Analysis
- max time kernel
148s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/10/2026, 12:19
Behavioral task
behavioral1
Sample
debug.dbg
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target debug.dbg
- Size 58KB
- Sample261003-phlevazvcs
- SHA256 ac9a2105efe6f38edaaa6e5af711348aab21f46bf73e53e7bdc4de66082c746c
- MD5 eceb189b5f6cc65cd2a8cedc94a5c37b
- SHA1 a1e890ff6ef4982c8d3dddb8844590e99e6e506d
- SHA512 498636106322d31387009b2d44be36bd4bfe123e63fb44f307fe64a59dae7097e5fecbb53c15e496f1ca472b45d6f245e15ed0f4dbb1efe174a349d9f4a023d5
- SSDEEP 1536:DIqD1xfYqyDgZtmYX38pJcpJoC2TwY5ts0Aj+ISeWYeOu:DIqDXfYqykZ4YX3IJcp+1wytzG+MWYeh
- TLSH T132436DC6D143D8F6E80B0570602BE72BAE71E8EA2219FF47C768D631FC86641A5179DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1498 debug.dbg - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 4 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bash 1499 debug.dbg Changes the process name, possibly in an attempt to hide itself inetd 1501 debug.dbg Changes the process name, possibly in an attempt to hide itself nginx 1500 debug.dbg Changes the process name, possibly in an attempt to hide itself sshd 1502 debug.dbg -
description ioc Process File opened for reading /proc/25/cmdline debug.dbg File opened for reading /proc/172/cmdline debug.dbg File opened for reading /proc/423/cmdline debug.dbg File opened for reading /proc/959/cmdline debug.dbg File opened for reading /proc/976/cmdline debug.dbg File opened for reading /proc/21/cmdline debug.dbg File opened for reading /proc/646/cmdline debug.dbg File opened for reading /proc/693/cmdline debug.dbg File opened for reading /proc/737/cmdline debug.dbg File opened for reading /proc/1100/cmdline debug.dbg File opened for reading /proc/1496/cmdline debug.dbg File opened for reading /proc/10/cmdline debug.dbg File opened for reading /proc/1075/cmdline debug.dbg File opened for reading /proc/1098/cmdline debug.dbg File opened for reading /proc/1312/cmdline debug.dbg File opened for reading /proc/86/cmdline debug.dbg File opened for reading /proc/211/cmdline debug.dbg File opened for reading /proc/567/cmdline debug.dbg File opened for reading /proc/1053/cmdline debug.dbg File opened for reading /proc/1093/cmdline debug.dbg File opened for reading /proc/1186/cmdline debug.dbg File opened for reading /proc/464/cmdline debug.dbg File opened for reading /proc/677/cmdline debug.dbg File opened for reading /proc/934/cmdline debug.dbg File opened for reading /proc/1103/cmdline debug.dbg File opened for reading /proc/1330/cmdline debug.dbg File opened for reading /proc/1351/cmdline debug.dbg File opened for reading /proc/13/cmdline debug.dbg File opened for reading /proc/115/cmdline debug.dbg File opened for reading /proc/173/cmdline debug.dbg File opened for reading /proc/180/cmdline debug.dbg File opened for reading /proc/452/cmdline debug.dbg File opened for reading /proc/469/cmdline debug.dbg File opened for reading /proc/1086/cmdline debug.dbg File opened for reading /proc/1272/cmdline debug.dbg File opened for reading /proc/17/cmdline debug.dbg File opened for reading /proc/20/cmdline debug.dbg File opened for reading /proc/30/cmdline debug.dbg File opened for reading /proc/175/cmdline debug.dbg File opened for reading /proc/1507/cmdline debug.dbg File opened for reading /proc/168/cmdline debug.dbg File opened for reading /proc/939/cmdline debug.dbg File opened for reading /proc/1153/cmdline debug.dbg File opened for reading /proc/1391/cmdline debug.dbg File opened for reading /proc/81/cmdline debug.dbg File opened for reading /proc/1171/cmdline debug.dbg File opened for reading /proc/1359/cmdline debug.dbg File opened for reading /proc/14/cmdline debug.dbg File opened for reading /proc/269/cmdline debug.dbg File opened for reading /proc/985/cmdline debug.dbg File opened for reading /proc/1048/cmdline debug.dbg File opened for reading /proc/1495/cmdline debug.dbg File opened for reading /proc/79/cmdline debug.dbg File opened for reading /proc/171/cmdline debug.dbg File opened for reading /proc/505/cmdline debug.dbg File opened for reading /proc/1032/cmdline debug.dbg File opened for reading /proc/82/cmdline debug.dbg File opened for reading /proc/912/cmdline debug.dbg File opened for reading /proc/1036/cmdline debug.dbg File opened for reading /proc/1040/cmdline debug.dbg File opened for reading /proc/1081/cmdline debug.dbg File opened for reading /proc/1097/cmdline debug.dbg File opened for reading /proc/1056/cmdline debug.dbg File opened for reading /proc/11/cmdline debug.dbg