Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
16/06/2026, 16:01
Behavioral task
behavioral1
Sample
aba2dd.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target aba2dd.elf
- Size 42KB
- Sample260616-tgc5asf16w
- SHA256 e217a281270dc8762820e5edc7dea14d7cd271c2d2e059719ae917761c7956a8
- MD5 ab31123be9bda44f14bc8dec7805a636
- SHA1 e92090e274e9b57b18e4371873b87d6c36775290
- SHA512 185384b342d56a5b8d4320889f9376ce5ef6de223b0030eac473176f25b4cdfe77cd2df24685583b818474fdfb20b87bafad0521903812c3a6ea1c3024ee44af
- SSDEEP 768:g+vDTXZ5VT5Y3jXtk0WgNMa+ouJEyKNjO9X1AS:NTXZ5VTSrtkfgWa+od3jQA
- TLSH T1D9130813B94480FCC499C274173AB63ED93275BE123DB3AA3BE4FB166D46E220D9D944
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog aba2dd.elf File opened for modification /dev/watchdog aba2dd.elf - Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp aba2dd.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself sh 1488 aba2dd.elf Changes the process name, possibly in an attempt to hide itself sh 1489 aba2dd.elf - Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp aba2dd.elf -
description ioc Process File opened for reading /proc/1145/exe aba2dd.elf File opened for reading /proc/1065/exe aba2dd.elf File opened for reading /proc/1550/exe aba2dd.elf File opened for reading /proc/1951/exe aba2dd.elf File opened for reading /proc/1973/exe aba2dd.elf File opened for reading /proc/1989/exe aba2dd.elf File opened for reading /proc/1643/exe aba2dd.elf File opened for reading /proc/1683/exe aba2dd.elf File opened for reading /proc/985/exe aba2dd.elf File opened for reading /proc/490/exe aba2dd.elf File opened for reading /proc/901/exe aba2dd.elf File opened for reading /proc/1486/exe aba2dd.elf File opened for reading /proc/1586/exe aba2dd.elf File opened for reading /proc/1864/exe aba2dd.elf File opened for reading /proc/1033/exe aba2dd.elf File opened for reading /proc/1764/exe aba2dd.elf File opened for reading /proc/1982/exe aba2dd.elf File opened for reading /proc/965/exe aba2dd.elf File opened for reading /proc/1503/exe aba2dd.elf File opened for reading /proc/1629/exe aba2dd.elf File opened for reading /proc/1912/exe aba2dd.elf File opened for reading /proc/1929/exe aba2dd.elf File opened for reading /proc/1937/exe aba2dd.elf File opened for reading /proc/1961/exe aba2dd.elf File opened for reading /proc/1969/exe aba2dd.elf File opened for reading /proc/906/exe aba2dd.elf File opened for reading /proc/1878/exe aba2dd.elf File opened for reading /proc/1932/exe aba2dd.elf File opened for reading /proc/1046/exe aba2dd.elf File opened for reading /proc/1484/exe aba2dd.elf File opened for reading /proc/1569/exe aba2dd.elf File opened for reading /proc/1590/exe aba2dd.elf File opened for reading /proc/1671/exe aba2dd.elf File opened for reading /proc/1833/exe aba2dd.elf File opened for reading /proc/1925/exe aba2dd.elf File opened for reading /proc/1955/exe aba2dd.elf File opened for reading /proc/468/exe aba2dd.elf File opened for reading /proc/502/exe aba2dd.elf File opened for reading /proc/1636/exe aba2dd.elf File opened for reading /proc/1895/exe aba2dd.elf File opened for reading /proc/942/exe aba2dd.elf File opened for reading /proc/1037/exe aba2dd.elf File opened for reading /proc/1662/exe aba2dd.elf File opened for reading /proc/1906/exe aba2dd.elf File opened for reading /proc/520/exe aba2dd.elf File opened for reading /proc/531/exe aba2dd.elf File opened for reading /proc/1021/exe aba2dd.elf File opened for reading /proc/1029/exe aba2dd.elf File opened for reading /proc/1047/exe aba2dd.elf File opened for reading /proc/1564/exe aba2dd.elf File opened for reading /proc/1849/exe aba2dd.elf File opened for reading /proc/1965/exe aba2dd.elf File opened for reading /proc/498/exe aba2dd.elf File opened for reading /proc/1846/exe aba2dd.elf File opened for reading /proc/1853/exe aba2dd.elf File opened for reading /proc/1876/exe aba2dd.elf File opened for reading /proc/1995/exe aba2dd.elf File opened for reading /proc/1600/exe aba2dd.elf File opened for reading /proc/659/exe aba2dd.elf File opened for reading /proc/1549/exe aba2dd.elf File opened for reading /proc/1610/exe aba2dd.elf File opened for reading /proc/1632/exe aba2dd.elf File opened for reading /proc/430/exe aba2dd.elf File opened for reading /proc/572/exe aba2dd.elf