Analysis
-
max time kernel
21989s -
max time network
103s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20-08-2022 04:54
Static task
static1
Behavioral task
behavioral1
Sample
9c288d048db6ffd62105350d071bd542
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
9c288d048db6ffd62105350d071bd542
-
Size
22KB
-
MD5
9c288d048db6ffd62105350d071bd542
-
SHA1
edc5c33c1c1f5078cdd71acefc9a84207e7ffa7d
-
SHA256
8b8129509ce25b214e8ed6ce4bf53584f469a023aa2bbc6499975e934b4d57ee
-
SHA512
11436d7a1aa1c089513a814c849f169e0ee1618cca37736d59c15ea6c7b491e2ff6f42a273c32a66b8b0f91eb09809b06f93b177e7c05322038df2dded66c86d
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc /sbin/watchdog /sbin/watchdog /bin/watchdog /bin/watchdog -
Reads runtime system information 16 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/581/cmdline /proc/581/cmdline /proc/698/cmdline /proc/698/cmdline /proc/420/cmdline /proc/420/cmdline /proc/458/cmdline /proc/458/cmdline /proc/575/cmdline /proc/575/cmdline /proc/617/cmdline /proc/617/cmdline /proc/416/cmdline /proc/416/cmdline /proc/447/cmdline /proc/447/cmdline /proc/656/cmdline /proc/656/cmdline /proc/660/cmdline /proc/660/cmdline /proc/699/cmdline /proc/699/cmdline /proc/418/cmdline /proc/418/cmdline /proc/594/cmdline /proc/594/cmdline /proc/598/cmdline /proc/598/cmdline /proc/ /proc/ /proc/580/cmdline /proc/580/cmdline