Analysis
- max time kernel
0s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
25/04/2026, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
X86_64
Resource
ubuntu1804-amd64-20260126-en
4 signatures
150 seconds
General
- Target X86_64
- Size 74KB
- Sample260425-pgmaraby7r
- SHA256 c876cffb991d5916bf5fd3bc4991dabf3e7ee776481f77bfc11bb3d20cf92ada
- MD5 deefa4c14f3b3dc5f210cc57c0de3fa9
- SHA1 428bb8b11e1c58d5261f77abbd4fc21368f62006
- SHA512 91844c2dc93ce92a8e9a7552cadb17784dfbe715b41c4cfc9c64674f3c73e28c63a987b03b500a5ed3fb4728944a5fbfbb14f99382a9cc349cc0da62d698c4c8
- SSDEEP 1536:Unir1igF371f0Bpxy8BlYXDRD//zuxhTB2UhBer63tQBu:wirjp2pbBlWRD//8hTB2yeyi0
- TLSH T196734B276691C53FC05BD1F01BEB9522E862BC7E0E32704973E1FE916F3A8C06A5A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog X86_64 File opened for modification /dev/watchdog X86_64 - Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route X86_64 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sshd 1521 X86_64 - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/route X86_64