Analysis
-
max time kernel
131s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
01-11-2024 14:07
Behavioral task
behavioral1
Sample
debug.dbg.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
4 signatures
150 seconds
General
-
Target
debug.dbg.elf
-
Size
69KB
-
MD5
893c23406acbeb9be3d94fa5b7fb08b7
-
SHA1
419fef832fdb438a61974322187056a8755d6dca
-
SHA256
e56813b987e2bd61add3481cdcbda3dcb82d6ce965bd15de5121b6cc0cc7815c
-
SHA512
ec9c32e25688058fd536f2f3bf073ecd06ebb4cf1880c45c91c18d7042282bda38c8e8fb3720dd81ecc33838e08b556fdc4adaaaa7fa960efb3472e6fac62795
-
SSDEEP
1536:bSKRI7C2wEI5Z5268+I/UCCPyiO+vmoV9okwKBTx3Poui7N1OF9Q+4j:bSKRI7C2wEI5nxCCqiO+vmoVikwKBTxI
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
debug.dbg.elfpid Process 1591 debug.dbg.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
debug.dbg.elfdescription ioc Process File opened for modification /dev/watchdog debug.dbg.elf File opened for modification /dev/misc/watchdog debug.dbg.elf -
Writes file to system bin folder 2 IoCs
Processes:
debug.dbg.elfdescription ioc Process File opened for modification /bin/watchdog debug.dbg.elf File opened for modification /sbin/watchdog debug.dbg.elf -
Changes its process name 1 IoCs
Processes:
debug.dbg.elfdescription pid Process Changes the process name, possibly in an attempt to hide itself 1591 debug.dbg.elf