Analysis
- max time kernel
138s - max time network
139s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
28/05/2026, 12:19
Behavioral task
behavioral1
Sample
176.65.139.220_sample.bin
Resource
ubuntu1804-amd64-20260513-en
2 signatures
150 seconds
General
- Target 176.65.139.220_sample.bin
- Size 77KB
- Sample260528-phcspse14j
- SHA256 561bcf749e4aff1076cc6501dabe3360e95a505ff3da679c38ca7e62ec9bbd74
- MD5 72e29c8d929bcaf287f9ae9c75ef600e
- SHA1 8a786eadeae8a886a5e81b6aa5c128210c0ea5f7
- SHA512 3c6a9fc2308653e4da0347eb9c9c10f3705d2b954f9c1ce927be3f801e7b1623a32eba2e824a0e2d385c911274cfd7b15b7c91f9cc8bf10db8d78921c2956ea1
- SSDEEP 1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHk:uVFrPNQn+WVQ3EXVUk29jgxOk
- TLSH T1B3733B81F54B80F1D847487090BBF33FDE31D69541B5D66EEF689F36EA63202A60629C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 176.65.139.220_sample.bin File opened for modification /dev/misc/watchdog 176.65.139.220_sample.bin - Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1505 176.65.139.220_sample.bin