Analysis
- max time kernel
148s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/10/2026, 12:19
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target x86
- Size 49KB
- Sample261003-phlevayamg
- SHA256 c9507ccbf6580dc69ff21e9bdc3a7577a91a512abbacb0c77a6d8331bd8c8a74
- MD5 0902f3aef2f121d795523dfc003b0162
- SHA1 9dee4a1e51b07df63c747c4346827f69db5937f5
- SHA512 021e98feaef18aadadbb7270d4c2d5ed2ff4dfd68057f3a0a9613507283d75a704d4cf9f87b9a45dc61ef14c7bf8714bf1a33a22264ab22bd7011b5763652af8
- SSDEEP 1536:GWa2d5sf1Gg+ya+nlQ5F0ffDRTfwVsp3MSfCYq:Gt2d5sf1GCammr0ndjMW3dCYq
- TLSH T14C335AC4F643DAF8EC5705701177FB339A32F5E51229E743C3A99A32AC52602A906EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1540 x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bash 1541 x86 Changes the process name, possibly in an attempt to hide itself inetd 1543 x86 Changes the process name, possibly in an attempt to hide itself nginx 1542 x86 Changes the process name, possibly in an attempt to hide itself sshd 1544 x86 -
description ioc Process File opened for reading /proc/115/cmdline x86 File opened for reading /proc/181/cmdline x86 File opened for reading /proc/278/cmdline x86 File opened for reading /proc/915/cmdline x86 File opened for reading /proc/78/cmdline x86 File opened for reading /proc/482/cmdline x86 File opened for reading /proc/672/cmdline x86 File opened for reading /proc/29/cmdline x86 File opened for reading /proc/80/cmdline x86 File opened for reading /proc/167/cmdline x86 File opened for reading /proc/532/cmdline x86 File opened for reading /proc/974/cmdline x86 File opened for reading /proc/1060/cmdline x86 File opened for reading /proc/1135/cmdline x86 File opened for reading /proc/1170/cmdline x86 File opened for reading /proc/908/cmdline x86 File opened for reading /proc/4/cmdline x86 File opened for reading /proc/14/cmdline x86 File opened for reading /proc/175/cmdline x86 File opened for reading /proc/501/cmdline x86 File opened for reading /proc/505/cmdline x86 File opened for reading /proc/666/cmdline x86 File opened for reading /proc/1073/cmdline x86 File opened for reading /proc/86/cmdline x86 File opened for reading /proc/541/cmdline x86 File opened for reading /proc/1047/cmdline x86 File opened for reading /proc/171/cmdline x86 File opened for reading /proc/82/cmdline x86 File opened for reading /proc/918/cmdline x86 File opened for reading /proc/12/cmdline x86 File opened for reading /proc/79/cmdline x86 File opened for reading /proc/170/cmdline x86 File opened for reading /proc/174/cmdline x86 File opened for reading /proc/180/cmdline x86 File opened for reading /proc/325/cmdline x86 File opened for reading /proc/506/cmdline x86 File opened for reading /proc/684/cmdline x86 File opened for reading /proc/490/cmdline x86 File opened for reading /proc/1039/cmdline x86 File opened for reading /proc/1043/cmdline x86 File opened for reading /proc/1103/cmdline x86 File opened for reading /proc/1259/cmdline x86 File opened for reading /proc/89/cmdline x86 File opened for reading /proc/497/cmdline x86 File opened for reading /proc/689/cmdline x86 File opened for reading /proc/1027/cmdline x86 File opened for reading /proc/1096/cmdline x86 File opened for reading /proc/1422/cmdline x86 File opened for reading /proc/7/cmdline x86 File opened for reading /proc/30/cmdline x86 File opened for reading /proc/32/cmdline x86 File opened for reading /proc/178/cmdline x86 File opened for reading /proc/1056/cmdline x86 File opened for reading /proc/1085/cmdline x86 File opened for reading /proc/1537/cmdline x86 File opened for reading /proc/1538/cmdline x86 File opened for reading /proc/1091/cmdline x86 File opened for reading /proc/1171/cmdline x86 File opened for reading /proc/1331/cmdline x86 File opened for reading /proc/1543/cmdline x86 File opened for reading /proc/31/cmdline x86 File opened for reading /proc/251/cmdline x86 File opened for reading /proc/464/cmdline x86 File opened for reading /proc/658/cmdline x86