7f9cb5a53b69a16ad785caed6d37b1ed630040cf3359d848198f79228f75160d

Analysis

user interaction
yes
max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20/10/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f9cb5a53b69a16ad785caed6d37b1ed630040cf3359d848198f79228f75160d
Size 5.0MB
Sample261020-qrfrdszygz
SHA256 7f9cb5a53b69a16ad785caed6d37b1ed630040cf3359d848198f79228f75160d
MD5 851936a704acfe3536a0c150faefcf8e
SHA1 12ad52d17768bd85ae94e43fb13e94f7025548bf
SHA512 4dc30bf27ce784204ab9f79ef217094a0bdbe0fd6f598a5bf10c77e0bc11f19b0a80d3f050404a3c117c564776769823e653e65f4fc1d6a24231727286e90a4b
SSDEEP 49152:t/fPl6ylOqI7KsIJTFLBaaI/9Z+uWrcwjODQ5Kf5EKtNgO0GEYttsgES:pCyFLBlYJgkbTtmgE
TLSH
T13A368D4AF1A39058C0178474379FE6917424BCBECA2939373BD27B703972EA46F68E51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/sched	timedatectl
File opened for reading	/proc/cmdline	timedatectl
File opened for reading	/proc/self/status	7f9cb5a53b69a16ad785caed6d37b1ed630040cf3359d848198f79228f75160d
File opened for reading	/proc/filesystems	timedatectl
File opened for reading	/proc/self/stat	timedatectl
File opened for reading	/proc/sys/kernel/osrelease	timedatectl
File opened for reading	/proc/1/environ	timedatectl

System Time Discovery 1 TTPs 2 IoCs

Adversaries may attempt to gather the system's date and time settings.

discovery

System Time Discovery

T1124

pid	Process
1530	sh
1531	timedatectl

/tmp/7f9cb5a53b69a16ad785caed6d37b1ed630040cf3359d848198f79228f75160d
/tmp/7f9cb5a53b69a16ad785caed6d37b1ed630040cf3359d848198f79228f75160d
1⤵
- Reads runtime system information
PID:1525
- /bin/sh
  sh -c -- "locale 2>/dev/null"
  2⤵
  PID:1526
- - /usr/bin/locale
    locale
    3⤵
    PID:1527
- /bin/sh
  sh -c -- "setxkbmap -query 2>/dev/null"
  2⤵
  PID:1528
- - /usr/bin/setxkbmap
    setxkbmap -query
    3⤵
    PID:1529
- /bin/sh
  sh -c -- "timedatectl show --property=Timezone --value 2>/dev/null"
  2⤵
  - System Time Discovery
  PID:1530
- - /usr/bin/timedatectl
    timedatectl show "--property=Timezone" --value
    3⤵
    - Reads runtime system information
    - System Time Discovery
    PID:1531

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads