9928c99ec2ef2eee7df7c786dbc35f5b765e9701de45e194ab59123bdf535983

Analysis

max time kernel
30s
max time network
30s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20241127-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
04/01/2025, 00:35 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

byte (1).x86
Size

73KB
MD5

f7eef7a952b17ab75b3bb24d03fbcdf2
SHA1

83bf20a36a93b73c1f78ff224459a797de605fa5
SHA256

9928c99ec2ef2eee7df7c786dbc35f5b765e9701de45e194ab59123bdf535983
SHA512

889239c925d90300423aa621777259f4d621fb232f5765b321a851e1815d1a54cc33b2535b2ab9662f08b3d8a8ddb6464a44f7f3ce3cda55a15a122b2611d2f1
SSDEEP

1536:6SYXBbpKbF+5AQZKOtRDXVFx4bgMj+B3bEKoui0QOo/Y0TB3:SbobF+5QOth3+bgMj+xbyuPXopt3

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	byte (1).x86
File opened for modification	/dev/misc/watchdog	byte (1).x86

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1434/cmdline	byte (1).x86
File opened for reading	/proc/1549/cmdline	byte (1).x86
File opened for reading	/proc/1583/cmdline	byte (1).x86
File opened for reading	/proc/172/cmdline	byte (1).x86
File opened for reading	/proc/1329/cmdline	byte (1).x86
File opened for reading	/proc/493/cmdline	byte (1).x86
File opened for reading	/proc/1077/cmdline	byte (1).x86
File opened for reading	/proc/1118/cmdline	byte (1).x86
File opened for reading	/proc/1242/cmdline	byte (1).x86
File opened for reading	/proc/1493/cmdline	byte (1).x86
File opened for reading	/proc/8/cmdline	byte (1).x86
File opened for reading	/proc/158/cmdline	byte (1).x86
File opened for reading	/proc/1470/cmdline	byte (1).x86
File opened for reading	/proc/994/cmdline	byte (1).x86
File opened for reading	/proc/1337/cmdline	byte (1).x86
File opened for reading	/proc/78/cmdline	byte (1).x86
File opened for reading	/proc/132/cmdline	byte (1).x86
File opened for reading	/proc/165/cmdline	byte (1).x86
File opened for reading	/proc/175/cmdline	byte (1).x86
File opened for reading	/proc/632/cmdline	byte (1).x86
File opened for reading	/proc/1025/cmdline	byte (1).x86
File opened for reading	/proc/1/cmdline	byte (1).x86
File opened for reading	/proc/16/cmdline	byte (1).x86
File opened for reading	/proc/1351/cmdline	byte (1).x86
File opened for reading	/proc/1602/cmdline	byte (1).x86
File opened for reading	/proc/270/cmdline	byte (1).x86
File opened for reading	/proc/1086/cmdline	byte (1).x86
File opened for reading	/proc/1471/cmdline	byte (1).x86
File opened for reading	/proc/490/cmdline	byte (1).x86
File opened for reading	/proc/1224/cmdline	byte (1).x86
File opened for reading	/proc/1081/cmdline	byte (1).x86
File opened for reading	/proc/1424/cmdline	byte (1).x86
File opened for reading	/proc/1572/cmdline	byte (1).x86
File opened for reading	/proc/920/cmdline	byte (1).x86
File opened for reading	/proc/950/cmdline	byte (1).x86
File opened for reading	/proc/456/cmdline	byte (1).x86
File opened for reading	/proc/1085/cmdline	byte (1).x86
File opened for reading	/proc/1331/cmdline	byte (1).x86
File opened for reading	/proc/1423/cmdline	byte (1).x86
File opened for reading	/proc/1575/cmdline	byte (1).x86
File opened for reading	/proc/72/cmdline	byte (1).x86
File opened for reading	/proc/81/cmdline	byte (1).x86
File opened for reading	/proc/668/cmdline	byte (1).x86
File opened for reading	/proc/1395/cmdline	byte (1).x86
File opened for reading	/proc/1452/cmdline	byte (1).x86
File opened for reading	/proc/1503/cmdline	byte (1).x86
File opened for reading	/proc/85/cmdline	byte (1).x86
File opened for reading	/proc/531/cmdline	byte (1).x86
File opened for reading	/proc/666/cmdline	byte (1).x86
File opened for reading	/proc/1179/cmdline	byte (1).x86
File opened for reading	/proc/1516/cmdline	byte (1).x86
File opened for reading	/proc/2/cmdline	byte (1).x86
File opened for reading	/proc/5/cmdline	byte (1).x86
File opened for reading	/proc/1335/cmdline	byte (1).x86
File opened for reading	/proc/1444/cmdline	byte (1).x86
File opened for reading	/proc/1479/cmdline	byte (1).x86
File opened for reading	/proc/457/cmdline	byte (1).x86
File opened for reading	/proc/897/cmdline	byte (1).x86
File opened for reading	/proc/551/cmdline	byte (1).x86
File opened for reading	/proc/923/cmdline	byte (1).x86
File opened for reading	/proc/1078/cmdline	byte (1).x86
File opened for reading	/proc/1095/cmdline	byte (1).x86
File opened for reading	/proc/18/cmdline	byte (1).x86
File opened for reading	/proc/502/cmdline	byte (1).x86

/tmp/byte (1).x86
"/tmp/byte (1).x86"
1⤵
- Modifies Watchdog functionality
- Reads runtime system information
PID:1398

Network

DNS

vbtgsze.r-e.kr

Remote address:

8.8.8.8:53

Request

vbtgsze.r-e.kr

IN A

Response

vbtgsze.r-e.kr

IN A

193.143.1.66
DNS

vbtgsze.r-e.kr

Remote address:

8.8.8.8:53

Request

vbtgsze.r-e.kr

IN A

Response

vbtgsze.r-e.kr

IN A

193.143.1.66
DNS

vbtgsze.r-e.kr

Remote address:

8.8.8.8:53

Request

vbtgsze.r-e.kr

IN A

Response

vbtgsze.r-e.kr

IN A

193.143.1.66

193.143.1.66:777

vbtgsze.r-e.kr

240 B
4
193.143.1.66:777

vbtgsze.r-e.kr

240 B
4
193.143.1.66:777

vbtgsze.r-e.kr

180 B
3

224.0.0.251:5353

293 B
2
8.8.8.8:53

vbtgsze.r-e.kr

dns

60 B
76 B
1
1

DNS Request

vbtgsze.r-e.kr

DNS Response

193.143.1.66
8.8.8.8:53

vbtgsze.r-e.kr

dns

60 B
76 B
1
1

DNS Request

vbtgsze.r-e.kr

DNS Response

193.143.1.66
8.8.8.8:53

vbtgsze.r-e.kr

dns

60 B
76 B
1
1

DNS Request

vbtgsze.r-e.kr

DNS Response

193.143.1.66

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.