Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/10/2026, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
kushnet.x64-test
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
150 seconds
General
- Target kushnet.x64-test
- Size 1014KB
- Sample261002-pmgbpaaa25
- SHA256 f6fbb28a2648634d262e7a8786ad78302e0c9d0c93ab7f541f1c5c8856591fd4
- MD5 0d209ec81c1f81dc59153c30c72c779a
- SHA1 1f2808401ba2a0fa6870b093508c8e0724feeb6a
- SHA512 8642bd3d934d3be8de19898e25e8b848e1baf57e0c6132f5daf65dcbc8f176173c634931dd83c140dfd7f28731d201514b9eb72acce7497b11aff0d171544a2a
- SSDEEP 24576:1A5VMM+pNgtSnOMDdVFoIQtcuEXrhq8J:G+pNgDWdVFoYN
- TLSH T136256C2AB2B3B17CD007C03447DBCAA25531B07526327D7F36C59A353EA6DE12369B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Contacts a large (774) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp kushnet.x64-test - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/13/maps kushnet.x64-test File opened for reading /proc/28/maps kushnet.x64-test File opened for reading /proc/35/maps kushnet.x64-test File opened for reading /proc/80/maps kushnet.x64-test File opened for reading /proc/84/maps kushnet.x64-test File opened for reading /proc/86/maps kushnet.x64-test File opened for reading /proc/179/maps kushnet.x64-test File opened for reading /proc/36/maps kushnet.x64-test File opened for reading /proc/178/maps kushnet.x64-test File opened for reading /proc/16/maps kushnet.x64-test File opened for reading /proc/29/maps kushnet.x64-test File opened for reading /proc/180/maps kushnet.x64-test File opened for reading /proc/17/maps kushnet.x64-test File opened for reading /proc/30/maps kushnet.x64-test File opened for reading /proc/32/maps kushnet.x64-test File opened for reading /proc/81/maps kushnet.x64-test File opened for reading /proc/6/maps kushnet.x64-test File opened for reading /proc/10/maps kushnet.x64-test File opened for reading /proc/26/maps kushnet.x64-test File opened for reading /proc/27/maps kushnet.x64-test File opened for reading /proc/83/maps kushnet.x64-test File opened for reading /proc/172/maps kushnet.x64-test File opened for reading /proc/176/maps kushnet.x64-test File opened for reading /proc/186/maps kushnet.x64-test File opened for reading /proc/11/maps kushnet.x64-test File opened for reading /proc/15/maps kushnet.x64-test File opened for reading /proc/19/maps kushnet.x64-test File opened for reading /proc/22/maps kushnet.x64-test File opened for reading /proc/184/maps kushnet.x64-test File opened for reading /proc/4/maps kushnet.x64-test File opened for reading /proc/7/maps kushnet.x64-test File opened for reading /proc/115/maps kushnet.x64-test File opened for reading /proc/173/maps kushnet.x64-test File opened for reading /proc/177/maps kushnet.x64-test File opened for reading /proc/3/maps kushnet.x64-test File opened for reading /proc/21/maps kushnet.x64-test File opened for reading /proc/24/maps kushnet.x64-test File opened for reading /proc/89/maps kushnet.x64-test File opened for reading /proc/175/maps kushnet.x64-test File opened for reading /proc/20/maps kushnet.x64-test File opened for reading /proc/78/maps kushnet.x64-test File opened for reading /proc/170/maps kushnet.x64-test File opened for reading /proc/174/maps kushnet.x64-test File opened for reading /proc/5/maps kushnet.x64-test File opened for reading /proc/8/maps kushnet.x64-test File opened for reading /proc/9/maps kushnet.x64-test File opened for reading /proc/23/maps kushnet.x64-test File opened for reading /proc/79/maps kushnet.x64-test File opened for reading /proc/182/maps kushnet.x64-test File opened for reading /proc/25/maps kushnet.x64-test File opened for reading /proc/171/maps kushnet.x64-test File opened for reading /proc/214/maps kushnet.x64-test File opened for reading /proc/181/maps kushnet.x64-test File opened for reading /proc/183/maps kushnet.x64-test File opened for reading /proc/12/maps kushnet.x64-test File opened for reading /proc/18/maps kushnet.x64-test File opened for reading /proc/188/maps kushnet.x64-test File opened for reading /proc/34/maps kushnet.x64-test File opened for reading /proc/169/maps kushnet.x64-test File opened for reading /proc/213/maps kushnet.x64-test File opened for reading /proc/14/maps kushnet.x64-test File opened for reading /proc/31/maps kushnet.x64-test File opened for reading /proc/82/maps kushnet.x64-test File opened for reading /proc/98/maps kushnet.x64-test - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp kushnet.x64-test - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/systemd/system.slice/packagekit.service kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/atd.service kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/swapfile.swap/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/cups.service kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/unattended-upgrades.service kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/wpa_supplicant.service kushnet.x64-test File opened for reading /sys/fs/cgroup/cpu,cpuacct/user.slice/user-0.slice/[email protected]/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/user.slice/user-0.slice/[email protected]/gvfs-afc-volume-monitor.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/user.slice/user-0.slice/[email protected]/gvfs-goa-volume-monitor.service kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/bolt.service kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/kerneloops.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/user.slice/user-0.slice/[email protected]/gvfs-afc-volume-monitor.service kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/snapd.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/upower.service kushnet.x64-test File opened for reading /sys/fs/cgroup/memory kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/sys-fs-fuse-connections.mount/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/user.slice/user-0.slice/[email protected]/gvfs-goa-volume-monitor.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/swapfile.swap kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/systemd-resolved.service kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/dbus.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/user.slice/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/avahi-daemon.service kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/user.slice kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/system-getty.slice kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/user.slice/user-0.slice/[email protected]/gvfs-mtp-volume-monitor.service kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/upower.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/user.slice/user-0.slice/session-1.scope/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/user.slice/user-0.slice/[email protected]/gvfs-mtp-volume-monitor.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/user.slice/user-0.slice/session-1.scope/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/systemd-udevd.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/snapd.socket/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/systemd-resolved.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/packagekit.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/sys-kernel-debug.mount/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/user.slice/user-0.slice/[email protected]/gvfs-daemon.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/upower.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/polkit.service kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/cron.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/sys-fs-fuse-connections.mount kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/system-serial\x2dgetty.slice/[email protected]/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/sys-kernel-debug.mount/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/user.slice/user-0.slice/[email protected]/at-spi-dbus-bus.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/polkit.service kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/acpid.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/udisks2.service kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/user.slice/user-0.slice/[email protected]/gvfs-goa-volume-monitor.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/sys-fs-fuse-connections.mount kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/networkd-dispatcher.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/upower.service kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/system.slice/system-getty.slice/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/ModemManager.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/systemd-journald.service/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/unattended-upgrades.service kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/system-getty.slice kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/system-serial\x2dgetty.slice/[email protected] kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/networkd-dispatcher.service kushnet.x64-test File opened for reading /sys/fs/cgroup/systemd/system.slice/ssh.service kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/system-getty.slice kushnet.x64-test File opened for reading /sys/fs/cgroup/unified/init.scope/cgroup.procs kushnet.x64-test File opened for reading /sys/fs/cgroup/devices/system.slice/sys-kernel-debug.mount kushnet.x64-test File opened for reading /sys/fs/cgroup/pids/system.slice/anacron.service kushnet.x64-test -
