a94cbed8e902cb60c0fc574ad5163480c6f0a93006b51322c9cd6ba45a346638

Resubmissions

05/02/2026, 12:27

260205-pm674sh16a10

27/06/2025, 07:57

250627-jtpzhswyfz7

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/02/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x86_32.nn.elf
Size 73KB
Sample260205-pm674sh16a
SHA256 a94cbed8e902cb60c0fc574ad5163480c6f0a93006b51322c9cd6ba45a346638
MD5 5f18eb278dafc5c147e3e8853e022bdf
SHA1 acf6b71e2bd3a375a3d06672f7b19ab96b651389
SHA512 568b6dd6e73be963f7d15af90f826609008217242dc99ef29923106b4b84e2f0132707fe30ec12b64c3a6159616258f691b22afaaa1365a0a773fb05a6ff7ece
SSDEEP 1536:ZqARo8NYPaxBwheNlAo0MSUmwwzRzuqX/ttnEB+jYew4laq:ZNRohPaxiheNlAo3NUuqXVtno+Mrfq
TLSH
T1C9734AC1F643E4F0DE160975123BE33ADB72E579023CDB47DBA5EA32B842610A65636C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	x86_32.nn.elf
File opened for modification	/dev/misc/watchdog	x86_32.nn.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1548	x86_32.nn.elf

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1555/status	x86_32.nn.elf
File opened for reading	/proc/1/cmdline	x86_32.nn.elf

/tmp/x86_32.nn.elf
/tmp/x86_32.nn.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

motd

Path /etc/motd
Size 53B
SHA256 64dc39f3004dc93c9fc4f1467b4807f2d8e3eb0bfa96b15c19cd8e7d6fa77a1d
MD5 2bd9b4be30579e633fc0191aa93df486
SHA1 7d63a9bd9662e86666b27c1b50db8e7370c624ff
SHA512 ae6dd7b39191354cf43cf65e517460d7d4c61b8f5c08e33e6ca3c451dc7cab4de89f33934c89396b80f1aade0a4e2571bd5ae8b76ef80b737d4588703d2814d5
TLSH
T12E900218500D653700438525479621C951D2944D156381F56526C5B5478581175605C8
MD5 SHA1 SHA512 TLSH

Submit Download