Analysis
- max time kernel
148s - max time network
154s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
27/05/2026, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
nuclear.i686
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
9 signatures
150 seconds
General
- Target nuclear.i686
- Size 162KB
- Sample260527-pd2w2aft31
- SHA256 a8b2928f22e2b9e177b465735e2d7e3bfd575b024c99707ed5fd3ca599dc9b8b
- MD5 7a3a382deba261ecd9157de2f4756133
- SHA1 b25e639a1bd7bec301556dd6529a59e2275a5350
- SHA512 e16dd80ed91425476722aa84526f9ce12716beb1523f55f7ca527a51022e3c1a41f7494bae497f78d48bf06364bb4740163b6f51e80370ccdb6a77a679ce210f
- SSDEEP 3072:gYnp5+7OK6SmV2Sp5vzC2D2+n8V7+vQi1F5J23W5q1RWAVO7/Eey:9IY5LC2D2+n8V7QQi1BQlYoV
- TLSH T183F31800FD87D1F1C8874D7150AAB33FDB31BA189127D71BEF956E32DA6BA029215E48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Contacts a large (934) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes itself 1 IoCs
pid Process 1500 nuclear.i686 - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nuclear.i686 File opened for modification /dev/misc/watchdog nuclear.i686 - Unexpected DNS network traffic destination 24 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nuclear.i686 File opened for modification /bin/watchdog nuclear.i686 - Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/35/maps nuclear.i686 File opened for reading /proc/78/maps nuclear.i686 File opened for reading /proc/169/maps nuclear.i686 File opened for reading /proc/13/maps nuclear.i686 File opened for reading /proc/22/maps nuclear.i686 File opened for reading /proc/24/maps nuclear.i686 File opened for reading /proc/82/maps nuclear.i686 File opened for reading /proc/174/maps nuclear.i686 File opened for reading /proc/181/maps nuclear.i686 File opened for reading /proc/995/maps nuclear.i686 File opened for reading /proc/12/maps nuclear.i686 File opened for reading /proc/680/maps nuclear.i686 File opened for reading /proc/709/maps nuclear.i686 File opened for reading /proc/36/maps nuclear.i686 File opened for reading /proc/171/maps nuclear.i686 File opened for reading /proc/176/maps nuclear.i686 File opened for reading /proc/3/maps nuclear.i686 File opened for reading /proc/424/maps nuclear.i686 File opened for reading /proc/947/maps nuclear.i686 File opened for reading /proc/28/maps nuclear.i686 File opened for reading /proc/183/maps nuclear.i686 File opened for reading /proc/213/maps nuclear.i686 File opened for reading /proc/595/maps nuclear.i686 File opened for reading /proc/20/maps nuclear.i686 File opened for reading /proc/178/maps nuclear.i686 File opened for reading /proc/179/maps nuclear.i686 File opened for reading /proc/435/maps nuclear.i686 File opened for reading /proc/472/maps nuclear.i686 File opened for reading /proc/473/maps nuclear.i686 File opened for reading /proc/717/maps nuclear.i686 File opened for reading /proc/19/maps nuclear.i686 File opened for reading /proc/279/maps nuclear.i686 File opened for reading /proc/14/maps nuclear.i686 File opened for reading /proc/18/maps nuclear.i686 File opened for reading /proc/460/maps nuclear.i686 File opened for reading /proc/25/maps nuclear.i686 File opened for reading /proc/324/maps nuclear.i686 File opened for reading /proc/15/maps nuclear.i686 File opened for reading /proc/115/maps nuclear.i686 File opened for reading /proc/481/maps nuclear.i686 File opened for reading /proc/619/maps nuclear.i686 File opened for reading /proc/942/maps nuclear.i686 File opened for reading /proc/86/maps nuclear.i686 File opened for reading /proc/98/maps nuclear.i686 File opened for reading /proc/173/maps nuclear.i686 File opened for reading /proc/442/maps nuclear.i686 File opened for reading /proc/21/maps nuclear.i686 File opened for reading /proc/79/maps nuclear.i686 File opened for reading /proc/731/maps nuclear.i686 File opened for reading /proc/920/maps nuclear.i686 File opened for reading /proc/30/maps nuclear.i686 File opened for reading /proc/184/maps nuclear.i686 File opened for reading /proc/261/maps nuclear.i686 File opened for reading /proc/988/maps nuclear.i686 File opened for reading /proc/11/maps nuclear.i686 File opened for reading /proc/27/maps nuclear.i686 File opened for reading /proc/31/maps nuclear.i686 File opened for reading /proc/581/maps nuclear.i686 File opened for reading /proc/667/maps nuclear.i686 File opened for reading /proc/925/maps nuclear.i686 File opened for reading /proc/7/maps nuclear.i686 File opened for reading /proc/10/maps nuclear.i686 File opened for reading /proc/5/maps nuclear.i686 File opened for reading /proc/26/maps nuclear.i686 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself [rcu_bh] 1500 nuclear.i686 -
description ioc Process File opened for reading /proc/1697/cmdline nuclear.i686 File opened for reading /proc/1837/cmdline nuclear.i686 File opened for reading /proc/19/cmdline nuclear.i686 File opened for reading /proc/988/cmdline nuclear.i686 File opened for reading /proc/1066/cmdline nuclear.i686 File opened for reading /proc/1108/cmdline nuclear.i686 File opened for reading /proc/1332/cmdline nuclear.i686 File opened for reading /proc/1709/maps nuclear.i686 File opened for reading /proc/1762/cmdline nuclear.i686 File opened for reading /proc/2/cmdline nuclear.i686 File opened for reading /proc/31/cmdline nuclear.i686 File opened for reading /proc/180/cmdline nuclear.i686 File opened for reading /proc/213/cmdline nuclear.i686 File opened for reading /proc/581/cmdline nuclear.i686 File opened for reading /proc/1593/cmdline nuclear.i686 File opened for reading /proc/1636/maps nuclear.i686 File opened for reading /proc/1650/maps nuclear.i686 File opened for reading /proc/22/cmdline nuclear.i686 File opened for reading /proc/178/cmdline nuclear.i686 File opened for reading /proc/1045/cmdline nuclear.i686 File opened for reading /proc/1538/maps nuclear.i686 File opened for reading /proc/1721/cmdline nuclear.i686 File opened for reading /proc/1788/cmdline nuclear.i686 File opened for reading /proc/1808/cmdline nuclear.i686 File opened for reading /proc/1821/maps nuclear.i686 File opened for reading /proc/1204/maps nuclear.i686 File opened for reading /proc/1507/maps nuclear.i686 File opened for reading /proc/34/cmdline nuclear.i686 File opened for reading /proc/456/cmdline nuclear.i686 File opened for reading /proc/618/cmdline nuclear.i686 File opened for reading /proc/967/cmdline nuclear.i686 File opened for reading /proc/1531/maps nuclear.i686 File opened for reading /proc/1534/maps nuclear.i686 File opened for reading /proc/1310/cmdline nuclear.i686 File opened for reading /proc/1512/cmdline nuclear.i686 File opened for reading /proc/1564/cmdline nuclear.i686 File opened for reading /proc/1576/maps nuclear.i686 File opened for reading /proc/1593/maps nuclear.i686 File opened for reading /proc/1618/maps nuclear.i686 File opened for reading /proc/1624/maps nuclear.i686 File opened for reading /proc/1636/cmdline nuclear.i686 File opened for reading /proc/1062/maps nuclear.i686 File opened for reading /proc/473/cmdline nuclear.i686 File opened for reading /proc/1802/cmdline nuclear.i686 File opened for reading /proc/1868/maps nuclear.i686 File opened for reading /proc/1495/maps nuclear.i686 File opened for reading /proc/1518/maps nuclear.i686 File opened for reading /proc/1597/maps nuclear.i686 File opened for reading /proc/1678/maps nuclear.i686 File opened for reading /proc/1678/cmdline nuclear.i686 File opened for reading /proc/1691/maps nuclear.i686 File opened for reading /proc/1711/maps nuclear.i686 File opened for reading /proc/1760/maps nuclear.i686 File opened for reading /proc/1018/maps nuclear.i686 File opened for reading /proc/1049/maps nuclear.i686 File opened for reading /proc/78/cmdline nuclear.i686 File opened for reading /proc/1095/cmdline nuclear.i686 File opened for reading /proc/1709/cmdline nuclear.i686 File opened for reading /proc/1742/cmdline nuclear.i686 File opened for reading /proc/1763/maps nuclear.i686 File opened for reading /proc/1825/cmdline nuclear.i686 File opened for reading /proc/1009/maps nuclear.i686 File opened for reading /proc/460/cmdline nuclear.i686 File opened for reading /proc/1504/cmdline nuclear.i686