c6e9fccdcdb931bae1383e2a506b35380102d1926fbb59af1427a41fb445c15e

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/10/2026, 18:24

Target
sample
Size 29KB
Sample261022-w2dbxaev8s
SHA256 c6e9fccdcdb931bae1383e2a506b35380102d1926fbb59af1427a41fb445c15e
MD5 188438de240e6b21565650cb6220d8c1
SHA1 90a1082dda85d2e7ae976dd98708ed370dd27055
SHA512 70f4268374a9c3abf069731d4ed1d8f4551c8c1bde9fefe2a49669a216ef552b699b8e6634609992a5fcf08a22741fcb5a59d94c83d1e7354f96d8e0b386bf10
SSDEEP 768:hieR9etyDKdrke/cLgq3sHb49bdx8ACJWGP90:hpc0C90
TLSH
T12FD209A3A70C177269D003A5BE4F91905F2865290B6658B9F1DFF49D332806F6273BD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	id

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.2699a9c6acc46d29	curl

/tmp/sample
/tmp/sample
1⤵
PID:1563
- /bin/uname
  uname -s
  2⤵
  PID:1564
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:1565
- /bin/uname
  uname -m
  2⤵
  PID:1566
- /bin/mktemp
  mktemp -d
  2⤵
  PID:1567
- /usr/bin/curl
  curl -fsSL --proto "=https" --proto-redir "=https" --tlsv1.2 --retry 3 --connect-timeout 15 --speed-limit 1024 --speed-time 60 -o /tmp/tmp.ArX2FfwGCv/latest.txt https://get.kelva.sh/agent/latest.txt
  2⤵
  - Writes file to tmp directory
  PID:1568
- /bin/rm
  rm -rf /tmp/tmp.ArX2FfwGCv
  2⤵
  PID:1577