Analysis
- max time kernel
135s - max time network
136s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/11/2025, 04:19
Behavioral task
behavioral1
Sample
Polar.x86.elf
Resource
ubuntu1804-amd64-20250619-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target Polar.x86.elf
- Size 133KB
- Sample251129-exln2sdr31
- SHA256 c19dfac3c3c3c0b8a24170bfe71f2b2fdf357029cc407620292142945574c66b
- MD5 194ea952c8a60f71a78d8305117598f2
- SHA1 61db4ce77444b8ab27794313c269cdb4616bbf99
- SHA512 c0a17492eda4af5b9b9960d3deffe0e93d8e3bca693a132cb9973d9245f50a9b1b80d574d473f14e376c8a04b1592d8dce35016b9dabe640a4e6ff147675dadf
- SSDEEP 3072:o58NWobg8VHFrp1Qne9iEnrDRiwuiQ/0vdwz8xB:A8NDbg8VHgUi4SfcvGz8x
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Polar.x86.elf File opened for modification /dev/misc/watchdog Polar.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Polar.x86.elf File opened for modification /bin/watchdog Polar.x86.elf -
description ioc Process File opened for reading /proc/5/status Polar.x86.elf File opened for reading /proc/12/status Polar.x86.elf File opened for reading /proc/84/status Polar.x86.elf File opened for reading /proc/161/status Polar.x86.elf File opened for reading /proc/178/status Polar.x86.elf File opened for reading /proc/241/status Polar.x86.elf File opened for reading /proc/1161/status Polar.x86.elf File opened for reading /proc/27/status Polar.x86.elf File opened for reading /proc/26/status Polar.x86.elf File opened for reading /proc/35/status Polar.x86.elf File opened for reading /proc/115/status Polar.x86.elf File opened for reading /proc/159/status Polar.x86.elf File opened for reading /proc/900/status Polar.x86.elf File opened for reading /proc/164/status Polar.x86.elf File opened for reading /proc/497/status Polar.x86.elf File opened for reading /proc/709/status Polar.x86.elf File opened for reading /proc/717/status Polar.x86.elf File opened for reading /proc/974/status Polar.x86.elf File opened for reading /proc/564/status Polar.x86.elf File opened for reading /proc/908/status Polar.x86.elf File opened for reading /proc/1017/status Polar.x86.elf File opened for reading /proc/1047/status Polar.x86.elf File opened for reading /proc/1183/status Polar.x86.elf File opened for reading /proc/137/status Polar.x86.elf File opened for reading /proc/1052/status Polar.x86.elf File opened for reading /proc/10/status Polar.x86.elf File opened for reading /proc/79/status Polar.x86.elf File opened for reading /proc/173/status Polar.x86.elf File opened for reading /proc/505/status Polar.x86.elf File opened for reading /proc/655/status Polar.x86.elf File opened for reading /proc/29/status Polar.x86.elf File opened for reading /proc/1492/status Polar.x86.elf File opened for reading /proc/21/status Polar.x86.elf File opened for reading /proc/504/status Polar.x86.elf File opened for reading /proc/585/status Polar.x86.elf File opened for reading /proc/1038/status Polar.x86.elf File opened for reading /proc/1092/status Polar.x86.elf File opened for reading /proc/167/status Polar.x86.elf File opened for reading /proc/98/status Polar.x86.elf File opened for reading /proc/160/status Polar.x86.elf File opened for reading /proc/672/status Polar.x86.elf File opened for reading /proc/884/status Polar.x86.elf File opened for reading /proc/1054/status Polar.x86.elf File opened for reading /proc/1474/status Polar.x86.elf File opened for reading /proc/481/status Polar.x86.elf File opened for reading /proc/1043/status Polar.x86.elf File opened for reading /proc/1499/status Polar.x86.elf File opened for reading /proc/19/status Polar.x86.elf File opened for reading /proc/172/status Polar.x86.elf File opened for reading /proc/671/status Polar.x86.elf File opened for reading /proc/1056/status Polar.x86.elf File opened for reading /proc/6/status Polar.x86.elf File opened for reading /proc/15/status Polar.x86.elf File opened for reading /proc/78/status Polar.x86.elf File opened for reading /proc/89/status Polar.x86.elf File opened for reading /proc/176/status Polar.x86.elf File opened for reading /proc/922/status Polar.x86.elf File opened for reading /proc/968/status Polar.x86.elf File opened for reading /proc/1067/status Polar.x86.elf File opened for reading /proc/2/status Polar.x86.elf File opened for reading /proc/32/status Polar.x86.elf File opened for reading /proc/80/status Polar.x86.elf File opened for reading /proc/83/status Polar.x86.elf File opened for reading /proc/170/status Polar.x86.elf