Analysis
- max time kernel
10s - max time network
146s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/04/2026, 12:31
Behavioral task
behavioral1
Sample
Space.x86_64
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target Space.x86_64
- Size 36KB
- Sample260419-pp8tqaav6p
- SHA256 cae854a2e6b41ff1c6ccf74dec41fdf54690eadeeee751b95f09aa38cf09d6a5
- MD5 100aa8fc7900757b992818584ed3b542
- SHA1 74298bc5bf885f5241c776b074627d85381d3aee
- SHA512 e6c38cbdcf40d4539061cb112284eff58bb7887921394f14a184b17c6adbe29c7a4d80c4b5b2b212d24da3eea45e37eac6989bf29fa23aae134b646fc69fe796
- SSDEEP 768:AwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKTK49AbzPwUx0nZl:rOX80VqVi2otGtzXsWdMZl
- TLSH T113F2E034C5FDE9BCC03F79790C9D8A45F982F9512AA53726042962BAAFFB9C43D016C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.x86_64 File opened for modification /dev/misc/watchdog Space.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.x86_64 File opened for modification /bin/watchdog Space.x86_64 -
description ioc Process File opened for reading /proc/909/status Space.x86_64 File opened for reading /proc/178/status Space.x86_64 File opened for reading /proc/1022/status Space.x86_64 File opened for reading /proc/11/status Space.x86_64 File opened for reading /proc/16/status Space.x86_64 File opened for reading /proc/86/status Space.x86_64 File opened for reading /proc/611/status Space.x86_64 File opened for reading /proc/642/status Space.x86_64 File opened for reading /proc/899/status Space.x86_64 File opened for reading /proc/31/status Space.x86_64 File opened for reading /proc/186/status Space.x86_64 File opened for reading /proc/491/status Space.x86_64 File opened for reading /proc/1070/status Space.x86_64 File opened for reading /proc/1506/status Space.x86_64 File opened for reading /proc/13/status Space.x86_64 File opened for reading /proc/183/status Space.x86_64 File opened for reading /proc/562/status Space.x86_64 File opened for reading /proc/664/status Space.x86_64 File opened for reading /proc/1068/status Space.x86_64 File opened for reading /proc/1509/status Space.x86_64 File opened for reading /proc/82/status Space.x86_64 File opened for reading /proc/181/status Space.x86_64 File opened for reading /proc/702/status Space.x86_64 File opened for reading /proc/985/status Space.x86_64 File opened for reading /proc/1303/status Space.x86_64 File opened for reading /proc/80/status Space.x86_64 File opened for reading /proc/188/status Space.x86_64 File opened for reading /proc/419/status Space.x86_64 File opened for reading /proc/448/status Space.x86_64 File opened for reading /proc/942/status Space.x86_64 File opened for reading /proc/1513/status Space.x86_64 File opened for reading /proc/169/status Space.x86_64 File opened for reading /proc/484/status Space.x86_64 File opened for reading /proc/524/status Space.x86_64 File opened for reading /proc/174/status Space.x86_64 File opened for reading /proc/21/status Space.x86_64 File opened for reading /proc/89/status Space.x86_64 File opened for reading /proc/173/status Space.x86_64 File opened for reading /proc/574/status Space.x86_64 File opened for reading /proc/1091/status Space.x86_64 File opened for reading /proc/1327/status Space.x86_64 File opened for reading /proc/1481/status Space.x86_64 File opened for reading /proc/27/status Space.x86_64 File opened for reading /proc/716/status Space.x86_64 File opened for reading /proc/1079/status Space.x86_64 File opened for reading /proc/1511/status Space.x86_64 File opened for reading /proc/30/status Space.x86_64 File opened for reading /proc/137/status Space.x86_64 File opened for reading /proc/175/status Space.x86_64 File opened for reading /proc/176/status Space.x86_64 File opened for reading /proc/213/status Space.x86_64 File opened for reading /proc/447/status Space.x86_64 File opened for reading /proc/22/status Space.x86_64 File opened for reading /proc/35/status Space.x86_64 File opened for reading /proc/180/status Space.x86_64 File opened for reading /proc/446/status Space.x86_64 File opened for reading /proc/458/status Space.x86_64 File opened for reading /proc/549/status Space.x86_64 File opened for reading /proc/20/status Space.x86_64 File opened for reading /proc/14/status Space.x86_64 File opened for reading /proc/3/status Space.x86_64 File opened for reading /proc/177/status Space.x86_64 File opened for reading /proc/185/status Space.x86_64 File opened for reading /proc/463/status Space.x86_64