Analysis
- max time kernel
135s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/04/2026, 06:05
Behavioral task
behavioral1
Sample
Space.x86.elf
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target Space.x86.elf
- Size 69KB
- Sample260419-gtknpadt8p
- SHA256 acc0c1ad15bdcff153995dc4f6e7faa205d2430016e219c61ae2526d8b0e766b
- MD5 31840434ce817e2c2668df744926a5a0
- SHA1 320f776deb7db80ce82bdda290e1114052424088
- SHA512 3f7d112aa64f62189d77dd3672d6c6b8f93f89b5d1700444b4df51b9b46f226df9474ca0c8a872459fb2ad5699be7e2bd289b67cf47a0eecac4a638d7d7c77ab
- SSDEEP 1536:ltWizyApqj4PfWjF7lOvZOWsIyq3XkZSYi:ltFyA0j4HWBJOvwfIyqsi
- TLSH T1F6634BC9F983D4B6E897093010BBBF639DB3D6BE2168DA43C3A855369D12502F416E6C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.x86.elf File opened for modification /dev/misc/watchdog Space.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.x86.elf File opened for modification /bin/watchdog Space.x86.elf -
description ioc Process File opened for reading /proc/15/status Space.x86.elf File opened for reading /proc/98/status Space.x86.elf File opened for reading /proc/160/status Space.x86.elf File opened for reading /proc/165/status Space.x86.elf File opened for reading /proc/167/status Space.x86.elf File opened for reading /proc/326/status Space.x86.elf File opened for reading /proc/1051/status Space.x86.elf File opened for reading /proc/17/status Space.x86.elf File opened for reading /proc/413/status Space.x86.elf File opened for reading /proc/417/status Space.x86.elf File opened for reading /proc/525/status Space.x86.elf File opened for reading /proc/555/status Space.x86.elf File opened for reading /proc/562/status Space.x86.elf File opened for reading /proc/944/status Space.x86.elf File opened for reading /proc/963/status Space.x86.elf File opened for reading /proc/23/status Space.x86.elf File opened for reading /proc/26/status Space.x86.elf File opened for reading /proc/482/status Space.x86.elf File opened for reading /proc/489/status Space.x86.elf File opened for reading /proc/1045/status Space.x86.elf File opened for reading /proc/1059/status Space.x86.elf File opened for reading /proc/1075/status Space.x86.elf File opened for reading /proc/1133/status Space.x86.elf File opened for reading /proc/164/status Space.x86.elf File opened for reading /proc/4/status Space.x86.elf File opened for reading /proc/468/status Space.x86.elf File opened for reading /proc/1194/status Space.x86.elf File opened for reading /proc/1489/status Space.x86.elf File opened for reading /proc/20/status Space.x86.elf File opened for reading /proc/488/status Space.x86.elf File opened for reading /proc/969/status Space.x86.elf File opened for reading /proc/1344/status Space.x86.elf File opened for reading /proc/460/status Space.x86.elf File opened for reading /proc/677/status Space.x86.elf File opened for reading /proc/5/status Space.x86.elf File opened for reading /proc/974/status Space.x86.elf File opened for reading /proc/1010/status Space.x86.elf File opened for reading /proc/1099/status Space.x86.elf File opened for reading /proc/1147/status Space.x86.elf File opened for reading /proc/22/status Space.x86.elf File opened for reading /proc/31/status Space.x86.elf File opened for reading /proc/32/status Space.x86.elf File opened for reading /proc/161/status Space.x86.elf File opened for reading /proc/524/status Space.x86.elf File opened for reading /proc/1066/status Space.x86.elf File opened for reading /proc/79/status Space.x86.elf File opened for reading /proc/1197/status Space.x86.elf File opened for reading /proc/174/status Space.x86.elf File opened for reading /proc/1094/status Space.x86.elf File opened for reading /proc/1097/status Space.x86.elf File opened for reading /proc/78/status Space.x86.elf File opened for reading /proc/178/status Space.x86.elf File opened for reading /proc/612/status Space.x86.elf File opened for reading /proc/1031/status Space.x86.elf File opened for reading /proc/1054/status Space.x86.elf File opened for reading /proc/86/status Space.x86.elf File opened for reading /proc/329/status Space.x86.elf File opened for reading /proc/25/status Space.x86.elf File opened for reading /proc/84/status Space.x86.elf File opened for reading /proc/176/status Space.x86.elf File opened for reading /proc/1073/status Space.x86.elf File opened for reading /proc/1080/status Space.x86.elf File opened for reading /proc/1166/status Space.x86.elf File opened for reading /proc/27/status Space.x86.elf