Analysis
- max time kernel
143s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
24/04/2026, 12:48
Behavioral task
behavioral1
Sample
uYtea.x86_64
Resource
ubuntu1804-amd64-20260126-en
3 signatures
150 seconds
General
- Target uYtea.x86_64
- Size 57KB
- Sample260424-p1s8eaat7v
- SHA256 391895724431b2e656fc557b81ff6f81c075b442b262b2dd5d245c651bfceeac
- MD5 ac44638d496587f83fe713cbcbd44e97
- SHA1 1efc282bfc92e6c1df0849728badacd47e9772dc
- SHA512 39418bf58d059206037c25ca11b4203a50b648368b5e79f03ffdaf593712d36baa24a5597a2c3d0d2aa9bfb9dd53296ed7bf03e98a941bd59ef0083dbb3e9ffc
- SSDEEP 1536:1XIY73si3qEToSRhINNQ/K6C8u50pfEHwNLW:2Y7H6ETRhIY/Kn5qEHw1W
- TLSH T142431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09C04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog uYtea.x86_64 File opened for modification /dev/misc/watchdog uYtea.x86_64 - Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /sbin/watchdog uYtea.x86_64 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ]mMribXlgbfl[ 1523 uYtea.x86_64