Analysis
-
max time kernel
153s -
max time network
157s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
20-12-2023 17:21
Behavioral task
behavioral1
Sample
f5aff437b04c19339c9be1b96b2982f0
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
f5aff437b04c19339c9be1b96b2982f0
-
Size
30KB
-
MD5
f5aff437b04c19339c9be1b96b2982f0
-
SHA1
3265d6ba2b62104cfa6d24b10609857cd50420f1
-
SHA256
885cad34a13c0ce65c6e632a354dfd7b8520511185caf88556c7f0c79a93b551
-
SHA512
0ee43492a02fade474f791e7fa7b166a4364fc117ec44e0fc6e8f5009a600ef84aa0ef33802d84db75bb23807f433d24beea67f3f84cde22359824699b583516
-
SSDEEP
768:5KGMuiPe/7bKFSoDEfUP2VnHJXMDLhK9ga:IGMuiPa7RZVnpXM/hK
Malware Config
Signatures
-
Contacts a large (53614) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog