Analysis
-
max time kernel
131s -
max time network
147s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20250307-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
19/03/2025, 22:49
Behavioral task
behavioral1
Sample
debug.dbg
Resource
ubuntu2204-amd64-20250307-en
5 signatures
150 seconds
General
-
Target
debug.dbg
-
Size
69KB
-
MD5
19cd1787a89d92e82e0c3b0618245d5d
-
SHA1
364be509eeab78ba08e5805447bfa5476930c5fb
-
SHA256
76a0f1dfac6e3430187108ad85a1253d8aff02524ca27e14998f9a094691c08b
-
SHA512
c8ebb6d3a87e547b69eb734218b31d1e3f667adafd3d0afd9ebb1593118d46892678009720f691c619da8fdb064f84027006109056231725b2cf837bdb7343c9
-
SSDEEP
1536:V5IWM3pufm+dOnBi+Z9XI3tPJfhI93ArE+OjEHedVOJw19E:V5Ix3pufvdOHwPJpA3ArExjE+eJA
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid 1570 -
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog -
Writes file to system bin folder 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
Changes its process name 1 IoCs
description pid Changes the process name, possibly in an attempt to hide itself 1570 -
description ioc File opened for reading /proc/self/maps