Analysis
- max time kernel
150s - max time network
135s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/05/2026, 02:21
Behavioral task
behavioral1
Sample
upperx64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target upperx64.elf
- Size 41KB
- Sample260519-cs88faa12q
- SHA256 382532451215dd8a3c5fa070ced106e02f3eceb33bb4ff20c1c3c1d800ed587a
- MD5 87d513c7d03811a59e307f55f33d9406
- SHA1 775bf037ee301a3a916b44bad5a17333bc6834c4
- SHA512 cb6cf2acbc1cd404cbdd9de9a87880ccf7577297252860f41b92f869d425640f105040f5540bd289040860ccb577fb8a17b17e95ebdaef705d7b3063cde8716d
- SSDEEP 768:HO5xyjKy5klOY5lYDJN+Tb4/BSgKSAnWVtmTWufBT7oRW:C4jKy5klH5lYFsTbUBSW+MtmTWuF8R
- TLSH T17113F807B94680FDC0ADC374477AB53AD53335BE1239B3B63BD8FA12A986EA10E1D544
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog upperx64.elf File opened for modification /dev/watchdog upperx64.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp upperx64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself bshsaabsbabshasabhh 1483 upperx64.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp upperx64.elf -
description ioc Process File opened for reading /proc/415/exe upperx64.elf File opened for reading /proc/418/exe upperx64.elf File opened for reading /proc/562/exe upperx64.elf File opened for reading /proc/1586/exe upperx64.elf File opened for reading /proc/484/exe upperx64.elf File opened for reading /proc/502/exe upperx64.elf File opened for reading /proc/1560/exe upperx64.elf File opened for reading /proc/1579/exe upperx64.elf File opened for reading /proc/1607/exe upperx64.elf File opened for reading /proc/498/exe upperx64.elf File opened for reading /proc/1038/exe upperx64.elf File opened for reading /proc/1577/exe upperx64.elf File opened for reading /proc/1626/exe upperx64.elf File opened for reading /proc/1942/exe upperx64.elf File opened for reading /proc/1972/exe upperx64.elf File opened for reading /proc/464/exe upperx64.elf File opened for reading /proc/466/exe upperx64.elf File opened for reading /proc/1865/exe upperx64.elf File opened for reading /proc/2036/exe upperx64.elf File opened for reading /proc/989/exe upperx64.elf File opened for reading /proc/1596/exe upperx64.elf File opened for reading /proc/1923/exe upperx64.elf File opened for reading /proc/1990/exe upperx64.elf File opened for reading /proc/474/exe upperx64.elf File opened for reading /proc/576/exe upperx64.elf File opened for reading /proc/669/exe upperx64.elf File opened for reading /proc/902/exe upperx64.elf File opened for reading /proc/993/exe upperx64.elf File opened for reading /proc/1543/exe upperx64.elf File opened for reading /proc/1661/exe upperx64.elf File opened for reading /proc/1666/exe upperx64.elf File opened for reading /proc/951/exe upperx64.elf File opened for reading /proc/1042/exe upperx64.elf File opened for reading /proc/1970/exe upperx64.elf File opened for reading /proc/1656/exe upperx64.elf File opened for reading /proc/1879/exe upperx64.elf File opened for reading /proc/965/exe upperx64.elf File opened for reading /proc/1493/exe upperx64.elf File opened for reading /proc/1550/exe upperx64.elf File opened for reading /proc/1839/exe upperx64.elf File opened for reading /proc/1860/exe upperx64.elf File opened for reading /proc/1905/exe upperx64.elf File opened for reading /proc/1964/exe upperx64.elf File opened for reading /proc/646/exe upperx64.elf File opened for reading /proc/692/exe upperx64.elf File opened for reading /proc/1615/exe upperx64.elf File opened for reading /proc/1960/exe upperx64.elf File opened for reading /proc/1659/exe upperx64.elf File opened for reading /proc/1026/exe upperx64.elf File opened for reading /proc/1053/exe upperx64.elf File opened for reading /proc/1498/exe upperx64.elf File opened for reading /proc/1588/exe upperx64.elf File opened for reading /proc/1986/exe upperx64.elf File opened for reading /proc/1160/exe upperx64.elf File opened for reading /proc/1845/exe upperx64.elf File opened for reading /proc/1849/exe upperx64.elf File opened for reading /proc/1924/exe upperx64.elf File opened for reading /proc/448/exe upperx64.elf File opened for reading /proc/979/exe upperx64.elf File opened for reading /proc/1956/exe upperx64.elf File opened for reading /proc/1629/exe upperx64.elf File opened for reading /proc/545/exe upperx64.elf File opened for reading /proc/727/exe upperx64.elf File opened for reading /proc/1059/exe upperx64.elf