Analysis
-
max time kernel
153s -
max time network
112s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230712-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230712-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
29-08-2023 16:08
Behavioral task
behavioral1
Sample
607-1-0x0000000008048000-0x00000000080547a0-memory.dmp
Resource
ubuntu1804-amd64-20230712-en
ubuntu-18.04-amd64
3 signatures
150 seconds
General
-
Target
607-1-0x0000000008048000-0x00000000080547a0-memory.dmp
-
Size
48KB
-
MD5
c873f5633bb63952968890f76b6ece61
-
SHA1
3c62396ed482b6dcf4bfa77a1d3fb8c6d14568a2
-
SHA256
1a863afb11daf7f5b905faddebb930a4433b718a1243cd9b1c93a39fcc6511d4
-
SHA512
0d8c37db2f5b444d5650013cf7f5497c954ef12bc2983694fdd492e6823fa2871b1c7aeff5e82b01476dead38c4925e398dde336d0119b6e48e32580e5cf8983
-
SSDEEP
1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2i7eA:Gv4QPfZfW5XTOeoEz0qAQwf2i5
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 19 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/596/cmdline File opened for reading /proc/597/cmdline File opened for reading /proc/710/cmdline File opened for reading /proc/589/cmdline File opened for reading /proc/591/cmdline File opened for reading /proc/611/cmdline File opened for reading /proc/615/cmdline File opened for reading /proc/678/cmdline File opened for reading /proc/452/cmdline File opened for reading /proc/633/cmdline File opened for reading /proc/674/cmdline File opened for reading /proc/711/cmdline File opened for reading /proc/590/cmdline File opened for reading /proc/406/cmdline File opened for reading /proc/408/cmdline File opened for reading /proc/425/cmdline File opened for reading /proc/427/cmdline File opened for reading /proc/563/cmdline File opened for reading /proc/588/cmdline