Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
24/05/2026, 18:45
Behavioral task
behavioral1
Sample
176.65.139.209_sample.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target 176.65.139.209_sample.bin
- Size 62KB
- Sample260524-xd334agy81
- SHA256 0fa3c515efba0dad93281bf0f0927640a23b80c8379fe1ccd378635464bbd32c
- MD5 462e9b679da2d33ee17535528310a993
- SHA1 b9f524e9bd0838736eda3accb46e7b0eb2cf0738
- SHA512 506b93028c9d937a05ad8cf0d534b18510fdbf796cd37f31137ecb88874d2c2b67247f7be92c9544d434e775cde964b91c7687b26c5c8295fff512330582624f
- SSDEEP 1536:LdV09/hhezGmDY1i+lR2cx1LrbmLiIhECOnouy8ryJ:LGfejc8cx1iLiIhE7outK
- TLSH T10D5302735DAF6BC0C60D44BE5C17FE5F0E907778D0114A9E1B4A82E8DC63B5466282E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Deletes itself 1 IoCs
pid Process 1484 176.65.139.209_sample.bin - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 176.65.139.209_sample.bin File opened for modification /dev/misc/watchdog 176.65.139.209_sample.bin - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 1484 176.65.139.209_sample.bin -
description ioc Process File opened for reading /proc/19cmdline 176.65.139.209_sample.bin File opened for reading /proc/167cmdline 176.65.139.209_sample.bin File opened for reading /proc/1095cmdline 176.65.139.209_sample.bin File opened for reading /proc/1162cmdline 176.65.139.209_sample.bin File opened for reading /proc/11cmdline 176.65.139.209_sample.bin File opened for reading /proc/531cmdline 176.65.139.209_sample.bin File opened for reading /proc/638cmdline 176.65.139.209_sample.bin File opened for reading /proc/906cmdline 176.65.139.209_sample.bin File opened for reading /proc/1067cmdline 176.65.139.209_sample.bin File opened for reading /proc/1091cmdline 176.65.139.209_sample.bin File opened for reading /proc/1163cmdline 176.65.139.209_sample.bin File opened for reading /proc/80cmdline 176.65.139.209_sample.bin File opened for reading /proc/1131cmdline 176.65.139.209_sample.bin File opened for reading /proc/28cmdline 176.65.139.209_sample.bin File opened for reading /proc/86cmdline 176.65.139.209_sample.bin File opened for reading /proc/163cmdline 176.65.139.209_sample.bin File opened for reading /proc/8cmdline 176.65.139.209_sample.bin File opened for reading /proc/20cmdline 176.65.139.209_sample.bin File opened for reading /proc/269cmdline 176.65.139.209_sample.bin File opened for reading /proc/488cmdline 176.65.139.209_sample.bin File opened for reading /proc/672cmdline 176.65.139.209_sample.bin File opened for reading /proc/1349cmdline 176.65.139.209_sample.bin File opened for reading /proc/1493cmdline 176.65.139.209_sample.bin File opened for reading /proc/2cmdline 176.65.139.209_sample.bin File opened for reading /proc/81cmdline 176.65.139.209_sample.bin File opened for reading /proc/159cmdline 176.65.139.209_sample.bin File opened for reading /proc/464cmdline 176.65.139.209_sample.bin File opened for reading /proc/596cmdline 176.65.139.209_sample.bin File opened for reading /proc/1088cmdline 176.65.139.209_sample.bin File opened for reading /proc/1092cmdline 176.65.139.209_sample.bin File opened for reading /proc/1499cmdline 176.65.139.209_sample.bin File opened for reading /proc/22cmdline 176.65.139.209_sample.bin File opened for reading /proc/173cmdline 176.65.139.209_sample.bin File opened for reading /proc/718cmdline 176.65.139.209_sample.bin File opened for reading /proc/1497cmdline 176.65.139.209_sample.bin File opened for reading /proc/35cmdline 176.65.139.209_sample.bin File opened for reading /proc/158cmdline 176.65.139.209_sample.bin File opened for reading /proc/165cmdline 176.65.139.209_sample.bin File opened for reading /proc/645cmdline 176.65.139.209_sample.bin File opened for reading /proc/1047cmdline 176.65.139.209_sample.bin File opened for reading /proc/1052cmdline 176.65.139.209_sample.bin File opened for reading /proc/1476cmdline 176.65.139.209_sample.bin File opened for reading /proc/1494cmdline 176.65.139.209_sample.bin File opened for reading /proc/98cmdline 176.65.139.209_sample.bin File opened for reading /proc/899cmdline 176.65.139.209_sample.bin File opened for reading /proc/1299cmdline 176.65.139.209_sample.bin File opened for reading /proc/83cmdline 176.65.139.209_sample.bin File opened for reading /proc/169cmdline 176.65.139.209_sample.bin File opened for reading /proc/525cmdline 176.65.139.209_sample.bin File opened for reading /proc/1085cmdline 176.65.139.209_sample.bin File opened for reading /proc/18cmdline 176.65.139.209_sample.bin File opened for reading /proc/1034cmdline 176.65.139.209_sample.bin File opened for reading /proc/78cmdline 176.65.139.209_sample.bin File opened for reading /proc/162cmdline 176.65.139.209_sample.bin File opened for reading /proc/175cmdline 176.65.139.209_sample.bin File opened for reading /proc/415cmdline 176.65.139.209_sample.bin File opened for reading /proc/423cmdline 176.65.139.209_sample.bin File opened for reading /proc/923cmdline 176.65.139.209_sample.bin File opened for reading /proc/1069cmdline 176.65.139.209_sample.bin File opened for reading /proc/1500cmdline 176.65.139.209_sample.bin File opened for reading /proc/7cmdline 176.65.139.209_sample.bin File opened for reading /proc/17cmdline 176.65.139.209_sample.bin File opened for reading /proc/79cmdline 176.65.139.209_sample.bin File opened for reading /proc/443cmdline 176.65.139.209_sample.bin