Analysis
- max time kernel
144s - max time network
146s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
15/04/2026, 12:15
Behavioral task
behavioral1
Sample
Space.i686
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target Space.i686
- Size 35KB
- Sample260415-pe6avags2x
- SHA256 53da8cfb7ae70f813715d80ee69e98e1014761527e246f234cde590b8b57053f
- MD5 b8b9a1ff12cb112dd5cc159f802aba68
- SHA1 b2988efe6571da07c4aff7a0d218bce3561674dc
- SHA512 aafe003161399bdffcb6e72ee5ead02056eeac8d604cfe8897ee2724697677702066682d5862e0d2545f293d634991e51772123438aa99ebe80ea94201ba21a4
- SSDEEP 768:BW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfFmmnbcuyD7UHQRja:E4B1E+TcAYC9owuiYmmnouy8Hyu
- TLSH T1ECF2F2B1C0568B18E33C41FA89AD6E0D2844D85DEC0494F5EE8C7D738A15F94AEF1B9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.i686 File opened for modification /dev/misc/watchdog Space.i686 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.i686 File opened for modification /bin/watchdog Space.i686 -
description ioc Process File opened for reading /proc/1042/status Space.i686 File opened for reading /proc/1212/status Space.i686 File opened for reading /proc/1503/status Space.i686 File opened for reading /proc/420/status Space.i686 File opened for reading /proc/458/status Space.i686 File opened for reading /proc/660/status Space.i686 File opened for reading /proc/717/status Space.i686 File opened for reading /proc/1016/status Space.i686 File opened for reading /proc/27/status Space.i686 File opened for reading /proc/32/status Space.i686 File opened for reading /proc/163/status Space.i686 File opened for reading /proc/438/status Space.i686 File opened for reading /proc/450/status Space.i686 File opened for reading /proc/913/status Space.i686 File opened for reading /proc/159/status Space.i686 File opened for reading /proc/539/status Space.i686 File opened for reading /proc/958/status Space.i686 File opened for reading /proc/9/status Space.i686 File opened for reading /proc/268/status Space.i686 File opened for reading /proc/427/status Space.i686 File opened for reading /proc/1047/status Space.i686 File opened for reading /proc/1083/status Space.i686 File opened for reading /proc/1373/status Space.i686 File opened for reading /proc/1507/status Space.i686 File opened for reading /proc/161/status Space.i686 File opened for reading /proc/162/status Space.i686 File opened for reading /proc/176/status Space.i686 File opened for reading /proc/411/status Space.i686 File opened for reading /proc/517/status Space.i686 File opened for reading /proc/631/status Space.i686 File opened for reading /proc/1028/status Space.i686 File opened for reading /proc/82/status Space.i686 File opened for reading /proc/680/status Space.i686 File opened for reading /proc/1059/status Space.i686 File opened for reading /proc/137/status Space.i686 File opened for reading /proc/5/status Space.i686 File opened for reading /proc/6/status Space.i686 File opened for reading /proc/80/status Space.i686 File opened for reading /proc/457/status Space.i686 File opened for reading /proc/598/status Space.i686 File opened for reading /proc/1007/status Space.i686 File opened for reading /proc/1513/status Space.i686 File opened for reading /proc/10/status Space.i686 File opened for reading /proc/115/status Space.i686 File opened for reading /proc/165/status Space.i686 File opened for reading /proc/169/status Space.i686 File opened for reading /proc/637/status Space.i686 File opened for reading /proc/938/status Space.i686 File opened for reading /proc/1086/status Space.i686 File opened for reading /proc/1168/status Space.i686 File opened for reading /proc/31/status Space.i686 File opened for reading /proc/167/status Space.i686 File opened for reading /proc/203/status Space.i686 File opened for reading /proc/204/status Space.i686 File opened for reading /proc/657/status Space.i686 File opened for reading /proc/975/status Space.i686 File opened for reading /proc/979/status Space.i686 File opened for reading /proc/1012/status Space.i686 File opened for reading /proc/23/status Space.i686 File opened for reading /proc/30/status Space.i686 File opened for reading /proc/658/status Space.i686 File opened for reading /proc/84/status Space.i686 File opened for reading /proc/988/status Space.i686 File opened for reading /proc/1264/status Space.i686