Analysis
- max time kernel
149s - max time network
153s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
27/05/2026, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
nuclear.x86_64
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
9 signatures
150 seconds
General
- Target nuclear.x86_64
- Size 192KB
- Sample260527-pdz3faft2z
- SHA256 ba3a206aaf4c538adb0575408f39d965c383e312f4eae8f8a2bc267ec134461c
- MD5 ba0117d088576115da018a05de7d570e
- SHA1 47c49f3d45c0270065298af48dfa5cc31e80b047
- SHA512 beab60ddf8463d994d2d5027e1dc2ab4e2f14dbe7976f41e31417af2822cbd9797b31722d07653bc5b53c3e47afa3c0827fa723aa3dde1b9793f4d07bc0e36ed
- SSDEEP 3072:JDh61ieF3ogzF7r3Wo0VNO8kWxk51eeUdU5oswVesj8KUrA6OYzp/I:Bh61ieF31zF7r3Wo0fO8rxzi2LUMEJI
- TLSH T1FF142B06FA8190FDC4DAC1384BEEF5379931B85C5238F25B5BD4AB212E29F205A2DF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Contacts a large (945) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes itself 1 IoCs
pid Process 1484 nuclear.x86_64 - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nuclear.x86_64 File opened for modification /dev/misc/watchdog nuclear.x86_64 - Unexpected DNS network traffic destination 24 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 208.67.222.222 Destination IP 9.9.9.9 Destination IP 208.67.222.222 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nuclear.x86_64 File opened for modification /bin/watchdog nuclear.x86_64 - Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/4/maps nuclear.x86_64 File opened for reading /proc/8/maps nuclear.x86_64 File opened for reading /proc/18/maps nuclear.x86_64 File opened for reading /proc/169/maps nuclear.x86_64 File opened for reading /proc/174/maps nuclear.x86_64 File opened for reading /proc/496/maps nuclear.x86_64 File opened for reading /proc/603/maps nuclear.x86_64 File opened for reading /proc/12/maps nuclear.x86_64 File opened for reading /proc/161/maps nuclear.x86_64 File opened for reading /proc/159/maps nuclear.x86_64 File opened for reading /proc/492/maps nuclear.x86_64 File opened for reading /proc/678/maps nuclear.x86_64 File opened for reading /proc/906/maps nuclear.x86_64 File opened for reading /proc/35/maps nuclear.x86_64 File opened for reading /proc/163/maps nuclear.x86_64 File opened for reading /proc/714/maps nuclear.x86_64 File opened for reading /proc/901/maps nuclear.x86_64 File opened for reading /proc/24/maps nuclear.x86_64 File opened for reading /proc/965/maps nuclear.x86_64 File opened for reading /proc/971/maps nuclear.x86_64 File opened for reading /proc/7/maps nuclear.x86_64 File opened for reading /proc/31/maps nuclear.x86_64 File opened for reading /proc/10/maps nuclear.x86_64 File opened for reading /proc/34/maps nuclear.x86_64 File opened for reading /proc/79/maps nuclear.x86_64 File opened for reading /proc/162/maps nuclear.x86_64 File opened for reading /proc/201/maps nuclear.x86_64 File opened for reading /proc/339/maps nuclear.x86_64 File opened for reading /proc/460/maps nuclear.x86_64 File opened for reading /proc/708/maps nuclear.x86_64 File opened for reading /proc/6/maps nuclear.x86_64 File opened for reading /proc/16/maps nuclear.x86_64 File opened for reading /proc/36/maps nuclear.x86_64 File opened for reading /proc/78/maps nuclear.x86_64 File opened for reading /proc/165/maps nuclear.x86_64 File opened for reading /proc/602/maps nuclear.x86_64 File opened for reading /proc/658/maps nuclear.x86_64 File opened for reading /proc/22/maps nuclear.x86_64 File opened for reading /proc/83/maps nuclear.x86_64 File opened for reading /proc/942/maps nuclear.x86_64 File opened for reading /proc/961/maps nuclear.x86_64 File opened for reading /proc/17/maps nuclear.x86_64 File opened for reading /proc/167/maps nuclear.x86_64 File opened for reading /proc/454/maps nuclear.x86_64 File opened for reading /proc/13/maps nuclear.x86_64 File opened for reading /proc/157/maps nuclear.x86_64 File opened for reading /proc/166/maps nuclear.x86_64 File opened for reading /proc/455/maps nuclear.x86_64 File opened for reading /proc/487/maps nuclear.x86_64 File opened for reading /proc/498/maps nuclear.x86_64 File opened for reading /proc/437/maps nuclear.x86_64 File opened for reading /proc/984/maps nuclear.x86_64 File opened for reading /proc/89/maps nuclear.x86_64 File opened