SUSPICIOUS — libunity.so
SUSPICIOUS — libunity.so is a elf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (38/100). 0 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
74f254f06ac67f875cbb41ab0462ec289318a8b092b20b175eff3b1d39dd5db1 - SHA-1:
8ac01c49c132af45da741fb1d22a6997d8b39484 - MD5:
53d0c237d6cea242fb15e6fb8a70cdb3 - ssdeep:
393216:7jPACU2Lu9vYsIl4IQ05HfeocEm/M5aSaKx:FU2y9vYsIl4IQ05JcEm/mx3 - TLSH:
T1C66F9E172486BCC4D6DE149CB1962B3C72420DED83361DCDE6D3DA25F29AB2744A9C83 - Submitted as: libunity.so
- File type: elf · Size: 15766088 bytes
- Verdict: suspicious (38/100)
Detections (0 of 56 engines)
No engine flagged this sample.
MITRE ATT&CK
Why this verdict
The suspicious score of 38/100 is the fusion of 2 weighted signals:
- query domain / anti-analysis (rule
query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: https://api.uca.cloud.unity3d.com/v1/events, https://cdp.cloud.unity3d.com/v1/events, https://config.uca.cloud.unity3d.com - static signal, weight 0.35, confidence 0.60
Dynamic analysis
This sample is built for AArch64, which no sandbox guest in our fleet executes, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.
Embedded URLs
- https://api.uca.cloud.unity3d.com/v1/events
- https://cdp.cloud.unity3d.com/v1/events
- https://config.uca.cloud.unity3d.com
- http://gcc.gnu.org/bugs.html
Embedded domains
- api.uca.cloud.unity3d.com
- cdp.cloud.unity3d.com
- config.uca.cloud.unity3d.com
- gcc.gnu.org
File paths
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geotokenlist.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geov128texture.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geovariant.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\trigroup.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore/GeoArray.inl
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geobitarray.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geobluenoise.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geobufferedfilestream.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geoconvexhull2d.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geodepthcubemap.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geofilestream.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geofp16texture.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geomemorystream.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\georgbxtexture.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\georingbuffer.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geospatialhash.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geocore\geotimer.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geobase\geoevent.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geobase\geofile.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\geobase\geostring.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\enlighten3hlrt\cubemap\cpucubemap.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\enlighten3hlrt\dynamicobject\basedynamicobject.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\enlighten3hlrt\dynamicobject\cpudynamicobject.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\enlighten3hlrt\environment\baseenvironment.cpp
- c:\buildslave\enlighten\build\src\enlightenapi\libsrc\enlighten3hlrt\environment\cpuenvironment.cpp
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report