Analysis
-
max time kernel
22155s -
max time network
102s -
platform
linux_amd64 -
resource
ubuntu1804-amd64-en-20211208 -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22-08-2022 03:04
Static task
static1
Behavioral task
behavioral1
Sample
dea5489e5cb3966e64ed6c8cc1808d28
Resource
ubuntu1804-amd64-en-20211208
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
dea5489e5cb3966e64ed6c8cc1808d28
-
Size
22KB
-
MD5
dea5489e5cb3966e64ed6c8cc1808d28
-
SHA1
8a66c7c20093d4e6ccb2a6db29f7321d40a80cfa
-
SHA256
ccaac714876d6c0609effefc4e61551ef109281cd9e266b05cbe79264c1d39b8
-
SHA512
df3dc1eaa3d5d68d8c4e42c14694b9a215b1997fabfbfed1f00d2cc56315a46d206072259d22e49207b22f6646163c6a0302dff55e1e82f63063b327963db8df
Score
9/10
Malware Config
Signatures
-
Modifies the Watchdog daemon 1 TTPs
Malware like Mirai modify the Watchdog to prevent it restarting an infected system.
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc /sbin/watchdog /sbin/watchdog /bin/watchdog /bin/watchdog -
Reads runtime system information 16 IoCs
Reads data from /proc virtual filesystem.
Processes:
description ioc /proc/460/cmdline /proc/460/cmdline /proc/614/cmdline /proc/614/cmdline /proc/632/cmdline /proc/632/cmdline /proc/ /proc/ /proc/409/cmdline /proc/409/cmdline /proc/422/cmdline /proc/422/cmdline /proc/601/cmdline /proc/601/cmdline /proc/424/cmdline /proc/424/cmdline /proc/596/cmdline /proc/596/cmdline /proc/676/cmdline /proc/676/cmdline /proc/684/cmdline /proc/684/cmdline /proc/672/cmdline /proc/672/cmdline /proc/565/cmdline /proc/565/cmdline /proc/591/cmdline /proc/591/cmdline /proc/597/cmdline /proc/597/cmdline /proc/610/cmdline /proc/610/cmdline