Analysis
- max time kernel
137s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
23/05/2026, 11:39
Behavioral task
behavioral1
Sample
luxzz.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target luxzz.x86
- Size 39KB
- Sample260523-nsa67abw3t
- SHA256 d48778d84bbbcf966a3f265aee449f5c011211a119de831bd030c6b990662f9a
- MD5 e6b858593f760c76af2181deee7c07c6
- SHA1 e0778ebda6dfd8e08e80235c4ef095f7cc4ec5a5
- SHA512 045752bcdf0b343d3bb04a7d8ff761f81e6be4e666dcd95aa1be21a675138d90ea42e2bcde4a44e73f57cb5b3d949cc14a5d85953036ca5fa47154e3ef0d17b7
- SSDEEP 768:42kfZ/bHf9x73X0LRk5OxvCaLM1eAQxs8waQF2hQO7aB:4nZbHXU2ox6asOfQFPO70
- TLSH T1FF03E012746C2E2DDD88E2BE439E7DBFB9660E622CD6E5C736D8DAAF8460134C170C54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
anakkontolmemek.my.id
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog luxzz.x86 File opened for modification /dev/misc/watchdog luxzz.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog luxzz.x86 File opened for modification /bin/watchdog luxzz.x86 -
description ioc Process File opened for reading /proc/680/status luxzz.x86 File opened for reading /proc/1081/status luxzz.x86 File opened for reading /proc/1481/status luxzz.x86 File opened for reading /proc/170/status luxzz.x86 File opened for reading /proc/480/status luxzz.x86 File opened for reading /proc/650/status luxzz.x86 File opened for reading /proc/969/status luxzz.x86 File opened for reading /proc/1020/status luxzz.x86 File opened for reading /proc/173/status luxzz.x86 File opened for reading /proc/974/status luxzz.x86 File opened for reading /proc/1062/status luxzz.x86 File opened for reading /proc/1067/status luxzz.x86 File opened for reading /proc/16/status luxzz.x86 File opened for reading /proc/670/status luxzz.x86 File opened for reading /proc/905/status luxzz.x86 File opened for reading /proc/80/status luxzz.x86 File opened for reading /proc/160/status luxzz.x86 File opened for reading /proc/171/status luxzz.x86 File opened for reading /proc/477/status luxzz.x86 File opened for reading /proc/1485/status luxzz.x86 File opened for reading /proc/7/status luxzz.x86 File opened for reading /proc/12/status luxzz.x86 File opened for reading /proc/172/status luxzz.x86 File opened for reading /proc/201/status luxzz.x86 File opened for reading /proc/608/status luxzz.x86 File opened for reading /proc/721/status luxzz.x86 File opened for reading /proc/1128/status luxzz.x86 File opened for reading /proc/1490/status luxzz.x86 File opened for reading /proc/4/status luxzz.x86 File opened for reading /proc/9/status luxzz.x86 File opened for reading /proc/164/status luxzz.x86 File opened for reading /proc/450/status luxzz.x86 File opened for reading /proc/660/status luxzz.x86 File opened for reading /proc/10/status luxzz.x86 File opened for reading /proc/11/status luxzz.x86 File opened for reading /proc/168/status luxzz.x86 File opened for reading /proc/1093/status luxzz.x86 File opened for reading /proc/6/status luxzz.x86 File opened for reading /proc/13/status luxzz.x86 File opened for reading /proc/253/status luxzz.x86 File opened for reading /proc/485/status luxzz.x86 File opened for reading /proc/1087/status luxzz.x86 File opened for reading /proc/79/status luxzz.x86 File opened for reading /proc/348/status luxzz.x86 File opened for reading /proc/521/status luxzz.x86 File opened for reading /proc/900/status luxzz.x86 File opened for reading /proc/1255/status luxzz.x86 File opened for reading /proc/1260/status luxzz.x86 File opened for reading /proc/166/status luxzz.x86 File opened for reading /proc/482/status luxzz.x86 File opened for reading /proc/560/status luxzz.x86 File opened for reading /proc/574/status luxzz.x86 File opened for reading /proc/941/status luxzz.x86 File opened for reading /proc/1028/status luxzz.x86 File opened for reading /proc/1053/status luxzz.x86 File opened for reading /proc/1142/status luxzz.x86 File opened for reading /proc/5/status luxzz.x86 File opened for reading /proc/89/status luxzz.x86 File opened for reading /proc/165/status luxzz.x86 File opened for reading /proc/493/status luxzz.x86 File opened for reading /proc/964/status luxzz.x86 File opened for reading /proc/1088/status luxzz.x86 File opened for reading /proc/1153/status luxzz.x86 File opened for reading /proc/1249/status luxzz.x86