Analysis
-
max time kernel
131s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
03-02-2025 10:23
Behavioral task
behavioral1
Sample
debug.dbg.elf
Resource
ubuntu2204-amd64-20240611-en
5 signatures
150 seconds
General
-
Target
debug.dbg.elf
-
Size
69KB
-
MD5
4f0598b31324cdbb14b54d10de2c29c5
-
SHA1
4c247bcbe0bbd73ca77f3fbd0462a2a5bc11493c
-
SHA256
0c3e585f6044a14b96441f88c42e2d09bd71e82724db5b981876a1d1dda17d74
-
SHA512
2c1aee0abba26f280166a7977a035f8621450fd2a544c6805792b9e6634c71fcf23812243cabca6bdb836b8dc865270a85a7103ab7e2ddf83124912095333cef
-
SSDEEP
1536:V5IWM3pufm+dOnBi+Z9XI3tPJfhI9/XZE+OjEHedVOJw1qE:V5Ix3pufvdOHwPJpA/XZExjE+eJX
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid 1587 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes file to system bin folder 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1587 -
description ioc File opened for reading /proc/self/maps