Analysis
- max time kernel
39s - max time network
10s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/04/2026, 08:18
Behavioral task
behavioral1
Sample
boatnet.x86_64
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
5 signatures
40 seconds
General
- Target boatnet.x86_64
- Size 22KB
- Sample260429-j7eqpsdv3m
- SHA256 519dfc20fd53aa8a5a81e1f86323b266f1b35ca05de6a05ef71cd15c06c7cadf
- MD5 25eee253247600056347e9faa7ae58a7
- SHA1 1cfb7ada7b75c24612d9be2c598531706c761a57
- SHA512 ae985e2acb08ff50d53db2904b791a9aee8338d7950ca1fa2df8254b6cf3bff53ac84276588251c1550ce84f1267e44c2678a0365001f8b2160010f401b8e54f
- SSDEEP 384:oWR+ruZc1EBD0BEnaGr9iYnznQ2sIOKqQ7+D7N+B1/BFvDzcuiFqcJP:oWRQuZvXnZr9zzQ2AKq38B1jvHnst
- TLSH T197A2E06AD165C39ED2C6423D74C70173382F5C446B88AB07BD00A9D3219807AA8FFF34
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog boatnet.x86_64 File opened for modification /dev/misc/watchdog boatnet.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog boatnet.x86_64 File opened for modification /bin/watchdog boatnet.x86_64 -
description ioc Process File opened for reading /proc/1530/cmdline boatnet.x86_64 File opened for reading /proc/470/cmdline boatnet.x86_64 File opened for reading /proc/499/cmdline boatnet.x86_64 File opened for reading /proc/989/cmdline boatnet.x86_64 File opened for reading /proc/1174/cmdline boatnet.x86_64 File opened for reading /proc/1329/cmdline boatnet.x86_64 File opened for reading /proc/726/cmdline boatnet.x86_64 File opened for reading /proc/979/cmdline boatnet.x86_64 File opened for reading /proc/1050/cmdline boatnet.x86_64 File opened for reading /proc/465/cmdline boatnet.x86_64 File opened for reading /proc/675/cmdline boatnet.x86_64 File opened for reading /proc/934/cmdline boatnet.x86_64 File opened for reading /proc/982/cmdline boatnet.x86_64 File opened for reading /proc/1069/cmdline boatnet.x86_64 File opened for reading /proc/1175/cmdline boatnet.x86_64 File opened for reading /proc/1188/cmdline boatnet.x86_64 File opened for reading /proc/513/cmdline boatnet.x86_64 File opened for reading /proc/678/cmdline boatnet.x86_64 File opened for reading /proc/959/cmdline boatnet.x86_64 File opened for reading /proc/976/cmdline boatnet.x86_64 File opened for reading /proc/996/cmdline boatnet.x86_64 File opened for reading /proc/1000/cmdline boatnet.x86_64 File opened for reading /proc/1055/cmdline boatnet.x86_64 File opened for reading /proc/1110/cmdline boatnet.x86_64 File opened for reading /proc/1042/cmdline boatnet.x86_64 File opened for reading /proc/1060/cmdline boatnet.x86_64 File opened for reading /proc/1102/cmdline boatnet.x86_64 File opened for reading /proc/1107/cmdline boatnet.x86_64 File opened for reading /proc/1157/cmdline boatnet.x86_64 File opened for reading /proc/1269/cmdline boatnet.x86_64 File opened for reading /proc/1332/cmdline boatnet.x86_64 File opened for reading /proc/487/cmdline boatnet.x86_64 File opened for reading /proc/500/cmdline boatnet.x86_64 File opened for reading /proc/912/cmdline boatnet.x86_64 File opened for reading /proc/1547/cmdline boatnet.x86_64 File opened for reading /proc/484/cmdline boatnet.x86_64 File opened for reading /proc/588/cmdline boatnet.x86_64 File opened for reading /proc/611/cmdline boatnet.x86_64 File opened for reading /proc/1103/cmdline boatnet.x86_64 File opened for reading /proc/1104/cmdline boatnet.x86_64 File opened for reading /proc/1143/cmdline boatnet.x86_64 File opened for reading /proc/1206/cmdline boatnet.x86_64 File opened for reading /proc/1541/cmdline boatnet.x86_64 File opened for reading /proc/425/cmdline boatnet.x86_64 File opened for reading /proc/558/cmdline boatnet.x86_64 File opened for reading /proc/1312/cmdline boatnet.x86_64 File opened for reading /proc/1393/cmdline boatnet.x86_64 File opened for reading /proc/1536/cmdline boatnet.x86_64 File opened for reading /proc/537/cmdline boatnet.x86_64 File opened for reading /proc/612/cmdline boatnet.x86_64 File opened for reading /proc/939/cmdline boatnet.x86_64 File opened for reading /proc/972/cmdline boatnet.x86_64 File opened for reading /proc/1038/cmdline boatnet.x86_64 File opened for reading /proc/1267/cmdline boatnet.x86_64 File opened for reading /proc/1361/cmdline boatnet.x86_64 File opened for reading /proc/1525/cmdline boatnet.x86_64 File opened for reading /proc/454/cmdline boatnet.x86_64 File opened for reading /proc/573/cmdline boatnet.x86_64 File opened for reading /proc/1046/cmdline boatnet.x86_64 File opened for reading /proc/1529/cmdline boatnet.x86_64 File opened for reading /proc/1553/cmdline boatnet.x86_64 File opened for reading /proc/872/cmdline boatnet.x86_64 File opened for reading /proc/917/cmdline boatnet.x86_64 File opened for reading /proc/1024/cmdline boatnet.x86_64