24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T45d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 6cd349eda0fa… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6cd349eda0fa…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141"],"about":{"@type":"SoftwareApplication","name":"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141","applicationCategory":["elf","64bits","executable"],"identifier":"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T54f,file/memory contains long string with (Indicator: "github.com"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "/work/cargo/registry/src/github.com-1ecc6299db9ec823/aes-soft-0.6.4/src/fixslice64.rs" (Indicator: "github.com"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "Error: /work/cargo/registry/src/github.com-1ecc6299db9ec823/rand_core-0.5.1/src/os.rsdescription() is deprecated; use Display" (Indicator: "github.com"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "assertion failed: `(left == right)` left: ``, right: ``/work/cargo/registry/src/github.com-1ecc6299db9ec823/getrandom-0.1.16/src/use_file.rs" (Indicator: "github.com"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "Hash table capacity overflow/cargo/registry/src/github.com-1ecc6299db9ec823/hashbrown-0.6.2/src/raw/mod.rs" (Indicator: "github.com"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string " at :cannot panic during the backtrace function/cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.40/src/lib.rsfailed to read executable information" (Indicator: "github.com"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141")26:Tf81,Found reference to API "clock_gettime" (Indicator: "clock_gettime"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "clock_gettime" (Indicator: "time"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "libpthread.so.0" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "write" (Indicator: "write"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_cond_init" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_mutex_destroy" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "open64" (Indicator: "open"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_self" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_rwlock_wrlock" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "recvfrom" (Indicator: "recvfrom"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_condattr_setclock" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_sigmask" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_mutex_init" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_cond_wait" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_cond_destroy" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_mutexattr_settype" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_rwlock_unlock" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "fsync" (Indicator: "fsync"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "fsync" (Indicator: "sync"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_key_delete" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_mutex_lock" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_mutexattr_init" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pread64" (Indicator: "pread64"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pread64" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_setspecific" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_cond_signal" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_cond_timedwait" (Indicator: "read"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "pthread_cond_timedwait" (Indicator: "time"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found reference to API "accept" (Indicator: "accept"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141")27:T814,Pattern match: "pattern.rs/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad196/src/libcore/macros/mod.rscalled" Pattern match: "core.rs/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad196/src/libcore/slice/mod.rsassertion" Heuristic match: "src/libstd/sync/mpsc/mod.rsinternal error: entered unreachable code/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad196/src/libstd/sync/mpsc/sync.rs" Heuristic match: "/work/cargo/registry/src/github.com-1ecc6299db9ec823/aes-soft-0.6.4/src/fixslice64.rs" Pattern match: "mod.rs/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad196/src/libcore/macros/mod.rscalled" Heuristic match: "called `result::unwrap()` on an `err` valuetried to shrink to a larger