Analysis
- max time kernel
145s - max time network
148s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20250619-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
01/12/2025, 06:39
Behavioral task
behavioral1
Sample
S3o.x86.elf
Resource
ubuntu1804-amd64-20250619-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target S3o.x86.elf
- Size 98KB
- Sample251201-herdcsft3b
- SHA256 fbaa2083f4322defe719fe7efcb67741d5b7c0ee1107f696b548dda629bd69fc
- MD5 910c33e4980530d1605c15390213e989
- SHA1 784a06dc666922247571de66474425e8a4b2143e
- SHA512 ec79d0409c67e459d24d3db4bb43ea1e16cfbf1a3b579117ed0876d332a135d872ef70d4c0db96ca060bbc68f274c3b1b736d8e861a72d5274b47b4098fe7cc7
- SSDEEP 1536:FnbhjFYbf1Ui5hKbc+sxKLb+mX1QrUSr1pAm3Jn5wR54yfZLi/sd:FbhWbT+c+sxK2mlQrUs1Z3vY5Xi/sd
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog S3o.x86.elf File opened for modification /dev/misc/watchdog S3o.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog S3o.x86.elf File opened for modification /bin/watchdog S3o.x86.elf -
description ioc Process File opened for reading /proc/86/status S3o.x86.elf File opened for reading /proc/158/status S3o.x86.elf File opened for reading /proc/175/status S3o.x86.elf File opened for reading /proc/657/status S3o.x86.elf File opened for reading /proc/987/status S3o.x86.elf File opened for reading /proc/1032/status S3o.x86.elf File opened for reading /proc/1037/status S3o.x86.elf File opened for reading /proc/25/status S3o.x86.elf File opened for reading /proc/163/status S3o.x86.elf File opened for reading /proc/320/status S3o.x86.elf File opened for reading /proc/566/status S3o.x86.elf File opened for reading /proc/931/status S3o.x86.elf File opened for reading /proc/115/status S3o.x86.elf File opened for reading /proc/168/status S3o.x86.elf File opened for reading /proc/169/status S3o.x86.elf File opened for reading /proc/600/status S3o.x86.elf File opened for reading /proc/602/status S3o.x86.elf File opened for reading /proc/1283/status S3o.x86.elf File opened for reading /proc/1492/status S3o.x86.elf File opened for reading /proc/17/status S3o.x86.elf File opened for reading /proc/29/status S3o.x86.elf File opened for reading /proc/84/status S3o.x86.elf File opened for reading /proc/137/status S3o.x86.elf File opened for reading /proc/245/status S3o.x86.elf File opened for reading /proc/441/status S3o.x86.elf File opened for reading /proc/1077/status S3o.x86.elf File opened for reading /proc/1079/status S3o.x86.elf File opened for reading /proc/83/status S3o.x86.elf File opened for reading /proc/723/status S3o.x86.elf File opened for reading /proc/917/status S3o.x86.elf File opened for reading /proc/1467/status S3o.x86.elf File opened for reading /proc/1495/status S3o.x86.elf File opened for reading /proc/5/status S3o.x86.elf File opened for reading /proc/10/status S3o.x86.elf File opened for reading /proc/36/status S3o.x86.elf File opened for reading /proc/78/status S3o.x86.elf File opened for reading /proc/89/status S3o.x86.elf File opened for reading /proc/409/status S3o.x86.elf File opened for reading /proc/485/status S3o.x86.elf File opened for reading /proc/511/status S3o.x86.elf File opened for reading /proc/202/status S3o.x86.elf File opened for reading /proc/463/status S3o.x86.elf File opened for reading /proc/937/status S3o.x86.elf File opened for reading /proc/954/status S3o.x86.elf File opened for reading /proc/978/status S3o.x86.elf File opened for reading /proc/1491/status S3o.x86.elf File opened for reading /proc/2/status S3o.x86.elf File opened for reading /proc/18/status S3o.x86.elf File opened for reading /proc/167/status S3o.x86.elf File opened for reading /proc/670/status S3o.x86.elf File opened for reading /proc/1245/status S3o.x86.elf File opened for reading /proc/35/status S3o.x86.elf File opened for reading /proc/81/status S3o.x86.elf File opened for reading /proc/407/status S3o.x86.elf File opened for reading /proc/414/status S3o.x86.elf File opened for reading /proc/466/status S3o.x86.elf File opened for reading /proc/1040/status S3o.x86.elf File opened for reading /proc/1043/status S3o.x86.elf File opened for reading /proc/1138/status S3o.x86.elf File opened for reading /proc/6/status S3o.x86.elf File opened for reading /proc/21/status S3o.x86.elf File opened for reading /proc/171/status S3o.x86.elf File opened for reading /proc/1239/status S3o.x86.elf File opened for reading /proc/9/status S3o.x86.elf