Analysis
-
max time kernel
9s -
max time network
0s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
11/08/2024, 01:18
Behavioral task
behavioral1
Sample
cyber-x86
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
5 signatures
150 seconds
General
-
Target
cyber-x86
-
Size
61KB
-
MD5
df62d3d53d3f634aae4a37df11acd1ed
-
SHA1
e5af5f52fe71317deda7e266b5c1d4d1610f34da
-
SHA256
cee25cc5b9582224d6bc20580fbfb9aecc21efbf673719d378172cb0756e5415
-
SHA512
911c64d707198f72e72770d4f1b303235befcdcbb72bdf5fb436a06dc9f9484cb45fda47dbc1242184c3108af653fc23b7b3afa858ff0b6db23024d98960ae30
-
SSDEEP
1536:2J5ivXfltjxvStba8IluvBhcZxb5l9CSNBODDF:2J5iXjjxvuba8I5P5ODDF
Score
7/10
Malware Config
Signatures
-
description ioc Process File deleted /var/log/journal/f2de92a803c744e586bd87567a26b68a/system@4602f887e40b4167b43e31ce4f8f789c-0000000000000001-00061aa2ae825b7d.journal cyber-x86 File deleted /var/log/journal/f2de92a803c744e586bd87567a26b68a/system.journal cyber-x86 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog cyber-x86 File opened for modification /dev/misc/watchdog cyber-x86 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Cyber 1567 cyber-x86 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/415/cmdline cyber-x86 File opened for reading /proc/1174/cmdline cyber-x86 File opened for reading /proc/8/cmdline cyber-x86 File opened for reading /proc/82/cmdline cyber-x86 File opened for reading /proc/741/cmdline cyber-x86 File opened for reading /proc/1216/cmdline cyber-x86 File opened for reading /proc/1227/cmdline cyber-x86 File opened for reading /proc/1545/cmdline cyber-x86 File opened for reading /proc/79/cmdline cyber-x86 File opened for reading /proc/314/cmdline cyber-x86 File opened for reading /proc/587/cmdline cyber-x86 File opened for reading /proc/88/cmdline cyber-x86 File opened for reading /proc/663/cmdline cyber-x86 File opened for reading /proc/1092/cmdline cyber-x86 File opened for reading /proc/1172/cmdline cyber-x86 File opened for reading /proc/15/cmdline cyber-x86 File opened for reading /proc/504/cmdline cyber-x86 File opened for reading /proc/907/cmdline cyber-x86 File opened for reading /proc/1276/cmdline cyber-x86 File opened for reading /proc/86/cmdline cyber-x86 File opened for reading /proc/636/cmdline cyber-x86 File opened for reading /proc/1083/cmdline cyber-x86 File opened for reading /proc/1088/cmdline cyber-x86 File opened for reading /proc/1164/cmdline cyber-x86 File opened for reading /proc/1341/cmdline cyber-x86 File opened for reading /proc/99/cmdline cyber-x86 File opened for reading /proc/74/cmdline cyber-x86 File opened for reading /proc/1557/cmdline cyber-x86 File opened for reading /proc/4/cmdline cyber-x86 File opened for reading /proc/216/cmdline cyber-x86 File opened for reading /proc/263/cmdline cyber-x86 File opened for reading /proc/1159/cmdline cyber-x86 File opened for reading /proc/1240/cmdline cyber-x86 File opened for reading /proc/10/cmdline cyber-x86 File opened for reading /proc/451/cmdline cyber-x86 File opened for reading /proc/740/cmdline cyber-x86 File opened for reading /proc/1272/cmdline cyber-x86 File opened for reading /proc/1281/cmdline cyber-x86 File opened for reading /proc/1284/cmdline cyber-x86 File opened for reading /proc/12/cmdline cyber-x86 File opened for reading /proc/93/cmdline cyber-x86 File opened for reading /proc/96/cmdline cyber-x86 File opened for reading /proc/1509/cmdline cyber-x86 File opened for reading /proc/1566/cmdline cyber-x86 File opened for reading /proc/85/cmdline cyber-x86 File opened for reading /proc/769/cmdline cyber-x86 File opened for reading /proc/788/cmdline cyber-x86 File opened for reading /proc/1032/cmdline cyber-x86 File opened for reading /proc/503/cmdline cyber-x86 File opened for reading /proc/774/cmdline cyber-x86 File opened for reading /proc/95/cmdline cyber-x86 File opened for reading /proc/749/cmdline cyber-x86 File opened for reading /proc/1167/cmdline cyber-x86 File opened for reading /proc/159/cmdline cyber-x86 File opened for reading /proc/775/cmdline cyber-x86 File opened for reading /proc/1157/cmdline cyber-x86 File opened for reading /proc/1503/cmdline cyber-x86 File opened for reading /proc/17/cmdline cyber-x86 File opened for reading /proc/14/cmdline cyber-x86 File opened for reading /proc/1053/cmdline cyber-x86 File opened for reading /proc/1076/cmdline cyber-x86 File opened for reading /proc/5/cmdline cyber-x86 File opened for reading /proc/634/cmdline cyber-x86 File opened for reading /proc/762/cmdline cyber-x86