for reading /proc/202/maps nuclear.x86_64 File opened for reading /proc/453/maps nuclear.x86_64 File opened for reading /proc/15/maps nuclear.x86_64 File opened for reading /proc/20/maps nuclear.x86_64 File opened for reading /proc/164/maps nuclear.x86_64 File opened for reading /proc/337/maps nuclear.x86_64 File opened for reading /proc/28/maps nuclear.x86_64 File opened for reading /proc/84/maps nuclear.x86_64 File opened for reading /proc/137/maps nuclear.x86_64 File opened for reading /proc/988/maps nuclear.x86_64 File opened for reading /proc/98/maps nuclear.x86_64 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself [kblockd] 1484 nuclear.x86_64 -
description ioc Process File opened for reading /proc/1536/maps nuclear.x86_64 File opened for reading /proc/1191/maps nuclear.x86_64 File opened for reading /proc/1596/maps nuclear.x86_64 File opened for reading /proc/1613/maps nuclear.x86_64 File opened for reading /proc/1625/cmdline nuclear.x86_64 File opened for reading /proc/1699/maps nuclear.x86_64 File opened for reading /proc/1826/maps nuclear.x86_64 File opened for reading /proc/1827/cmdline nuclear.x86_64 File opened for reading /proc/1834/cmdline nuclear.x86_64 File opened for reading /proc/1045/maps nuclear.x86_64 File opened for reading /proc/489/cmdline nuclear.x86_64 File opened for reading /proc/658/cmdline nuclear.x86_64 File opened for reading /proc/869/cmdline nuclear.x86_64 File opened for reading /proc/1243/cmdline nuclear.x86_64 File opened for reading /proc/1579/maps nuclear.x86_64 File opened for reading /proc/1586/maps nuclear.x86_64 File opened for reading /proc/1733/cmdline nuclear.x86_64 File opened for reading /proc/1011/maps nuclear.x86_64 File opened for reading /proc/1348/maps nuclear.x86_64 File opened for reading /proc/83/cmdline nuclear.x86_64 File opened for reading /proc/965/cmdline nuclear.x86_64 File opened for reading /proc/1497/maps nuclear.x86_64 File opened for reading /proc/1809/maps nuclear.x86_64 File opened for reading /proc/1827/maps nuclear.x86_64 File opened for reading /proc/1582/cmdline nuclear.x86_64 File opened for reading /proc/1637/cmdline nuclear.x86_64 File opened for reading /proc/1776/maps nuclear.x86_64 File opened for reading /proc/1083/maps nuclear.x86_64 File opened for reading /proc/157/cmdline nuclear.x86_64 File opened for reading /proc/1530/cmdline nuclear.x86_64 File opened for reading /proc/1667/maps nuclear.x86_64 File opened for reading /proc/172/cmdline nuclear.x86_64 File opened for reading /proc/602/cmdline nuclear.x86_64 File opened for reading /proc/1020/cmdline nuclear.x86_64 File opened for reading /proc/1588/cmdline nuclear.x86_64 File opened for reading /proc/1593/cmdline nuclear.x86_64 File opened for reading /proc/3/cmdline nuclear.x86_64 File opened for reading /proc/170/cmdline nuclear.x86_64 File opened for reading /proc/1024/maps nuclear.x86_64 File opened for reading /proc/1533/cmdline nuclear.x86_64 File opened for reading /proc/1593/maps nuclear.x86_64 File opened for reading /proc/1853/maps nuclear.x86_64 File opened for reading /proc/6/cmdline nuclear.x86_64 File opened for reading /proc/10/cmdline nuclear.x86_64 File opened for reading /proc/84/cmdline nuclear.x86_64 File opened for reading /proc/268/cmdline nuclear.x86_64 File opened for reading /proc/437/cmdline nuclear.x86_64 File opened for reading /proc/603/cmdline nuclear.x86_64 File opened for reading /proc/674/cmdline nuclear.x86_64 File opened for reading /proc/1086/cmdline nuclear.x86_64 File opened for reading /proc/1028/maps nuclear.x86_64 File opened for reading /proc/30/cmdline nuclear.x86_64 File opened for reading /proc/160/cmdline nuclear.x86_64 File opened for reading /proc/259/cmdline nuclear.x86_64 File opened for reading /proc/1045/cmdline nuclear.x86_64 File opened for reading /proc/1091/cmdline nuclear.x86_64 File opened for reading /proc/1525/maps nuclear.x86_64 File opened for reading /proc/1613/cmdline nuclear.x86_64 File opened for reading /proc/1049/maps nuclear.x86_64 File opened for reading /proc/24/cmdline nuclear.x86_64 File opened for reading /proc/539/cmdline nuclear.x86_64 File opened for reading /proc/1032/cmdline nuclear.x86_64 File opened for reading /proc/1524/maps nuclear.x86_64 File opened for reading /proc/1654/maps nuclear.x86_64