b98c7f756334d7dab2b416803ea76c317537701cc8113bdbc74fbac3bae2c29a

Analysis

max time kernel
149s
max time network
141s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
01/06/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbg.elf
Size 958KB
Sample260601-grq3padt4w
SHA256 b98c7f756334d7dab2b416803ea76c317537701cc8113bdbc74fbac3bae2c29a
MD5 7bc098b4445e7e1a69962f16351af2d8
SHA1 d7316df726d2c137fea786bdc2626b976ba6ef71
SHA512 67cf1e7b5736128a3a02e6b63e79b8c5ba3202693e7d19ae6648b0a9109b50f60233ca00bc07bc7ec902ba198aed84e445707e84e80c4c8150d11cf3d44aba33
SSDEEP 12288:Jia3oAbeNgvzRNwGdoHtMLi+CSegujoS89uUbHlTI3kayQgLonHX:Jia3oceNgv/Bly8kUbHl0iLo
TLSH
T19C257B2EF2B2F1BCE007C03417DFCAA15525B07926312DBB37C49A353E6ADA15359B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	dbg.elf
File opened for modification	/dev/misc/watchdog	dbg.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	syJhMoTdIqvvcfRaHAh	1497	dbg.elf

/tmp/dbg.elf
/tmp/dbg.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:1497

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads