Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
25/05/2026, 00:10
Behavioral task
behavioral1
Sample
px86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target px86
- Size 32KB
- Sample260525-agf2eacy2s
- SHA256 ff598de8f6ea5c7b18f1f19f0a44a91a4ab38f10721cfe9bb7253cfdd88147e4
- MD5 2452c7cc03e47a9363e29a2939a1e508
- SHA1 692bd7b31a549f4b003ae2cf789f9eb0ec620d5d
- SHA512 4b7744df16da6117825c2a6c15ffbf8d69b4de27b11b08af3997e577e6f231890fffb0e49022ceee634c0cd316efb1208c2c38f531ac555b06fa61e003cd245e
- SSDEEP 768:7DxevKCEH287OYQ2XqqPEvmZh4EHBHaG0VhLai3U+uJE:eKCEH2KnXqTvmZh4EHpafnGi+JE
- TLSH T13AE2F161D8AC684CF0194B762B26CD2CB0AF35515FAF4B4732D61923AE032E939313B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Deletes itself 1 IoCs
pid Process 1484 px86 - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog px86 File opened for modification /dev/misc/watchdog px86 - Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1484 px86 -
description ioc Process File opened for reading /proc/1061cmdline px86 File opened for reading /proc/497cmdline px86 File opened for reading /proc/7cmdline px86 File opened for reading /proc/80cmdline px86 File opened for reading /proc/1063cmdline px86 File opened for reading /proc/15cmdline px86 File opened for reading /proc/165cmdline px86 File opened for reading /proc/1246cmdline px86 File opened for reading /proc/1475cmdline px86 File opened for reading /proc/2cmdline px86 File opened for reading /proc/34cmdline px86 File opened for reading /proc/78cmdline px86 File opened for reading /proc/494cmdline px86 File opened for reading /proc/575cmdline px86 File opened for reading /proc/905cmdline px86 File opened for reading /proc/1186cmdline px86 File opened for reading /proc/26cmdline px86 File opened for reading /proc/446cmdline px86 File opened for reading /proc/485cmdline px86 File opened for reading /proc/984cmdline px86 File opened for reading /proc/1082cmdline px86 File opened for reading /proc/1171cmdline px86 File opened for reading /proc/1488cmdline px86 File opened for reading /proc/20cmdline px86 File opened for reading /proc/23cmdline px86 File opened for reading /proc/81cmdline px86 File opened for reading /proc/522cmdline px86 File opened for reading /proc/924cmdline px86 File opened for reading /proc/1021cmdline px86 File opened for reading /proc/493cmdline px86 File opened for reading /proc/657cmdline px86 File opened for reading /proc/35cmdline px86 File opened for reading /proc/454cmdline px86 File opened for reading /proc/902cmdline px86 File opened for reading /proc/1300cmdline px86 File opened for reading /proc/1486cmdline px86 File opened for reading /proc/86cmdline px86 File opened for reading /proc/701cmdline px86 File opened for reading /proc/1478cmdline px86 File opened for reading /proc/28cmdline px86 File opened for reading /proc/160cmdline px86 File opened for reading /proc/249cmdline px86 File opened for reading /proc/172cmdline px86 File opened for reading /proc/1025cmdline px86 File opened for reading /proc/1049cmdline px86 File opened for reading /proc/1072cmdline px86 File opened for reading /proc/159cmdline px86 File opened for reading /proc/961cmdline px86 File opened for reading /proc/1091cmdline px86 File opened for reading /proc/1118cmdline px86 File opened for reading /proc/1158cmdline px86 File opened for reading /proc/4cmdline px86 File opened for reading /proc/5cmdline px86 File opened for reading /proc/115cmdline px86 File opened for reading /proc/168cmdline px86 File opened for reading /proc/326cmdline px86 File opened for reading /proc/1089cmdline px86 File opened for reading /proc/897cmdline px86 File opened for reading /proc/669cmdline px86 File opened for reading /proc/980cmdline px86 File opened for reading /proc/1489cmdline px86 File opened for reading /proc/8cmdline px86 File opened for reading /proc/79cmdline px86 File opened for reading /proc/98cmdline px86