Analysis
- max time kernel
149s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
24/03/2026, 04:15
Behavioral task
behavioral1
Sample
tux.x86.elf
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target tux.x86.elf
- Size 61KB
- Sample260324-evdknaay2t
- SHA256 e3060223977da8f21e95f6df338863429d0d547e68063658c875b629e27d4b6f
- MD5 e2b571aa36d82e4825a0df4e1e2b013f
- SHA1 c3b8abe19dc29359a7942dda399b1b56d1f55ff8
- SHA512 2ae49d92bf929d3a54abfafc1ac768aedf3cf5c3dddd4942957d3c672c4ff72a1d65ab5b31df1e627639b132283321ae6b0543659e2a9fd0cba70dd0926266c0
- SSDEEP 1536:yFTEDQhVTerheQ+ebAJMUAlUhCA7ALMurVQSPqs:yFTyQh1eHpbAJZAqhb74MYnqs
- TLSH T1AF536CC5A687C8F5E81605756133AB374B37F53B1029EB97CBDCAA229C42B01E21739C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog tux.x86.elf File opened for modification /dev/misc/watchdog tux.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/204/maps tux.x86.elf File opened for reading /proc/175/maps tux.x86.elf File opened for reading /proc/173/maps tux.x86.elf File opened for reading /proc/169/maps tux.x86.elf File opened for reading /proc/159/maps tux.x86.elf File opened for reading /proc/80/maps tux.x86.elf File opened for reading /proc/572/maps tux.x86.elf File opened for reading /proc/313/maps tux.x86.elf File opened for reading /proc/82/maps tux.x86.elf File opened for reading /proc/31/maps tux.x86.elf File opened for reading /proc/29/maps tux.x86.elf File opened for reading /proc/86/maps tux.x86.elf File opened for reading /proc/27/maps tux.x86.elf File opened for reading /proc/938/maps tux.x86.elf File opened for reading /proc/416/maps tux.x86.elf File opened for reading /proc/414/maps tux.x86.elf File opened for reading /proc/79/maps tux.x86.elf File opened for reading /proc/30/maps tux.x86.elf File opened for reading /proc/911/maps tux.x86.elf File opened for reading /proc/716/maps tux.x86.elf File opened for reading /proc/674/maps tux.x86.elf File opened for reading /proc/665/maps tux.x86.elf File opened for reading /proc/485/maps tux.x86.elf File opened for reading /proc/471/maps tux.x86.elf File opened for reading /proc/452/maps tux.x86.elf File opened for reading /proc/241/maps tux.x86.elf File opened for reading /proc/985/maps tux.x86.elf File opened for reading /proc/467/maps tux.x86.elf File opened for reading /proc/419/maps tux.x86.elf File opened for reading /proc/418/maps tux.x86.elf File opened for reading /proc/174/maps tux.x86.elf File opened for reading /proc/164/maps tux.x86.elf File opened for reading /proc/161/maps tux.x86.elf File opened for reading /proc/35/maps tux.x86.elf File opened for reading /proc/995/maps tux.x86.elf File opened for reading /proc/958/maps tux.x86.elf File opened for reading /proc/933/maps tux.x86.elf File opened for reading /proc/720/maps tux.x86.elf File opened for reading /proc/616/maps tux.x86.elf File opened for reading /proc/614/maps tux.x86.elf File opened for reading /proc/160/maps tux.x86.elf File opened for reading /proc/78/maps tux.x86.elf File opened for reading /proc/999/maps tux.x86.elf File opened for reading /proc/980/maps tux.x86.elf File opened for reading /proc/916/maps tux.x86.elf File opened for reading /proc/479/maps tux.x86.elf File opened for reading /proc/168/maps tux.x86.elf File opened for reading /proc/162/maps tux.x86.elf File opened for reading /proc/89/maps tux.x86.elf File opened for reading /proc/32/maps tux.x86.elf File opened for reading /proc/683/maps tux.x86.elf File opened for reading /proc/656/maps tux.x86.elf File opened for reading /proc/499/maps tux.x86.elf File opened for reading /proc/482/maps tux.x86.elf File opened for reading /proc/81/maps tux.x86.elf File opened for reading /proc/34/maps tux.x86.elf File opened for reading /proc/971/maps tux.x86.elf File opened for reading /proc/919/maps tux.x86.elf File opened for reading /proc/725/maps tux.x86.elf File opened for reading /proc/584/maps tux.x86.elf File opened for reading /proc/172/maps tux.x86.elf File opened for reading /proc/170/maps tux.x86.elf File opened for reading /proc/84/maps tux.x86.elf File opened for reading /proc/26/maps tux.x86.elf - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 1532 tux.x86.elf Changes the process name, possibly in an attempt to hide itself /var/Sofia 1533 tux.x86.elf -