description ioc Process File opened for reading /proc/1107/comm kushnet.x64-test File opened for reading /proc/180/mounts kushnet.x64-test File opened for reading /proc/426/mounts kushnet.x64-test File opened for reading /proc/22/comm kushnet.x64-test File opened for reading /proc/449/status kushnet.x64-test File opened for reading /proc/609/comm kushnet.x64-test File opened for reading /proc/1117/comm kushnet.x64-test File opened for reading /proc/1551/mounts kushnet.x64-test File opened for reading /proc/31/mounts kushnet.x64-test File opened for reading /proc/188/mounts kushnet.x64-test File opened for reading /proc/734/mounts kushnet.x64-test File opened for reading /proc/22/cmdline kushnet.x64-test File opened for reading /proc/180/status kushnet.x64-test File opened for reading /proc/440/status kushnet.x64-test File opened for reading /proc/990/cmdline kushnet.x64-test File opened for reading /proc/1349/comm kushnet.x64-test File opened for reading /proc/115/mounts kushnet.x64-test File opened for reading /proc/26/status kushnet.x64-test File opened for reading /proc/579/comm kushnet.x64-test File opened for reading /proc/1546/mounts kushnet.x64-test File opened for reading /proc/1548/mounts kushnet.x64-test File opened for reading /proc/182/comm kushnet.x64-test File opened for reading /proc/993/cmdline kushnet.x64-test File opened for reading /proc/81/mounts kushnet.x64-test File opened for reading /proc/555/mounts kushnet.x64-test File opened for reading /proc/1196/cmdline kushnet.x64-test File opened for reading /proc/1545/mounts kushnet.x64-test File opened for reading /proc/32/comm kushnet.x64-test File opened for reading /proc/176/cmdline kushnet.x64-test File opened for reading /proc/930/comm kushnet.x64-test File opened for reading /proc/178/mounts kushnet.x64-test File opened for reading /proc/17/cmdline kushnet.x64-test File opened for reading /proc/19/cmdline kushnet.x64-test File opened for reading /proc/425/comm kushnet.x64-test File opened for reading /proc/550/mounts kushnet.x64-test File opened for reading /proc/1070/mounts kushnet.x64-test File opened for reading /proc/1182/mounts kushnet.x64-test File opened for reading /proc/1112/status kushnet.x64-test File opened for reading /proc/1565/mounts kushnet.x64-test File opened for reading /proc/80/cmdline kushnet.x64-test File opened for reading /proc/609/status kushnet.x64-test File opened for reading /proc/1571/status kushnet.x64-test File opened for reading /proc/1569/mounts kushnet.x64-test File opened for reading /proc/2/mounts kushnet.x64-test File opened for reading /proc/13/mounts kushnet.x64-test File opened for reading /proc/18/mounts kushnet.x64-test File opened for reading /proc/1011/cmdline kushnet.x64-test File opened for reading /proc/1052/cmdline kushnet.x64-test File opened for reading /proc/1561/status kushnet.x64-test File opened for reading /proc/1560/mounts kushnet.x64-test File opened for reading /proc/169/mounts kushnet.x64-test File opened for reading /proc/586/mounts kushnet.x64-test File opened for reading /proc/27/cmdline kushnet.x64-test File opened for reading /proc/1579/comm kushnet.x64-test File opened for reading /proc/14/mounts kushnet.x64-test File opened for reading /proc/171/status kushnet.x64-test File opened for reading /proc/712/comm kushnet.x64-test File opened for reading /proc/1183/cmdline kushnet.x64-test File opened for reading /proc/1545/status kushnet.x64-test File opened for reading /proc/83/mounts kushnet.x64-test File opened for reading /proc/81/status kushnet.x64-test File opened for reading /proc/578/comm kushnet.x64-test File opened for reading /proc/1089/status kushnet.x64-test File opened for reading /proc/175/mounts kushnet.x64-test
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/KUSHNET.claimed
- Size 22B
- SHA256 76797708e7ecc4089fc3aef2dc1525680cd452b3b6843821a3de8fbd26eeb6de
- MD5 e422ab5c0618c4a58a9d9b26f7283c53
- SHA1 baff08a151720214cd130f99b9967acbd2088070
- SHA512 245e6c1df3c18b0db105d1d3c73509b8b8656ad688485ce26cf03953ff344eddae6b138139c3371f7e619f38de13fa80cb2f28cf4569209b2270aaacf6f826fb
- MD5 SHA1 SHA512