Analysis
- max time kernel
148s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
24/10/2025, 18:13
Behavioral task
behavioral1
Sample
Orbt.i686.elf
Resource
ubuntu1804-amd64-20250619-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target Orbt.i686.elf
- Size 57KB
- Sample251024-wt4twstkdk
- SHA256 a24da5b4b475ca6e4553b77771b11d779503f9957a35cd0bbab583309c62e97a
- MD5 2153e2724be997b0928e95cca456bf86
- SHA1 0b40d74c9f03e8f1a88a82eda00d3f0178098303
- SHA512 7a0acd9d4dd76faeda3f1376abae7269d7e1d03614877c2dbec628b13cce8677caa88d6ebd1ca812c893bba59bab543600f6a2ad361d33fbbfbf655ad84a3a53
- SSDEEP 1536:ZxX2KN8WO97MnIYNbWiCcpCRpGsgf4nouy8HyB:7mKN8WO97Mn5NbWiCcpSGcout2
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc File opened for modification /sbin/watchdog File opened for modification /bin/watchdog -
description ioc File opened for reading /proc/1514/status File opened for reading /proc/5/status File opened for reading /proc/34/status File opened for reading /proc/1244/status File opened for reading /proc/1252/status File opened for reading /proc/1483/status File opened for reading /proc/166/status File opened for reading /proc/16/status File opened for reading /proc/161/status File opened for reading /proc/539/status File opened for reading /proc/576/status File opened for reading /proc/1325/status File opened for reading /proc/23/status File opened for reading /proc/35/status File opened for reading /proc/489/status File opened for reading /proc/1075/status File opened for reading /proc/18/status File opened for reading /proc/170/status File opened for reading /proc/262/status File opened for reading /proc/1191/status File opened for reading /proc/173/status File opened for reading /proc/1056/status File opened for reading /proc/1376/status File opened for reading /proc/9/status File opened for reading /proc/11/status File opened for reading /proc/137/status File opened for reading /proc/904/status File opened for reading /proc/1033/status File opened for reading /proc/1069/status File opened for reading /proc/1087/status File opened for reading /proc/1173/status File opened for reading /proc/174/status File opened for reading /proc/655/status File opened for reading /proc/1066/status File opened for reading /proc/921/status File opened for reading /proc/946/status File opened for reading /proc/713/status File opened for reading /proc/20/status File opened for reading /proc/21/status File opened for reading /proc/24/status File opened for reading /proc/82/status File opened for reading /proc/178/status File opened for reading /proc/29/status File opened for reading /proc/32/status File opened for reading /proc/165/status File opened for reading /proc/481/status File opened for reading /proc/976/status File opened for reading /proc/1052/status File opened for reading /proc/1093/status File opened for reading /proc/1323/status File opened for reading /proc/8/status File opened for reading /proc/162/status File opened for reading /proc/1029/status File opened for reading /proc/1512/status File opened for reading /proc/6/status File opened for reading /proc/168/status File opened for reading /proc/493/status File opened for reading /proc/555/status File opened for reading /proc/983/status File opened for reading /proc/1089/status File opened for reading /proc/13/status File opened for reading /proc/559/status File opened for reading /proc/1302/status File opened for reading /proc/1324/status