Analysis
- max time kernel
4s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/10/2026, 12:19
Behavioral task
behavioral1
Sample
x86_64
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target x86_64
- Size 53KB
- Sample261003-phlevayamh
- SHA256 089026c4c5cab42a00247e6802d9ea2672ce3f08ed14363cc120ff36bf634f62
- MD5 c0f246aaf4a851e31424c806b1cc6013
- SHA1 43ee2219d3cf854a29a43da9ec19252afdbd300b
- SHA512 42f0bbd73cb588af3fc54c3bb2d7f4168fe960b72708aad3d5e8695c41bcc656fd22b1ed5ee2e7725a40b95c2ebe8a8db86f7627816638f9c44604963b9140c6
- SSDEEP 1536:Ru31CxXVpHlCrxsNnVfvj56+H32r4DaEXzd0OCUjCYy:Y1sXV5lCKNVfvj51X0GaEDOVUjCYy
- TLSH T1A4330907F681C0FDC49AC174476BBA3AD93771ED0238F2A67BE4EA223D96E611D19C44
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1489 x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 7 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bash 1490 x86_64 Changes the process name, possibly in an attempt to hide itself inetd 1492 x86_64 Changes the process name, possibly in an attempt to hide itself nginx 1491 x86_64 Changes the process name, possibly in an attempt to hide itself sshd 1493 x86_64 Changes the process name, possibly in an attempt to hide itself bash 1492 x86_64 Changes the process name, possibly in an attempt to hide itself inetd 1502 x86_64 Changes the process name, possibly in an attempt to hide itself sshd 1503 x86_64 -
description ioc Process File opened for reading /proc/1251/cmdline x86_64 File opened for reading /proc/1481/cmdline x86_64 File opened for reading /proc/1492/cmdline x86_64 File opened for reading /proc/901/cmdline x86_64 File opened for reading /proc/29/cmdline x86_64 File opened for reading /proc/32/cmdline x86_64 File opened for reading /proc/564/cmdline x86_64 File opened for reading /proc/990/cmdline x86_64 File opened for reading /proc/1057/cmdline x86_64 File opened for reading /proc/1195/cmdline x86_64 File opened for reading /proc/1386/cmdline x86_64 File opened for reading /proc/26/cmdline x86_64 File opened for reading /proc/426/cmdline x86_64 File opened for reading /proc/1050/cmdline x86_64 File opened for reading /proc/1459/cmdline x86_64 File opened for reading /proc/161/cmdline x86_64 File opened for reading /proc/175/cmdline x86_64 File opened for reading /proc/446/cmdline x86_64 File opened for reading /proc/454/cmdline x86_64 File opened for reading /proc/602/cmdline x86_64 File opened for reading /proc/906/cmdline x86_64 File opened for reading /proc/962/cmdline x86_64 File opened for reading /proc/31/cmdline x86_64 File opened for reading /proc/83/cmdline x86_64 File opened for reading /proc/159/cmdline x86_64 File opened for reading /proc/168/cmdline x86_64 File opened for reading /proc/174/cmdline x86_64 File opened for reading /proc/534/cmdline x86_64 File opened for reading /proc/999/cmdline x86_64 File opened for reading /proc/89/cmdline x86_64 File opened for reading /proc/638/cmdline x86_64 File opened for reading /proc/976/cmdline x86_64 File opened for reading /proc/1028/cmdline x86_64 File opened for reading /proc/1045/cmdline x86_64 File opened for reading /proc/308/cmdline x86_64 File opened for reading /proc/476/cmdline x86_64 File opened for reading /proc/1017/cmdline x86_64 File opened for reading /proc/666/cmdline x86_64 File opened for reading /proc/13/cmdline x86_64 File opened for reading /proc/23/cmdline x86_64 File opened for reading /proc/80/cmdline x86_64 File opened for reading /proc/430/cmdline x86_64 File opened for reading /proc/655/cmdline x86_64 File opened for reading /proc/661/cmdline x86_64 File opened for reading /proc/1147/cmdline x86_64 File opened for reading /proc/6/cmdline x86_64 File opened for reading /proc/8/cmdline x86_64 File opened for reading /proc/172/cmdline x86_64 File opened for reading /proc/604/cmdline x86_64 File opened for reading /proc/658/cmdline x86_64 File opened for reading /proc/942/cmdline x86_64 File opened for reading /proc/971/cmdline x86_64 File opened for reading /proc/1032/cmdline x86_64 File opened for reading /proc/22/cmdline x86_64 File opened for reading /proc/433/cmdline x86_64 File opened for reading /proc/547/cmdline x86_64 File opened for reading /proc/899/cmdline x86_64 File opened for reading /proc/1074/cmdline x86_64 File opened for reading /proc/1132/cmdline x86_64 File opened for reading /proc/1196/cmdline x86_64 File opened for reading /proc/1343/cmdline x86_64 File opened for reading /proc/24/cmdline x86_64 File opened for reading /proc/28/cmdline x86_64 File opened for reading /proc/82/cmdline x86_64