Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-24.04_amd64 -
resource
ubuntu2404-amd64-20240523-en -
resource tags
arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system -
submitted
03-12-2024 21:16
Behavioral task
behavioral1
Sample
x86_64.elf
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
5 signatures
150 seconds
General
-
Target
x86_64.elf
-
Size
66KB
-
MD5
88660446811d50c52341472f9b03d870
-
SHA1
bc8c0a5be47d1538a1504aded3f9fdffaabe3b6f
-
SHA256
011c4d82c6f391669c979bb51cabe5815e14f370e96e4492d298ad16f510b73d
-
SHA512
15a1bc29f9e2f6c97b498edc751d13720ea7b643f48e7745fa3b10194942294d04556e6a963b3075c6c402c11aead80bf564696f71180a69d10c629055da7cac
-
SSDEEP
1536:AQqMYLd31JuGGCao6GRnBkmnz8o16Qj7AT4vpN3:VqMYrJdvaopRnuE16QjI4v
Score
9/10
Malware Config
Signatures
-
Contacts a large (149878) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog x86_64.elf File opened for modification /dev/misc/watchdog x86_64.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog x86_64.elf File opened for modification /bin/watchdog x86_64.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 2825 x86_64.elf