Analysis
- max time kernel
145s - max time network
148s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
23/10/2026, 07:55
Static task
static1
Behavioral task
behavioral1
Sample
180.93.116.203_sample.bin
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
7 signatures
150 seconds
General
- Target 180.93.116.203_sample.bin
- Size 88KB
- Sample261023-jsmsrsaw2v
- SHA256 aa8c39533cada754929d2b0d27af2c6b522264e8fdc4531177eb823e77fa71f9
- MD5 75fe2c8b76b5aa0b92aaafdd39c70c8e
- SHA1 a1593711b19b5e956109b7d80fa7d9ada7ade4e5
- SHA512 8112c7cc0c5f15e8cc4c63c3ac1038fd063349bca7d0ab536e33bf495217ecd99517970751df7a17559d11f5ce8cf72dd29f1d007b7bc6f5649a57f713a3bdd7
- SSDEEP 1536:tkfigz+A4CSBAbkNKMCZn/Tuxz+Ftr8lBrxWoJr/SZrNzarXPflFHsiScWoV:+qgz+A4/ybkAusFwxPWFabP9FMr1o
- TLSH T186935BC5F243D0F6EC6705716037E7325B32F1B91119EB43D768AA36DC92942EA0AB9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 1521 180.93.116.203_sample.bin - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 1521 180.93.116.203_sample.bin 1522 180.93.116.203_sample.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/15/maps 180.93.116.203_sample.bin File opened for reading /proc/7/maps 180.93.116.203_sample.bin File opened for reading /proc/31/maps 180.93.116.203_sample.bin File opened for reading /proc/82/maps 180.93.116.203_sample.bin File opened for reading /proc/156/maps 180.93.116.203_sample.bin File opened for reading /proc/164/maps 180.93.116.203_sample.bin File opened for reading /proc/4/maps 180.93.116.203_sample.bin File opened for reading /proc/23/maps 180.93.116.203_sample.bin File opened for reading /proc/115/maps 180.93.116.203_sample.bin File opened for reading /proc/155/maps 180.93.116.203_sample.bin File opened for reading /proc/172/maps 180.93.116.203_sample.bin File opened for reading /proc/5/maps 180.93.116.203_sample.bin File opened for reading /proc/21/maps 180.93.116.203_sample.bin File opened for reading /proc/78/maps 180.93.116.203_sample.bin File opened for reading /proc/89/maps 180.93.116.203_sample.bin File opened for reading /proc/98/maps 180.93.116.203_sample.bin File opened for reading /proc/168/maps 180.93.116.203_sample.bin File opened for reading /proc/9/maps 180.93.116.203_sample.bin File opened for reading /proc/79/maps 180.93.116.203_sample.bin File opened for reading /proc/169/maps 180.93.116.203_sample.bin File opened for reading /proc/2/maps 180.93.116.203_sample.bin File opened for reading /proc/25/maps 180.93.116.203_sample.bin File opened for reading /proc/26/maps 180.93.116.203_sample.bin File opened for reading /proc/137/maps 180.93.116.203_sample.bin File opened for reading /proc/171/maps 180.93.116.203_sample.bin File opened for reading /proc/174/maps 180.93.116.203_sample.bin File opened for reading /proc/6/maps 180.93.116.203_sample.bin File opened for reading /proc/8/maps 180.93.116.203_sample.bin File opened for reading /proc/10/maps 180.93.116.203_sample.bin File opened for reading /proc/32/maps 180.93.116.203_sample.bin File opened for reading /proc/35/maps 180.93.116.203_sample.bin File opened for reading /proc/161/maps 180.93.116.203_sample.bin File opened for reading /proc/167/maps 180.93.116.203_sample.bin File opened for reading /proc/36/maps 180.93.116.203_sample.bin File opened for reading /proc/200/maps 180.93.116.203_sample.bin File opened for reading /proc/977/maps 180.93.116.203_sample.bin File opened for reading /proc/27/maps 180.93.116.203_sample.bin File opened for reading /proc/159/maps 180.93.116.203_sample.bin File opened for reading /proc/166/maps 180.93.116.203_sample.bin File opened for reading /proc/12/maps 180.93.116.203_sample.bin File opened for reading /proc/80/maps 180.93.116.203_sample.bin File opened for reading /proc/83/maps 180.93.116.203_sample.bin File opened for reading /proc/162/maps 180.93.116.203_sample.bin File opened for reading /proc/22/maps 180.93.116.203_sample.bin File opened for reading /proc/34/maps 180.93.116.203_sample.bin File opened for reading /proc/81/maps 180.93.116.203_sample.bin File opened for reading /proc/157/maps 180.93.116.203_sample.bin File opened for reading /proc/158/maps 180.93.116.203_sample.bin File opened for reading /proc/165/maps 180.93.116.203_sample.bin File opened for reading /proc/3/maps 180.93.116.203_sample.bin File opened for reading /proc/11/maps 180.93.116.203_sample.bin File opened for reading /proc/17/maps 180.93.116.203_sample.bin File opened for reading /proc/19/maps 180.93.116.203_sample.bin File opened for reading /proc/86/maps 180.93.116.203_sample.bin File opened for reading /proc/163/maps 180.93.116.203_sample.bin File opened for reading /proc/24/maps 180.93.116.203_sample.bin File opened for reading /proc/170/maps 180.93.116.203_sample.bin File opened for reading /proc/199/maps 180.93.116.203_sample.bin File opened for reading /proc/13/maps 180.93.116.203_sample.bin File opened for reading /proc/14/maps 180.93.116.203_sample.bin File opened for reading /proc/16/maps 180.93.116.203_sample.bin File opened for reading /proc/20/maps 180.93.116.203_sample.bin File opened for reading /proc/29/maps 180.93.116.203_sample.bin File opened for reading /proc/30/maps 180.93.116.203_sample.bin - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 1521 180.93.116.203_sample.bin -
