Analysis
-
max time kernel
131s -
max time network
151s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
29-10-2024 14:54
Behavioral task
behavioral1
Sample
debug.dbg.elf
Resource
ubuntu2204-amd64-20240611-en
4 signatures
150 seconds
General
-
Target
debug.dbg.elf
-
Size
69KB
-
MD5
e272b3940efc74cc7066b31b69fd80aa
-
SHA1
ce5538a04eda392874b705b1ec6b11782b05f3fd
-
SHA256
9abf9ac02fcd24a60f425ff7ca724761769c4b8e22f09590658da3cbe66f2052
-
SHA512
207038d3baa6ecad83766ab4881d3010fd3e5c9b088f18c6b58471ea46671aa972545769cb853b996927c6673d7f0f07c26d31767b993ea2e00d4bf73e77e95e
-
SSDEEP
1536:bSKRI7C2wEI5Z5268+I/UCCPyieMOioBJooU6eTxrPoui7N1OF9Q+/j:bSKRI7C2wEI5nxCCqieMOioB2oU6eTxz
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1587 debug.dbg.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog debug.dbg.elf File opened for modification /dev/misc/watchdog debug.dbg.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog debug.dbg.elf File opened for modification /bin/watchdog debug.dbg.elf -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1587 debug.dbg.elf