Analysis
- max time kernel
149s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/06/2026, 16:24
Static task
static1
Behavioral task
behavioral1
Sample
dbg.elf
Resource
ubuntu1804-amd64-20260513-en
2 signatures
150 seconds
General
- Target dbg.elf
- Size 1.0MB
- Sample260619-twl1raay21
- SHA256 edac8dfbdb2a42d88bac0839bf486d2d4da5d42dafb291ea9ae528748375ca75
- MD5 3407e24b9242573ca475b0a9138fc0d4
- SHA1 2b1ca3c16e4535c61c0b07d30a3321670106e073
- SHA512 cf6b9c88236c303bc5710693647b396107a0ed628ab447e6f3cde0afeb3bee2851ed9b45ea9f0c14655a4cc8a41cfc5e49e8ec37a6a337b99044ddabd28c6fac
- SSDEEP 12288:Z39v0uT0xHYTnCFVzuQrZW59EnMt8FPtz0myI/pUxi5k:Z310uT0x4nCFVqQrqCMt83RpUx
- TLSH T17A357D2AF2B3B0BCD017C03053AFDBA2A835F47912216D7B35C496352D66DA01B69F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog dbg.elf File opened for modification /dev/misc/watchdog dbg.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself IQSWkbXtdGuSNuDBC 1515 dbg.elf