capacity<::core::macros::panic macros>/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad196/src/libcore/str/pattern.rsassertion failed: mid <= len/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad1" Heuristic match: "[0mcyanblueassertion failed: `(left == right)` left: ``, right: ``: destination and source slices have different lengths/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad196/src/libcore/macros/mod.rs" Heuristic match: "assertion failed: `(left == right)` left: ``, right: ``/work/cargo/registry/src/github.com-1ecc6299db9ec823/getrandom-0.1.16/src/use_file.rs" Heuristic match: "tried to shrink to a larger capacity/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad196/src/libcore/slice/mod.rs" Pattern match: "error.src/libstd/path.rs..src/libstd/sync/condvar.rsattempted" Pattern match: "rand.rs/dev/urandomfailed" Heuristic match: "called `option::unwrap()` on a `none` value/rustc/f3e1a954d2ead4e2fc197c7da7d71e6c61bad196/src/libcore/macros/mod.rs" Heuristic match: "hash table capacity overflow/cargo/registry/src/github.com-1ecc6299db9ec823/hashbrown-0.6.2/src/raw/mod.rs" Heuristic match: "out of range integral type conversion attemptedfrom_str_radix_int: must lie in the range `[2, 36]` - found src/libcore/num/mod.rs..borrowerrorborrowmuterror: but the index is called `option::unwrap()` on a `none` valuesrc/libcore/option.rs: src/libcore/res" Heuristic match: ".data.rel.ro"28:T611,Found string "_ZN8aes_soft8fixslice14aes128_encrypt17h6674e4527ec21a9fE" (Indicator: "aes"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "_ZN8aes_soft8fixslice14aes128_encrypt17h6674e4527ec21a9fE" (Indicator: "aes128"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "_ZN6base646decode10num_chunks17hbdb7cac0c8e2298dE" (Indicator: "base64"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "_ZN8aes_soft8fixslice19aes128_key_schedule17h9a29af0bbe9cea8bE" (Indicator: "aes"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "_ZN8aes_soft8fixslice19aes128_key_schedule17h9a29af0bbe9cea8bE" (Indicator: "aes128"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "_ZN6base6412CharacterSet12decode_table17h16ca47471a083203E" (Indicator: "base64"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "_ZN66_$LT$base64..decode..DecodeError$u20$as$u20$core..fmt..Display$GT$3fmt17haa2d91aaff98d431E" (Indicator: "base64"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") file/memory contains long string with (Indicator: "base64"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141") Found string "/work/cargo/registry/src/github.com-1ecc6299db9ec823/aes-soft-0.6.4/src/fixslice64.rs" (Indicator: "aes"; File: "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790310093798,"unified_at":"2026-09-25T04:21:33.798Z","metadata":{"hashes":{"sha256":"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141","sha1":"265a8e89464e32b22553ef16edbab703da7176a7","md5":"03dd0efa84d145d7d4ed8e240267e5c5","sha512":"1069e2eb237354a35338e4e0b7f8359a6887fe23778d763541b8bb30810323dc7144a1ed680422fe8a65605a27ac4456cce636fe22d71d15b6d609003ba07eb6","ssdeep":"24576:eqy4VsWHgFJ2EdXFzP+8JpnwBj7AXHTIa+pP9yBn+I:eqy4aWHgFJ2EdXFzP+8JpwBj7A3TIa+i","ssdeep_chunks":["24576:eqy4VsW","24576:qy4VsWH","24576:y4VsWHg","24576:4VsWHgF","24576:VsWHgFJ","24576:sWHgFJ2","24576:WHgFJ2E","24576:HgFJ2Ed","24576:gFJ2EdX","24576:FJ2EdXF","24576:J2EdXFz","24576:2EdXFzP","24576:EdXFzP+","24576:dXFzP+8","24576:XFzP+8J","24576:FzP+8Jp","24576:zP+8Jpn","24576:P+8Jpnw","24576:+8JpnwB","24576:8JpnwBj","24576:JpnwBj7","24576:pnwBj7A","24576:nwBj7AX","24576:wBj7AXH","24576:Bj7AXHT","24576:j7AXHTI","24576:7AXHTIa","24576:AXHTIa+","24576:XHTIa+p","24576:HTIa+pP","24576:TIa+pP9","24576:Ia+pP9y","24576:a+pP9yB","24576:+pP9yBn","24576:pP9yBn+","24576:P9yBn+I","49152:eqy4VsW","49152:qy4VsWH","49152:y4VsWHg","49152:4VsWHgF","49152:VsWHgFJ","49152:sWHgFJ2","49152:WHgFJ2E","49152:HgFJ2Ed","49152:gFJ2EdX","49152:FJ2EdXF","49152:J2EdXFz","49152:2EdXFzP","49152:EdXFzP+","49152:dXFzP+8","49152:XFzP+8J","49152:FzP+8Jp","49152:zP+8Jpn","49152:P+8Jpnw","49152:+8JpnwB","49152:8JpnwBj","49152:JpnwBj7","49152:pnwBj7A","49152:nwBj7AX","49152:wBj7AXH","49152:Bj7AXHT","49152:j7AXHTI","49152:7AXHTIa","49152:AXHTIa+","49152:XHTIa+p","49152:HTIa+pP","49152:TIa+pP9","49152:Ia+pP9y","49152:a+pP9yB","49152:+pP9yBn","49152:pP9yBn+","49152:P9yBn+I","24576:eqy4aWH","24576:qy4aWHg","24576:y4aWHgF","24576:4aWHgFJ","24576:aWHgFJ2","24576:zP+8Jpw","24576:P+8JpwB","24576:+8JpwBj","24576:8JpwBj7","24576:JpwBj7A","24576:pwBj7A3","24576:wBj7A3T","24576:Bj7A3TI","24576:j7A3TIa","24576:7A3TIa+","24576:A3TIa+i"],"imphash":"Unknown"},"file_info":{"file_name":"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141","file_type":["elf","64bits","executable"],"file_type_id":"64-bit