Analysis
-
max time kernel
131s -
max time network
151s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20241127-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
13-12-2024 09:22
Behavioral task
behavioral1
Sample
debug.dbg.elf
Resource
ubuntu2004-amd64-20241127-en
4 signatures
150 seconds
General
-
Target
debug.dbg.elf
-
Size
69KB
-
MD5
1717a0849661f4d0e50150ef684e492d
-
SHA1
6a944d22a9821d15ae34b63f3f593cc39fff97ac
-
SHA256
37f99b8da4f675eb133704163773b5bf9a87284025f57e35a5a4463584d5410c
-
SHA512
7dd29c096c62708f2fe24289c3fa83771b93ca084e9e1f2fdae04bc4b47cfbc3476e3efe05b339cea766b82510f8ac445430d6a0a717b69bccc495d3007f28c5
-
SSDEEP
1536:bSKRI7C2wEI5Z5u68+I/UCCPB4+LjJKoZxogcahTxDPoui7N1OF9Qmvj:bSKRI7C2wEI5fxCCp4+LjJKoZegcahT9
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1399 debug.dbg.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog debug.dbg.elf File opened for modification /dev/watchdog debug.dbg.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog debug.dbg.elf File opened for modification /bin/watchdog debug.dbg.elf -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1399 debug.dbg.elf