0c21fd92d6daf1d94d376f7f0b72570fc800967fe2a9c64ad6316fcb4cb26aa7

Analysis

max time kernel
103s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260127-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
17/04/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
586.elf
Size 96KB
Sample260417-faegwsfv4p
SHA256 0c21fd92d6daf1d94d376f7f0b72570fc800967fe2a9c64ad6316fcb4cb26aa7
MD5 a5715fe71993a335f2cbdd486bfd79ad
SHA1 13c380c3975d7e8e1839bc47de7f24be9e4098dc
SHA512 e8e66b217a1dd1bcdfd2ae5423e581c6a59fd85a904541fae46b4fbf7b844169e698fdfdfa42daced57587cd937015b773653edf0731ab7100e308e43451141f
SSDEEP 3072:MPkRU9AUmH1rfsABYBfTw9w9fM0mqAgcVyZIcBI:VR0AXRpes9w3mqAgcVyZIcBI
TLSH
T16CA33B5BA741D6B3D14315B216939B240133FE3F195A9A0AF3A97CB8CB390C87522F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	586.elf
File opened for modification	/dev/watchdog	586.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1555	586.elf

/tmp/586.elf
/tmp/586.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:1555

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads