdline main.i486.elf File opened for reading /proc/650/cmdline main.i486.elf File opened for reading /proc/1080/cmdline main.i486.elf File opened for reading /proc/84/cmdline main.i486.elf File opened for reading /proc/270/cmdline main.i486.elf File opened for reading /proc/472/cmdline main.i486.elf File opened for reading /proc/493/cmdline main.i486.elf File opened for reading /proc/520/cmdline main.i486.elf File opened for reading /proc/565/cmdline main.i486.elf File opened for reading /proc/1159/cmdline main.i486.elf File opened for reading /proc/1472/cmdline main.i486.elf File opened for reading /proc/18/cmdline main.i486.elf File opened for reading /proc/203/cmdline main.i486.elf File opened for reading /proc/1078/cmdline main.i486.elf File opened for reading /proc/1470/cmdline main.i486.elf - System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1478 lesspipe 1479 basename 1481 dirname - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.Kdat_tmp main.i486.elf
Processes
-
/tmp/main.i486.elf/tmp/main.i486.elf1⤵
- Deletes itself
- Changes its process name
- Reads runtime system information
- Writes file to tmp directory
PID:1468 -
/bin/bash/bin/bash2⤵PID:1472
-
/usr/bin/groupsgroups3⤵PID:1476
-
-
/usr/bin/lesspipelesspipe3⤵
- System Network Configuration Discovery
PID:1478 -
/usr/bin/basenamebasename /usr/bin/lesspipe4⤵
- System Network Configuration Discovery
PID:1479
-
-
/usr/bin/dirnamedirname /usr/bin/lesspipe4⤵
- System Network Configuration Discovery
PID:1481
-
-
-
/usr/bin/dircolorsdircolors -b3⤵PID:1483
-
-