description ioc Process File opened for reading /proc/36/cmdline 180.93.116.203_sample.bin File opened for reading /proc/89/cmdline 180.93.116.203_sample.bin File opened for reading /proc/9/cmdline 180.93.116.203_sample.bin File opened for reading /proc/11/cmdline 180.93.116.203_sample.bin File opened for reading /proc/19/cmdline 180.93.116.203_sample.bin File opened for reading /proc/160/cmdline 180.93.116.203_sample.bin File opened for reading /proc/200/cmdline 180.93.116.203_sample.bin File opened for reading /proc/10/cmdline 180.93.116.203_sample.bin File opened for reading /proc/16/cmdline 180.93.116.203_sample.bin File opened for reading /proc/5/cmdline 180.93.116.203_sample.bin File opened for reading /proc/34/cmdline 180.93.116.203_sample.bin File opened for reading /proc/155/cmdline 180.93.116.203_sample.bin File opened for reading /proc/161/cmdline 180.93.116.203_sample.bin File opened for reading /proc/14/cmdline 180.93.116.203_sample.bin File opened for reading /proc/27/cmdline 180.93.116.203_sample.bin File opened for reading /proc/79/cmdline 180.93.116.203_sample.bin File opened for reading /proc/80/cmdline 180.93.116.203_sample.bin File opened for reading /proc/84/cmdline 180.93.116.203_sample.bin File opened for reading /proc/158/cmdline 180.93.116.203_sample.bin File opened for reading /proc/977/cmdline 180.93.116.203_sample.bin File opened for reading /proc/3/cmdline 180.93.116.203_sample.bin File opened for reading /proc/6/cmdline 180.93.116.203_sample.bin File opened for reading /proc/81/cmdline 180.93.116.203_sample.bin File opened for reading /proc/82/cmdline 180.93.116.203_sample.bin File opened for reading /proc/18/cmdline 180.93.116.203_sample.bin File opened for reading /proc/24/cmdline 180.93.116.203_sample.bin File opened for reading /proc/156/cmdline 180.93.116.203_sample.bin File opened for reading /proc/1517/cmdline 180.93.116.203_sample.bin File opened for reading /proc/21/cmdline 180.93.116.203_sample.bin File opened for reading /proc/26/cmdline 180.93.116.203_sample.bin File opened for reading /proc/35/cmdline 180.93.116.203_sample.bin File opened for reading /proc/137/cmdline 180.93.116.203_sample.bin File opened for reading /proc/157/cmdline 180.93.116.203_sample.bin File opened for reading /proc/159/cmdline 180.93.116.203_sample.bin File opened for reading /proc/170/cmdline 180.93.116.203_sample.bin File opened for reading /proc/17/cmdline 180.93.116.203_sample.bin File opened for reading /proc/32/cmdline 180.93.116.203_sample.bin File opened for reading /proc/115/cmdline 180.93.116.203_sample.bin File opened for reading /proc/2/cmdline 180.93.116.203_sample.bin File opened for reading /proc/15/cmdline 180.93.116.203_sample.bin File opened for reading /proc/22/cmdline 180.93.116.203_sample.bin File opened for reading /proc/163/cmdline 180.93.116.203_sample.bin File opened for reading /proc/164/cmdline 180.93.116.203_sample.bin File opened for reading /proc/166/cmdline 180.93.116.203_sample.bin File opened for reading /proc/171/cmdline 180.93.116.203_sample.bin File opened for reading /proc/1519/cmdline 180.93.116.203_sample.bin File opened for reading /proc/7/cmdline 180.93.116.203_sample.bin File opened for reading /proc/23/cmdline 180.93.116.203_sample.bin File opened for reading /proc/78/cmdline 180.93.116.203_sample.bin File opened for reading /proc/168/cmdline 180.93.116.203_sample.bin File opened for reading /proc/199/cmdline 180.93.116.203_sample.bin File opened for reading /proc/1519/maps 180.93.116.203_sample.bin File opened for reading /proc/30/cmdline 180.93.116.203_sample.bin File opened for reading /proc/86/cmdline 180.93.116.203_sample.bin File opened for reading /proc/98/cmdline 180.93.116.203_sample.bin File opened for reading /proc/165/cmdline 180.93.116.203_sample.bin File opened for reading /proc/169/cmdline 180.93.116.203_sample.bin File opened for reading /proc/162/cmdline 180.93.116.203_sample.bin File opened for reading /proc/20/cmdline 180.93.116.203_sample.bin File opened for reading /proc/25/cmdline 180.93.116.203_sample.bin File opened for reading /proc/28/cmdline 180.93.116.203_sample.bin File opened for reading /proc/167/cmdline 180.93.116.203_sample.bin File opened for reading /proc/172/cmdline 180.93.116.203_sample.bin File opened for reading /proc/8/cmdline 180.93.116.203_sample.bin - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/180.93.116.203_sample.bin 180.93.116.203_sample.bin