9928c99ec2ef2eee7df7c786dbc35f5b765e9701de45e194ab59123bdf535983

Analysis

max time kernel
0s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04-01-2025 00:35

Sharing

Copy URL

Twitter E-mail

Reason

Reading agent response: unexpected EOF

Report Analysis Logs

General

Target

byte (1).x86
Size

73KB
MD5

f7eef7a952b17ab75b3bb24d03fbcdf2
SHA1

83bf20a36a93b73c1f78ff224459a797de605fa5
SHA256

9928c99ec2ef2eee7df7c786dbc35f5b765e9701de45e194ab59123bdf535983
SHA512

889239c925d90300423aa621777259f4d621fb232f5765b321a851e1815d1a54cc33b2535b2ab9662f08b3d8a8ddb6464a44f7f3ce3cda55a15a122b2611d2f1
SSDEEP

1536:6SYXBbpKbF+5AQZKOtRDXVFx4bgMj+B3bEKoui0QOo/Y0TB3:SbobF+5QOth3+bgMj+xbyuPXopt3

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	byte (1).x86
File opened for modification	/dev/misc/watchdog	byte (1).x86

Reads runtime system information 25 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/cmdline	byte (1).x86
File opened for reading	/proc/24/cmdline	byte (1).x86
File opened for reading	/proc/1/cmdline	byte (1).x86
File opened for reading	/proc/2/cmdline	byte (1).x86
File opened for reading	/proc/6/cmdline	byte (1).x86
File opened for reading	/proc/12/cmdline	byte (1).x86
File opened for reading	/proc/15/cmdline	byte (1).x86
File opened for reading	/proc/16/cmdline	byte (1).x86
File opened for reading	/proc/17/cmdline	byte (1).x86
File opened for reading	/proc/19/cmdline	byte (1).x86
File opened for reading	/proc/25/cmdline	byte (1).x86
File opened for reading	/proc/3/cmdline	byte (1).x86
File opened for reading	/proc/5/cmdline	byte (1).x86
File opened for reading	/proc/9/cmdline	byte (1).x86
File opened for reading	/proc/13/cmdline	byte (1).x86
File opened for reading	/proc/20/cmdline	byte (1).x86
File opened for reading	/proc/21/cmdline	byte (1).x86
File opened for reading	/proc/22/cmdline	byte (1).x86
File opened for reading	/proc/23/cmdline	byte (1).x86
File opened for reading	/proc/4/cmdline	byte (1).x86
File opened for reading	/proc/7/cmdline	byte (1).x86
File opened for reading	/proc/8/cmdline	byte (1).x86
File opened for reading	/proc/11/cmdline	byte (1).x86
File opened for reading	/proc/14/cmdline	byte (1).x86
File opened for reading	/proc/18/cmdline	byte (1).x86

/tmp/byte (1).x86
"/tmp/byte (1).x86"
1⤵
- Modifies Watchdog functionality
- Reads runtime system information
PID:1515

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads