Analysis
-
max time kernel
153s -
max time network
155s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20230831-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20230831-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
31/08/2023, 23:31
Behavioral task
behavioral1
Sample
592-1-0x0000000008048000-0x00000000080547a0-memory.dmp
Resource
ubuntu1804-amd64-20230831-en
3 signatures
150 seconds
General
-
Target
592-1-0x0000000008048000-0x00000000080547a0-memory.dmp
-
Size
48KB
-
MD5
6f9e155b637b80537e3ae680bd5db708
-
SHA1
9ac8fd6941a5701138a5a55040e6155ee38b5685
-
SHA256
ee63d7fc01f10a47f6f109a841f5e739d43e3f35717e08ad8af4501a558ea4d6
-
SHA512
ccdfac15609028c6ca73cde792f4182cf7a58b974cee160382c0e19dcd30758a9d53f924e788c48f02ce636d3da4bfe849164b6be0e821387eb17e824eba1928
-
SSDEEP
1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2iHeA:Gv4QPfZfW5XTOeoEzJ7AQwf2il
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Reads runtime system information 12 IoCs
Reads data from /proc virtual filesystem.
description ioc File opened for reading /proc/563/cmdline File opened for reading /proc/586/cmdline File opened for reading /proc/588/cmdline File opened for reading /proc/594/cmdline File opened for reading /proc/595/cmdline File opened for reading /proc/407/cmdline File opened for reading /proc/408/cmdline File opened for reading /proc/412/cmdline File opened for reading /proc/428/cmdline File opened for reading /proc/430/cmdline File opened for reading /proc/587/cmdline File opened for reading /proc/589/cmdline