Analysis
-
max time kernel
21191s -
max time network
103s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
10-08-2022 23:17
Static task
static1
Behavioral task
behavioral1
Sample
1f365098dae9313a7ea21cef7ed01949
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
1f365098dae9313a7ea21cef7ed01949
-
Size
22KB
-
MD5
1f365098dae9313a7ea21cef7ed01949
-
SHA1
4b54ad488afc5a270097dc8e83a36d74d488dca3
-
SHA256
6e8d36faf6cd93f1eb37c3db8249c3b6e9886e3f336b4cc47d5e747a1f70dcaf
-
SHA512
770d84d13ef0c1d96663ebe5d6f0dd3f1e1b49a2ab128dc27c4cb11e35ebda8d9b5dbbed895d1975a07ddb7da3097b11d29f81bbe492f980a323565660fb0823
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc /sbin/watchdog /sbin/watchdog /bin/watchdog /bin/watchdog -
Reads runtime system information 16 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/587/cmdline /proc/587/cmdline /proc/420/cmdline /proc/420/cmdline /proc/581/cmdline /proc/581/cmdline /proc/580/cmdline /proc/580/cmdline /proc/598/cmdline /proc/598/cmdline /proc/656/cmdline /proc/656/cmdline /proc/447/cmdline /proc/447/cmdline /proc/458/cmdline /proc/458/cmdline /proc/616/cmdline /proc/616/cmdline /proc/660/cmdline /proc/660/cmdline /proc/668/cmdline /proc/668/cmdline /proc/416/cmdline /proc/416/cmdline /proc/575/cmdline /proc/575/cmdline /proc/594/cmdline /proc/594/cmdline /proc/ /proc/ /proc/418/cmdline /proc/418/cmdline