Analysis
- max time kernel
124s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
26/04/2026, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
x86_64.elf
Resource
ubuntu1804-amd64-20260126-en
6 signatures
150 seconds
General
- Target x86_64.elf
- Size 45KB
- Sample260426-mtltmsgz3r
- SHA256 460812e89bbe0740f0eb7db2e387a5380210de3d6fd038037a7eb7c927e5e515
- MD5 3c77eefa2b6406df2c40c45074df4bc7
- SHA1 ad067df4229357647087f4a3c743a8869fab1b5d
- SHA512 2bedfd93afb90a8079d787c7bc8053ec4b179c125e796438a7a7ade66ed826a33315683ff7cebee02bb5c6880ac4caf69f7b4fbb60da1dcc0a3e7807925e17d2
- SSDEEP 768:FkrR8ysZAY+OGZZRw4xSwPtKOo7vHjKRDACGyjltp4B6gC:6d8y2+OO5yDDckCGyp4B6gC
- TLSH T1912329035491C0FDC955C230AB3FA636C922F47E123AB59D73E0BE226E4AE311F5A589
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Contacts a large (114421) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog x86_64.elf File opened for modification /dev/misc/watchdog x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /var/Sofia 1530 x86_64.elf -
description ioc Process File opened for reading /proc/174/cmdline x86_64.elf File opened for reading /proc/15/cmdline x86_64.elf File opened for reading /proc/173/cmdline x86_64.elf File opened for reading /proc/1081/cmdline x86_64.elf File opened for reading /proc/1174/cmdline x86_64.elf File opened for reading /proc/1528/cmdline x86_64.elf File opened for reading /proc/7/cmdline x86_64.elf File opened for reading /proc/29/cmdline x86_64.elf File opened for reading /proc/31/cmdline x86_64.elf File opened for reading /proc/203/cmdline x86_64.elf File opened for reading /proc/611/cmdline x86_64.elf File opened for reading /proc/698/cmdline x86_64.elf File opened for reading /proc/959/cmdline x86_64.elf File opened for reading /proc/1000/cmdline x86_64.elf File opened for reading /proc/470/cmdline x86_64.elf File opened for reading /proc/920/cmdline x86_64.elf File opened for reading /proc/989/cmdline x86_64.elf File opened for reading /proc/1009/cmdline x86_64.elf File opened for reading /proc/1024/cmdline x86_64.elf File opened for reading /proc/1263/cmdline x86_64.elf File opened for reading /proc/1526/cmdline x86_64.elf File opened for reading /proc/161/cmdline x86_64.elf File opened for reading /proc/1067/cmdline x86_64.elf File opened for reading /proc/1102/cmdline x86_64.elf File opened for reading /proc/1188/cmdline x86_64.elf File opened for reading /proc/160/cmdline x86_64.elf File opened for reading /proc/558/cmdline x86_64.elf File opened for reading /proc/1202/cmdline x86_64.elf File opened for reading /proc/318/cmdline x86_64.elf File opened for reading /proc/465/cmdline x86_64.elf File opened for reading /proc/513/cmdline x86_64.elf File opened for reading /proc/912/cmdline x86_64.elf File opened for reading /proc/1085/cmdline x86_64.elf File opened for reading /proc/1329/cmdline x86_64.elf File opened for reading /proc/1332/cmdline x86_64.elf File opened for reading /proc/35/cmdline x86_64.elf File opened for reading /proc/2/cmdline x86_64.elf File opened for reading /proc/21/cmdline x86_64.elf File opened for reading /proc/159/cmdline x86_64.elf File opened for reading /proc/488/cmdline x86_64.elf File opened for reading /proc/518/cmdline x86_64.elf File opened for reading /proc/1038/cmdline x86_64.elf File opened for reading /proc/1393/cmdline x86_64.elf File opened for reading /proc/34/cmdline x86_64.elf File opened for reading /proc/169/cmdline x86_64.elf File opened for reading /proc/319/cmdline x86_64.elf File opened for reading /proc/917/cmdline x86_64.elf File opened for reading /proc/22/cmdline x86_64.elf File opened for reading /proc/36/cmdline x86_64.elf File opened for reading /proc/86/cmdline x86_64.elf File opened for reading /proc/170/cmdline x86_64.elf File opened for reading /proc/726/cmdline x86_64.elf File opened for reading /proc/982/cmdline x86_64.elf File opened for reading /proc/1143/cmdline x86_64.elf File opened for reading /proc/1535/cmdline x86_64.elf File opened for reading /proc/19/cmdline x86_64.elf File opened for reading /proc/1046/cmdline x86_64.elf File opened for reading /proc/1110/cmdline x86_64.elf File opened for reading /proc/1499/cmdline x86_64.elf File opened for reading /proc/12/cmdline x86_64.elf File opened for reading /proc/13/cmdline x86_64.elf File opened for reading /proc/454/cmdline x86_64.elf File opened for reading /proc/939/cmdline x86_64.elf File opened for reading /proc/979/cmdline x86_64.elf