Analysis
- max time kernel
149s - max time network
148s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/05/2026, 02:01
Behavioral task
behavioral1
Sample
1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f
- Size 61KB
- Sample260519-cf2ylae16x
- SHA256 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f
- MD5 0931e257cb5734568c3de1709196fd31
- SHA1 808926abfe9b24fb8f23989ce40ec65f30369b80
- SHA512 9a4ebb10f6de47d97c00d6661cc6b41faae69a12fd0acccb32682b82c41ebfd4a0b2e1590030689b828b4171e7fa63c2ee0077114b84b94b5b1f7e23d41ce6d9
- SSDEEP 1536:vn3PX/h7QUhqSOZlKdG+guZuXyZFE4y/Z6IoIfwJ8nouy8HyN:vHh7DzOKGMZmwByEISeouty
- TLSH T17C53028752FD8B18C395633D0CDE3F5F3031981AB0D86CD39E4869B326A5B6A3F28595
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for modification /dev/misc/watchdog 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for modification /bin/watchdog 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f -
description ioc Process File opened for reading /proc/1/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/4/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/27/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/163/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/201/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/339/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/869/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1203/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/19/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/84/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/169/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/971/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/977/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1046/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1053/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1092/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/161/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/268/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/487/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1015/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1148/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1380/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1477/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/11/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/18/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/31/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/36/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/79/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/480/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/603/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/700/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/714/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/909/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/961/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1066/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1348/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/202/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/498/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/460/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1036/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1049/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1174/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1482/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1484/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/3/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/115/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/165/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/660/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/968/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/12/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/17/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/20/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/22/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/337/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/561/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/602/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/667/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/10/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/176/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/489/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/492/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/708/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/1328/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f File opened for reading /proc/80/status 1bb34f5503224a92751971e4d9c8c0255ff478530ca5e3bca456ce61bd07913f