Analysis
-
max time kernel
144s -
max time network
152s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
19-01-2025 14:17
Behavioral task
behavioral1
Sample
debug.dbg.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
4 signatures
150 seconds
General
-
Target
debug.dbg.elf
-
Size
65KB
-
MD5
23ef0306a74d6940fd63d99b87ecd7dd
-
SHA1
375bb9f9c344a4331290e2382a530ee8576f89be
-
SHA256
c8255fdd418f670ab92a2c163be211ac96fb9db22ddcc31a1c7402f6461e9cda
-
SHA512
c7bc994cb90c8bac92abae063c66a1d050edb5020d972f7df3e23410583c56f1186ea60bae87dccd6bc4cf3076b8a78740f71c80ff8ff3e4e1c9d5ab76d249e4
-
SSDEEP
1536:Q0KKI8WG1ugVT+LZW/VDDPg5hIYNmCo1vDVIVKYDUjVtV9iRO310IATkSlX:hKKI8WG1ugVT+LZW/VDDPg5hIYNmrB65
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1596 debug.dbg.elf -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog debug.dbg.elf File opened for modification /dev/misc/watchdog debug.dbg.elf -
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog debug.dbg.elf File opened for modification /bin/watchdog debug.dbg.elf -
Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1596 debug.dbg.elf