Analysis
- max time kernel
26s - max time network
150s - platform
ubuntu-22.04_amd64 - resource
ubuntu2204-amd64-20250619-en - resource tags
- submitted
18/07/2025, 05:51
General
- Target rsyslogd.elf
- Size 86KB
- Sample250718-gkagcsvrw9
- SHA256 0af9d56370ce7c7403889ca114fcfee2c9d8a74b0741ce4b01077f8c3f52a7df
Score
9/10
Malware Config
Signatures
- Contacts a large (149534) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Writes file to system bin folder 1 IoCs
- Changes its process name 1 IoCs