elf","file_size":870920,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1754312896000,"last_seen":1754312896000,"last_multi_scan":1754312896000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":14,"suspicious_count":0,"malicious_count":1,"total":15},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls native functions (syscalls)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"},{"type":"informative","value":"Contains ability to set the socket options (syscall string)"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Binary is stripped"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"tactic":"Command and Control","technique":"IDE Tunneling","attack_id":"T1219.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1219/001","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential URL in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$25","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"General","name":"Binary is stripped","description":"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141 is stripped","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-1000","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"General","name":"Calls native functions (syscalls)","description":"Calls a syscall: \"execve\"\n Calls a syscall: \"brk\"\n Calls a syscall: \"arch_prctl\"\n Calls a syscall: \"access\"\n Calls a syscall: \"openat\"\n Calls a syscall: \"fstat\"\n Calls a syscall: \"mmap\"\n Calls a syscall: \"close\"\n Calls a syscall: \"read\"\n Calls a syscall: \"pread\"\n Calls a syscall: \"mprotect\"\n Calls a syscall: \"munmap\"\n Calls a syscall: \"set_tid_address\"\n Calls a syscall: \"set_robust_list\"\n Calls a syscall: \"rt_sigaction\"\n Calls a syscall: \"rt_sigprocmask\"\n Calls a syscall: \"sched_getaffinity\"\n Calls a syscall: \"sigaltstack\"\n Calls a syscall: \"getrandom\"\n Calls a syscall: \"write\"\n Calls a syscall: \"exit_group\"\n Calls a syscall: \"procexit\"\n Calls a syscall: \"open\"","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-1150","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-5000","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"/home/ubuntu/6cd349eda0fa141 reads file /lib/x86_64-linux-gnu/libdl.so.2\n /home/ubuntu/6cd349eda0fa141 reads file /lib/x86_64-linux-gnu/librt.so.1\n /home/ubuntu/6cd349eda0fa141 reads file /lib/x86_64-linux-gnu/libpthread.so.0\n /home/ubuntu/6cd349eda0fa141 reads file /lib/x86_64-linux-gnu/libgcc_s.so.1\n /home/ubuntu/6cd349eda0fa141 reads file /lib/x86_64-linux-gnu/libc.so.6\n /home/ubuntu/6cd349eda0fa141 reads file /lib/x86_64-linux-gnu/libm.so.6\n /home/ubuntu/6cd349eda0fa141 reads file /proc/self/maps","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1156","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the socket options (syscall string)","description":"Observed string: \"setsockopt\" (Indicator: \"setsockopt\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-5002","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"file/memory contains long string with (Indicator: \" ssh \"; File: \"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141\")","origin":"File/Memory","mitre_attack_id":"T1219.001","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: linux/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6890b0c0a5ffe031c80ae1f2","environment_id":310,"environment_description":"Linux (Ubuntu 20.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141","analysis_start_time":"2025-08-04T13:10:46+00:00","indicators_count":{"informative":14,"suspicious":0,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6890b0c0a5ffe031c80ae1f2"}],"processes":[{"pid":1660,"ppid":0,"name":"6cd349eda0fa141","command_line":"","normalized_path":"/home/ubuntu/6cd349eda0fa141","uid":"48396786-1660"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6890b0c0a5ffe031c80ae1f2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 6cd349eda0fa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6cd349eda0fa…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 6cd349eda0fa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6cd349eda0fa…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 6cd349eda0fa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6cd349eda0fa…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]