description ioc Process File opened for reading /proc/1562/maps tux.x86.elf File opened for reading /proc/1926/maps tux.x86.elf File opened for reading /proc/1273/maps tux.x86.elf File opened for reading /proc/1155/maps tux.x86.elf File opened for reading /proc/1107/maps tux.x86.elf File opened for reading /proc/1079/maps tux.x86.elf File opened for reading /proc/1762/maps tux.x86.elf File opened for reading /proc/1066/maps tux.x86.elf File opened for reading /proc/1052/maps tux.x86.elf File opened for reading /proc/1731/maps tux.x86.elf File opened for reading /proc/1856/maps tux.x86.elf File opened for reading /proc/2174/maps tux.x86.elf File opened for reading /proc/1312/maps tux.x86.elf File opened for reading /proc/1102/maps tux.x86.elf File opened for reading /proc/1099/maps tux.x86.elf File opened for reading /proc/1745/maps tux.x86.elf File opened for reading /proc/1885/maps tux.x86.elf File opened for reading /proc/1953/maps tux.x86.elf File opened for reading /proc/1043/maps tux.x86.elf File opened for reading /proc/1595/maps tux.x86.elf File opened for reading /proc/1651/maps tux.x86.elf File opened for reading /proc/1631/maps tux.x86.elf File opened for reading /proc/1706/maps tux.x86.elf File opened for reading /proc/2136/maps tux.x86.elf File opened for reading /proc/2180/maps tux.x86.elf File opened for reading /proc/1624/maps tux.x86.elf File opened for reading /proc/2155/maps tux.x86.elf File opened for reading /proc/1528/maps tux.x86.elf File opened for reading /proc/1725/maps tux.x86.elf File opened for reading /proc/1914/maps tux.x86.elf File opened for reading /proc/1903/maps tux.x86.elf File opened for reading /proc/1047/maps tux.x86.elf File opened for reading /proc/2041/maps tux.x86.elf File opened for reading /proc/2196/maps tux.x86.elf File opened for reading /proc/1521/maps tux.x86.elf File opened for reading /proc/1391/maps tux.x86.elf File opened for reading /proc/1270/maps tux.x86.elf File opened for reading /proc/1039/maps tux.x86.elf File opened for reading /proc/1759/maps tux.x86.elf File opened for reading /proc/1817/maps tux.x86.elf File opened for reading /proc/1849/maps tux.x86.elf File opened for reading /proc/2145/maps tux.x86.elf File opened for reading /proc/1356/maps tux.x86.elf File opened for reading /proc/1140/maps tux.x86.elf File opened for reading /proc/1964/maps tux.x86.elf File opened for reading /proc/2027/maps tux.x86.elf File opened for reading /proc/2125/maps tux.x86.elf File opened for reading /proc/1537/maps tux.x86.elf File opened for reading /proc/1642/maps tux.x86.elf File opened for reading /proc/1752/maps tux.x86.elf File opened for reading /proc/1911/maps tux.x86.elf File opened for reading /proc/1524/maps tux.x86.elf File opened for reading /proc/1955/maps tux.x86.elf File opened for reading /proc/1096/maps tux.x86.elf File opened for reading /proc/1835/maps tux.x86.elf File opened for reading /proc/1829/maps tux.x86.elf File opened for reading /proc/1941/maps tux.x86.elf File opened for reading /proc/1935/maps tux.x86.elf File opened for reading /proc/1573/maps tux.x86.elf File opened for reading /proc/1732/maps tux.x86.elf File opened for reading /proc/1863/maps tux.x86.elf File opened for reading /proc/1201/maps tux.x86.elf File opened for reading /proc/1658/maps tux.x86.elf File opened for reading /proc/2046/maps tux.x86.elf