Analysis
- max time kernel
149s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
17/04/2026, 22:45
Behavioral task
behavioral1
Sample
px86.elf
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target px86.elf
- Size 57KB
- Sample260417-2pft6ac121
- SHA256 045b1f4610c6b0ff9e787a2cee78f0f0a09c853da59bd4973a29b84645a94443
- MD5 b057a960da9cb5c9df57c08eda780e08
- SHA1 678da8a53327a9afb0688368214c108f773e91c5
- SHA512 90c1b510b5447a4fbb7a13b5e1aeffc73b16614f5273ec397e25db9cb7c314889d45ec65cba777b8cb51321b11284f697fefbc49705b4e17ad6d1e95e10cf6b6
- SSDEEP 1536:7/R1J8A+SM8Xu8B6bmYQ3ah39aOXqn9OThX4f/fnouy8tyni:7vJ8A+SUK3ap9aq1sXoutei
- TLSH T1474301C0D2A39A2DBE7BD0B07DBDF70E1AD1B5946168DAF07ED01004A616F568B607A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Deletes itself 1 IoCs
pid Process 1525 px86.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog px86.elf File opened for modification /dev/misc/watchdog px86.elf - Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1525 px86.elf -
description ioc Process File opened for reading /proc/1026cmdline px86.elf File opened for reading /proc/1055cmdline px86.elf File opened for reading /proc/1063cmdline px86.elf File opened for reading /proc/4cmdline px86.elf File opened for reading /proc/36cmdline px86.elf File opened for reading /proc/81cmdline px86.elf File opened for reading /proc/466cmdline px86.elf File opened for reading /proc/533cmdline px86.elf File opened for reading /proc/983cmdline px86.elf File opened for reading /proc/1100cmdline px86.elf File opened for reading /proc/20cmdline px86.elf File opened for reading /proc/35cmdline px86.elf File opened for reading /proc/565cmdline px86.elf File opened for reading /proc/1083cmdline px86.elf File opened for reading /proc/1494cmdline px86.elf File opened for reading /proc/1518cmdline px86.elf File opened for reading /proc/5cmdline px86.elf File opened for reading /proc/24cmdline px86.elf File opened for reading /proc/27cmdline px86.elf File opened for reading /proc/184cmdline px86.elf File opened for reading /proc/257cmdline px86.elf File opened for reading /proc/441cmdline px86.elf File opened for reading /proc/619cmdline px86.elf File opened for reading /proc/692cmdline px86.elf File opened for reading /proc/976cmdline px86.elf File opened for reading /proc/1105cmdline px86.elf File opened for reading /proc/1204cmdline px86.elf File opened for reading /proc/1389cmdline px86.elf File opened for reading /proc/181cmdline px86.elf File opened for reading /proc/497cmdline px86.elf File opened for reading /proc/1045cmdline px86.elf File opened for reading /proc/1049cmdline px86.elf File opened for reading /proc/1173cmdline px86.elf File opened for reading /proc/182cmdline px86.elf File opened for reading /proc/183cmdline px86.elf File opened for reading /proc/424cmdline px86.elf File opened for reading /proc/557cmdline px86.elf File opened for reading /proc/953cmdline px86.elf File opened for reading /proc/1065cmdline px86.elf File opened for reading /proc/1186cmdline px86.elf File opened for reading /proc/1522cmdline px86.elf File opened for reading /proc/3cmdline px86.elf File opened for reading /proc/180cmdline px86.elf File opened for reading /proc/685cmdline px86.elf File opened for reading /proc/178cmdline px86.elf File opened for reading /proc/280cmdline px86.elf File opened for reading /proc/493cmdline px86.elf File opened for reading /proc/697cmdline px86.elf File opened for reading /proc/1041cmdline px86.elf File opened for reading /proc/26cmdline px86.elf File opened for reading /proc/2cmdline px86.elf File opened for reading /proc/986cmdline px86.elf File opened for reading /proc/17cmdline px86.elf File opened for reading /proc/82cmdline px86.elf File opened for reading /proc/177cmdline px86.elf File opened for reading /proc/213cmdline px86.elf File opened for reading /proc/426cmdline px86.elf File opened for reading /proc/1101cmdline px86.elf File opened for reading /proc/1172cmdline px86.elf File opened for reading /proc/1523cmdline px86.elf File opened for reading /proc/9cmdline px86.elf File opened for reading /proc/32cmdline px86.elf File opened for reading /proc/662cmdline px86.elf File opened for reading /proc/677cmdline px86.elf