Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260127-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
15/04/2026, 12:18
Behavioral task
behavioral1
Sample
Space.i686
Resource
ubuntu1804-amd64-20260127-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target Space.i686
- Size 35KB
- Sample260415-pgmarags9y
- SHA256 53da8cfb7ae70f813715d80ee69e98e1014761527e246f234cde590b8b57053f
- MD5 b8b9a1ff12cb112dd5cc159f802aba68
- SHA1 b2988efe6571da07c4aff7a0d218bce3561674dc
- SHA512 aafe003161399bdffcb6e72ee5ead02056eeac8d604cfe8897ee2724697677702066682d5862e0d2545f293d634991e51772123438aa99ebe80ea94201ba21a4
- SSDEEP 768:BW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfFmmnbcuyD7UHQRja:E4B1E+TcAYC9owuiYmmnouy8Hyu
- TLSH T1ECF2F2B1C0568B18E33C41FA89AD6E0D2844D85DEC0494F5EE8C7D738A15F94AEF1B9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.i686 File opened for modification /dev/misc/watchdog Space.i686 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.i686 File opened for modification /bin/watchdog Space.i686 -
description ioc Process File opened for reading /proc/9/status Space.i686 File opened for reading /proc/177/status Space.i686 File opened for reading /proc/683/status Space.i686 File opened for reading /proc/1257/status Space.i686 File opened for reading /proc/24/status Space.i686 File opened for reading /proc/34/status Space.i686 File opened for reading /proc/1081/status Space.i686 File opened for reading /proc/181/status Space.i686 File opened for reading /proc/503/status Space.i686 File opened for reading /proc/1/status Space.i686 File opened for reading /proc/2/status Space.i686 File opened for reading /proc/5/status Space.i686 File opened for reading /proc/10/status Space.i686 File opened for reading /proc/11/status Space.i686 File opened for reading /proc/979/status Space.i686 File opened for reading /proc/13/status Space.i686 File opened for reading /proc/86/status Space.i686 File opened for reading /proc/327/status Space.i686 File opened for reading /proc/414/status Space.i686 File opened for reading /proc/571/status Space.i686 File opened for reading /proc/976/status Space.i686 File opened for reading /proc/999/status Space.i686 File opened for reading /proc/1307/status Space.i686 File opened for reading /proc/18/status Space.i686 File opened for reading /proc/1098/status Space.i686 File opened for reading /proc/1167/status Space.i686 File opened for reading /proc/1327/status Space.i686 File opened for reading /proc/1385/status Space.i686 File opened for reading /proc/35/status Space.i686 File opened for reading /proc/115/status Space.i686 File opened for reading /proc/324/status Space.i686 File opened for reading /proc/417/status Space.i686 File opened for reading /proc/1103/status Space.i686 File opened for reading /proc/1159/status Space.i686 File opened for reading /proc/22/status Space.i686 File opened for reading /proc/15/status Space.i686 File opened for reading /proc/137/status Space.i686 File opened for reading /proc/474/status Space.i686 File opened for reading /proc/505/status Space.i686 File opened for reading /proc/535/status Space.i686 File opened for reading /proc/911/status Space.i686 File opened for reading /proc/919/status Space.i686 File opened for reading /proc/79/status Space.i686 File opened for reading /proc/172/status Space.i686 File opened for reading /proc/500/status Space.i686 File opened for reading /proc/651/status Space.i686 File opened for reading /proc/916/status Space.i686 File opened for reading /proc/1052/status Space.i686 File opened for reading /proc/20/status Space.i686 File opened for reading /proc/174/status Space.i686 File opened for reading /proc/469/status Space.i686 File opened for reading /proc/1086/status Space.i686 File opened for reading /proc/1097/status Space.i686 File opened for reading /proc/1356/status Space.i686 File opened for reading /proc/1060/status Space.i686 File opened for reading /proc/32/status Space.i686 File opened for reading /proc/185/status Space.i686 File opened for reading /proc/494/status Space.i686 File opened for reading /proc/731/status Space.i686 File opened for reading /proc/6/status Space.i686 File opened for reading /proc/14/status Space.i686 File opened for reading /proc/496/status Space.i686 File opened for reading /proc/995/status Space.i686 File opened for reading /proc/84/status Space.i686