Analysis
- max time kernel
134s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
18/06/2026, 07:12
Behavioral task
behavioral1
Sample
px86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target px86.elf
- Size 64KB
- Sample260618-h1ydsshv7w
- SHA256 013db1cb6c9fcca606bbe39188bf3f477283c46148a3358ddf43ce9b010d4a5e
- MD5 00584d20a23508a02a93cda145020fb9
- SHA1 9ec238193563a6f637d6c49dcedcdae6f25507df
- SHA512 40f6314c12554e381ec0dabfc8548669d98fe556242af7812ca5f28c1fdf7a9cbac04257487d547ce217a923828be6bfb516fb13f899fab97df690edb06e2c04
- SSDEEP 1536:FtCKbOKOv4mqLH/gS5MrGEB8E3s01rXPOZfFMNPZnouy8ryp:FVOKE4RH/LM6k180BPCSNxoutK
- TLSH T1725312CFC8965231FFC4443605FDF88E8D89F724491896695AC4BBBFDC847962630A23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes itself 1 IoCs
pid Process 1487 px86.elf - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog px86.elf File opened for modification /dev/misc/watchdog px86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself scanbot 1487 px86.elf -
description ioc Process File opened for reading /proc/115/stat px86.elf File opened for reading /proc/160/stat px86.elf File opened for reading /proc/163/stat px86.elf File opened for reading /proc/169/stat px86.elf File opened for reading /proc/567/stat px86.elf File opened for reading /proc/662/stat px86.elf File opened for reading /proc/910/stat px86.elf File opened for reading /proc/943/stat px86.elf File opened for reading /proc/702/stat px86.elf File opened for reading /proc/929/stat px86.elf File opened for reading /proc/1028/stat px86.elf File opened for reading /proc/1032/stat px86.elf File opened for reading /proc/1045/stat px86.elf File opened for reading /proc/1493/stat px86.elf File opened for reading /proc/963/stat px86.elf File opened for reading /proc/1078/stat px86.elf File opened for reading /proc/1095/stat px86.elf File opened for reading /proc/1128/stat px86.elf File opened for reading /proc/1144/stat px86.elf File opened for reading /proc/1190/stat px86.elf File opened for reading /proc/1000/stat px86.elf File opened for reading /proc/1040/stat px86.elf File opened for reading /proc/1057/stat px86.elf File opened for reading /proc/1245/stat px86.elf File opened for reading /proc/2/stat px86.elf File opened for reading /proc/9/stat px86.elf File opened for reading /proc/82/stat px86.elf File opened for reading /proc/473/stat px86.elf File opened for reading /proc/594/stat px86.elf File opened for reading /proc/924/stat px86.elf File opened for reading /proc/1483/stat px86.elf File opened for reading /proc/29/stat px86.elf File opened for reading /proc/480/stat px86.elf File opened for reading /proc/658/stat px86.elf File opened for reading /proc/28/stat px86.elf File opened for reading /proc/30/stat px86.elf File opened for reading /proc/174/stat px86.elf File opened for reading /proc/476/stat px86.elf File opened for reading /proc/13/stat px86.elf File opened for reading /proc/22/stat px86.elf File opened for reading /proc/137/stat px86.elf File opened for reading /proc/171/stat px86.elf File opened for reading /proc/447/stat px86.elf File opened for reading /proc/634/stat px86.elf File opened for reading /proc/976/stat px86.elf File opened for reading /proc/1073/stat px86.elf File opened for reading /proc/35/stat px86.elf File opened for reading /proc/560/stat px86.elf File opened for reading /proc/907/stat px86.elf File opened for reading /proc/1092/stat px86.elf File opened for reading /proc/25/stat px86.elf File opened for reading /proc/1053/stat px86.elf File opened for reading /proc/15/stat px86.elf File opened for reading /proc/178/stat px86.elf File opened for reading /proc/1024/stat px86.elf File opened for reading /proc/1036/stat px86.elf File opened for reading /proc/1177/stat px86.elf File opened for reading /proc/32/stat px86.elf File opened for reading /proc/902/stat px86.elf File opened for reading /proc/1383/stat px86.elf File opened for reading /proc/3/stat px86.elf File opened for reading /proc/6/stat px86.elf File opened for reading /proc/86/stat px86.elf File opened for reading /proc/1015/stat px86.elf