Analysis
-
max time kernel
0s -
max time network
150s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
27-12-2024 15:13
Behavioral task
behavioral1
Sample
fstream-1.dat
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
3 signatures
150 seconds
General
-
Target
fstream-1.dat
-
Size
73KB
-
MD5
f7eef7a952b17ab75b3bb24d03fbcdf2
-
SHA1
83bf20a36a93b73c1f78ff224459a797de605fa5
-
SHA256
9928c99ec2ef2eee7df7c786dbc35f5b765e9701de45e194ab59123bdf535983
-
SHA512
889239c925d90300423aa621777259f4d621fb232f5765b321a851e1815d1a54cc33b2535b2ab9662f08b3d8a8ddb6464a44f7f3ce3cda55a15a122b2611d2f1
-
SSDEEP
1536:6SYXBbpKbF+5AQZKOtRDXVFx4bgMj+B3bEKoui0QOo/Y0TB3:SbobF+5QOth3+bgMj+xbyuPXopt3
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog fstream-1.dat File opened for modification /dev/misc/watchdog fstream-1.dat -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/673/cmdline fstream-1.dat File opened for reading /proc/1054/cmdline fstream-1.dat File opened for reading /proc/1186/cmdline fstream-1.dat File opened for reading /proc/1347/cmdline fstream-1.dat File opened for reading /proc/1352/cmdline fstream-1.dat File opened for reading /proc/501/cmdline fstream-1.dat File opened for reading /proc/90/cmdline fstream-1.dat File opened for reading /proc/93/cmdline fstream-1.dat File opened for reading /proc/164/cmdline fstream-1.dat File opened for reading /proc/169/cmdline fstream-1.dat File opened for reading /proc/559/cmdline fstream-1.dat File opened for reading /proc/1076/cmdline fstream-1.dat File opened for reading /proc/1377/cmdline fstream-1.dat File opened for reading /proc/20/cmdline fstream-1.dat File opened for reading /proc/1115/cmdline fstream-1.dat File opened for reading /proc/162/cmdline fstream-1.dat File opened for reading /proc/12/cmdline fstream-1.dat File opened for reading /proc/19/cmdline fstream-1.dat File opened for reading /proc/79/cmdline fstream-1.dat File opened for reading /proc/89/cmdline fstream-1.dat File opened for reading /proc/201/cmdline fstream-1.dat File opened for reading /proc/445/cmdline fstream-1.dat File opened for reading /proc/1023/cmdline fstream-1.dat File opened for reading /proc/10/cmdline fstream-1.dat File opened for reading /proc/1409/cmdline fstream-1.dat File opened for reading /proc/1120/cmdline fstream-1.dat File opened for reading /proc/1028/cmdline fstream-1.dat File opened for reading /proc/91/cmdline fstream-1.dat File opened for reading /proc/82/cmdline fstream-1.dat File opened for reading /proc/784/cmdline fstream-1.dat File opened for reading /proc/1096/cmdline fstream-1.dat File opened for reading /proc/1353/cmdline fstream-1.dat File opened for reading /proc/7/cmdline fstream-1.dat File opened for reading /proc/639/cmdline fstream-1.dat File opened for reading /proc/642/cmdline fstream-1.dat File opened for reading /proc/801/cmdline fstream-1.dat File opened for reading /proc/803/cmdline fstream-1.dat File opened for reading /proc/828/cmdline fstream-1.dat File opened for reading /proc/1354/cmdline fstream-1.dat File opened for reading /proc/74/cmdline fstream-1.dat File opened for reading /proc/6/cmdline fstream-1.dat File opened for reading /proc/88/cmdline fstream-1.dat File opened for reading /proc/170/cmdline fstream-1.dat File opened for reading /proc/448/cmdline fstream-1.dat File opened for reading /proc/588/cmdline fstream-1.dat File opened for reading /proc/1357/cmdline fstream-1.dat File opened for reading /proc/2/cmdline fstream-1.dat File opened for reading /proc/606/cmdline fstream-1.dat File opened for reading /proc/794/cmdline fstream-1.dat File opened for reading /proc/967/cmdline fstream-1.dat File opened for reading /proc/1097/cmdline fstream-1.dat File opened for reading /proc/1122/cmdline fstream-1.dat File opened for reading /proc/1284/cmdline fstream-1.dat File opened for reading /proc/242/cmdline fstream-1.dat File opened for reading /proc/86/cmdline fstream-1.dat File opened for reading /proc/92/cmdline fstream-1.dat File opened for reading /proc/102/cmdline fstream-1.dat File opened for reading /proc/534/cmdline fstream-1.dat File opened for reading /proc/669/cmdline fstream-1.dat File opened for reading /proc/762/cmdline fstream-1.dat File opened for reading /proc/944/cmdline fstream-1.dat File opened for reading /proc/1/cmdline fstream-1.dat File opened for reading /proc/1345/cmdline fstream-1.dat File opened for reading /proc/949/cmdline fstream-1.dat