Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
16-01-2025 07:47
Behavioral task
behavioral1
Sample
byte.x86.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
3 signatures
150 seconds
General
-
Target
byte.x86.elf
-
Size
73KB
-
MD5
a999e004765e2021a58c7f482885b6bc
-
SHA1
5afce80a370313bad25608c2f64fb68902d955c0
-
SHA256
eea347168b8f25340b94765571a0d5906da3f67210d78f350421976e7a703e8f
-
SHA512
af4faa5c281a6f32e696e407ddbc5afa5eb0d109bbdf3baa151e1e12f6a00e31be08c662cc387e722d1d2dc9d2d84a5fdfc314143d09173a41334c1df580c546
-
SSDEEP
1536:aSYXBbJKbFe5AQZqOtRjX1lxQ7//S2xnLs+IJrF/DOn/YUTB/:ybIbFe5wOtB3m7XS2xLCJdinJt/
Score
7/10
Malware Config
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog byte.x86.elf File opened for modification /dev/misc/watchdog byte.x86.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/1669/cmdline byte.x86.elf File opened for reading /proc/1784/cmdline byte.x86.elf File opened for reading /proc/73/cmdline byte.x86.elf File opened for reading /proc/79/cmdline byte.x86.elf File opened for reading /proc/206/cmdline byte.x86.elf File opened for reading /proc/212/cmdline byte.x86.elf File opened for reading /proc/1158/cmdline byte.x86.elf File opened for reading /proc/1508/cmdline byte.x86.elf File opened for reading /proc/1053/cmdline byte.x86.elf File opened for reading /proc/1130/cmdline byte.x86.elf File opened for reading /proc/1275/cmdline byte.x86.elf File opened for reading /proc/1630/cmdline byte.x86.elf File opened for reading /proc/1635/cmdline byte.x86.elf File opened for reading /proc/1646/cmdline byte.x86.elf File opened for reading /proc/1633/cmdline byte.x86.elf File opened for reading /proc/1663/cmdline byte.x86.elf File opened for reading /proc/9/cmdline byte.x86.elf File opened for reading /proc/18/cmdline byte.x86.elf File opened for reading /proc/82/cmdline byte.x86.elf File opened for reading /proc/113/cmdline byte.x86.elf File opened for reading /proc/1032/cmdline byte.x86.elf File opened for reading /proc/1239/cmdline byte.x86.elf File opened for reading /proc/1753/cmdline byte.x86.elf File opened for reading /proc/4/cmdline byte.x86.elf File opened for reading /proc/88/cmdline byte.x86.elf File opened for reading /proc/1600/cmdline byte.x86.elf File opened for reading /proc/89/cmdline byte.x86.elf File opened for reading /proc/749/cmdline byte.x86.elf File opened for reading /proc/1612/cmdline byte.x86.elf File opened for reading /proc/1648/cmdline byte.x86.elf File opened for reading /proc/77/cmdline byte.x86.elf File opened for reading /proc/208/cmdline byte.x86.elf File opened for reading /proc/741/cmdline byte.x86.elf File opened for reading /proc/1607/cmdline byte.x86.elf File opened for reading /proc/1702/cmdline byte.x86.elf File opened for reading /proc/506/cmdline byte.x86.elf File opened for reading /proc/794/cmdline byte.x86.elf File opened for reading /proc/1616/cmdline byte.x86.elf File opened for reading /proc/1644/cmdline byte.x86.elf File opened for reading /proc/1662/cmdline byte.x86.elf File opened for reading /proc/8/cmdline byte.x86.elf File opened for reading /proc/1080/cmdline byte.x86.elf File opened for reading /proc/1107/cmdline byte.x86.elf File opened for reading /proc/1592/cmdline byte.x86.elf File opened for reading /proc/1602/cmdline byte.x86.elf File opened for reading /proc/796/cmdline byte.x86.elf File opened for reading /proc/1806/cmdline byte.x86.elf File opened for reading /proc/3/cmdline byte.x86.elf File opened for reading /proc/1487/cmdline byte.x86.elf File opened for reading /proc/1603/cmdline byte.x86.elf File opened for reading /proc/1609/cmdline byte.x86.elf File opened for reading /proc/1673/cmdline byte.x86.elf File opened for reading /proc/1732/cmdline byte.x86.elf File opened for reading /proc/843/cmdline byte.x86.elf File opened for reading /proc/1597/cmdline byte.x86.elf File opened for reading /proc/1637/cmdline byte.x86.elf File opened for reading /proc/1723/cmdline byte.x86.elf File opened for reading /proc/1776/cmdline byte.x86.elf File opened for reading /proc/505/cmdline byte.x86.elf File opened for reading /proc/1175/cmdline byte.x86.elf File opened for reading /proc/1184/cmdline byte.x86.elf File opened for reading /proc/195/cmdline byte.x86.elf File opened for reading /proc/1156/cmdline byte.x86.elf File opened for reading /proc/1160/cmdline byte.x86.elf