Analysis
- max time kernel
136s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
26/04/2026, 20:00
Behavioral task
behavioral1
Sample
luxzz.i686.elf
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target luxzz.i686.elf
- Size 85KB
- Sample260426-yq2apsfx21
- SHA256 6b04202cf734482b7bec3a7ce7077f8f373fc7586fa8315b67c99058cc9ba40d
- MD5 4ba930bd81eefc27d4fdef0d4a24644d
- SHA1 46105cb2aa3fd69f0671e375a73110f68fea133d
- SHA512 548d4f57f8cd73628624d48a1819f6ef65b9d1a739349159bc8687afe7368088ec6f1e09c2faa161fb45e14de0e34bc465717b67642f0ef531b2d7269dc275bf
- SSDEEP 1536:iXDwDhVtcU4xiUWaqH3FgfKueEMWximKjfTsv4gz9F7vl:kDWKzQLH3FoFjwmKjfTc4gl
- TLSH T17B8329C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog luxzz.i686.elf File opened for modification /dev/watchdog luxzz.i686.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog luxzz.i686.elf File opened for modification /bin/watchdog luxzz.i686.elf -
description ioc Process File opened for reading /proc/20/status luxzz.i686.elf File opened for reading /proc/466/status luxzz.i686.elf File opened for reading /proc/534/status luxzz.i686.elf File opened for reading /proc/1059/status luxzz.i686.elf File opened for reading /proc/1518/status luxzz.i686.elf File opened for reading /proc/17/status luxzz.i686.elf File opened for reading /proc/1107/status luxzz.i686.elf File opened for reading /proc/1154/status luxzz.i686.elf File opened for reading /proc/81/status luxzz.i686.elf File opened for reading /proc/503/status luxzz.i686.elf File opened for reading /proc/733/status luxzz.i686.elf File opened for reading /proc/979/status luxzz.i686.elf File opened for reading /proc/983/status luxzz.i686.elf File opened for reading /proc/1067/status luxzz.i686.elf File opened for reading /proc/1095/status luxzz.i686.elf File opened for reading /proc/1102/status luxzz.i686.elf File opened for reading /proc/7/status luxzz.i686.elf File opened for reading /proc/82/status luxzz.i686.elf File opened for reading /proc/1262/status luxzz.i686.elf File opened for reading /proc/1528/status luxzz.i686.elf File opened for reading /proc/213/status luxzz.i686.elf File opened for reading /proc/972/status luxzz.i686.elf File opened for reading /proc/5/status luxzz.i686.elf File opened for reading /proc/172/status luxzz.i686.elf File opened for reading /proc/1037/status luxzz.i686.elf File opened for reading /proc/1083/status luxzz.i686.elf File opened for reading /proc/1098/status luxzz.i686.elf File opened for reading /proc/27/status luxzz.i686.elf File opened for reading /proc/178/status luxzz.i686.elf File opened for reading /proc/181/status luxzz.i686.elf File opened for reading /proc/467/status luxzz.i686.elf File opened for reading /proc/920/status luxzz.i686.elf File opened for reading /proc/86/status luxzz.i686.elf File opened for reading /proc/179/status luxzz.i686.elf File opened for reading /proc/1359/status luxzz.i686.elf File opened for reading /proc/619/status luxzz.i686.elf File opened for reading /proc/917/status luxzz.i686.elf File opened for reading /proc/31/status luxzz.i686.elf File opened for reading /proc/171/status luxzz.i686.elf File opened for reading /proc/426/status luxzz.i686.elf File opened for reading /proc/533/status luxzz.i686.elf File opened for reading /proc/4/status luxzz.i686.elf File opened for reading /proc/424/status luxzz.i686.elf File opened for reading /proc/953/status luxzz.i686.elf File opened for reading /proc/25/status luxzz.i686.elf File opened for reading /proc/1041/status luxzz.i686.elf File opened for reading /proc/1105/status luxzz.i686.elf File opened for reading /proc/1343/status luxzz.i686.elf File opened for reading /proc/12/status luxzz.i686.elf File opened for reading /proc/489/status luxzz.i686.elf File opened for reading /proc/1000/status luxzz.i686.elf File opened for reading /proc/1494/status luxzz.i686.elf File opened for reading /proc/36/status luxzz.i686.elf File opened for reading /proc/668/status luxzz.i686.elf File opened for reading /proc/939/status luxzz.i686.elf File opened for reading /proc/1076/status luxzz.i686.elf File opened for reading /proc/1275/status luxzz.i686.elf File opened for reading /proc/32/status luxzz.i686.elf File opened for reading /proc/35/status luxzz.i686.elf File opened for reading /proc/79/status luxzz.i686.elf File opened for reading /proc/280/status luxzz.i686.elf File opened for reading /proc/462/status luxzz.i686.elf File opened for reading /proc/493/status luxzz.i686.elf File opened for reading /proc/501/status luxzz.i686.elf