Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
06/11/2025, 07:03
Behavioral task
behavioral1
Sample
morte.i686.elf
Resource
ubuntu1804-amd64-20250619-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target morte.i686.elf
- Size 38KB
- Sample251106-hvf8bssmap
- SHA256 893b92fe98aa586f245fa0a75ab7af10992788dffd31bc91fcf5b54a5f59ad4d
- MD5 4219b8e00cfeb4189d8977ad3c9ed4a1
- SHA1 0239b670e5611254f4c59797aea9770216626085
- SHA512 d4ef9defbace742525c59192c016efeb14576937196cd354fcf8f97f16fcc668b8635c03811f045664218faa40488cd878c18b24920960452432c6e3d75fbfba
- SSDEEP 768:9zlXEjfwVOK7tB+hcI/JiLvA61nyQil0vDuek+WpryhdlkD5/bE16wHrfnbcuyDl:j6YVOKE/XdLlfek+3hw5/g4wHznouy80
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Mirai family
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc File opened for modification /dev/watchdog File opened for modification /dev/misc/watchdog - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc File opened for modification /bin/watchdog File opened for modification /sbin/watchdog -
description ioc File opened for reading /proc/890/status File opened for reading /proc/1021/status File opened for reading /proc/523/status File opened for reading /proc/716/status File opened for reading /proc/1042/status File opened for reading /proc/1131/status File opened for reading /proc/1/status File opened for reading /proc/25/status File opened for reading /proc/175/status File opened for reading /proc/204/status File opened for reading /proc/974/status File opened for reading /proc/1056/status File opened for reading /proc/1504/status File opened for reading /proc/2/status File opened for reading /proc/5/status File opened for reading /proc/7/status File opened for reading /proc/15/status File opened for reading /proc/35/status File opened for reading /proc/606/status File opened for reading /proc/674/status File opened for reading /proc/917/status File opened for reading /proc/16/status File opened for reading /proc/162/status File opened for reading /proc/575/status File opened for reading /proc/987/status File opened for reading /proc/1063/status File opened for reading /proc/1085/status File opened for reading /proc/1343/status File opened for reading /proc/1508/status File opened for reading /proc/26/status File opened for reading /proc/36/status File opened for reading /proc/171/status File opened for reading /proc/491/status File opened for reading /proc/895/status File opened for reading /proc/13/status File opened for reading /proc/81/status File opened for reading /proc/160/status File opened for reading /proc/961/status File opened for reading /proc/997/status File opened for reading /proc/1250/status File opened for reading /proc/161/status File opened for reading /proc/541/status File opened for reading /proc/1046/status File opened for reading /proc/1069/status File opened for reading /proc/1319/status File opened for reading /proc/432/status File opened for reading /proc/18/status File opened for reading /proc/86/status File opened for reading /proc/137/status File opened for reading /proc/416/status File opened for reading /proc/1075/status File opened for reading /proc/1092/status File opened for reading /proc/11/status File opened for reading /proc/82/status File opened for reading /proc/559/status File opened for reading /proc/691/status File opened for reading /proc/1148/status File opened for reading /proc/1241/status File opened for reading /proc/1333/status File opened for reading /proc/1505/status File opened for reading /proc/485/status File opened for reading /proc/671/status File opened for reading /proc/23/status File opened for reading /proc/474/status