Analysis
- max time kernel
149s - max time network
146s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
08/07/2026, 01:15
Behavioral task
behavioral1
Sample
nz.i686.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.i686.elf
- Size 47KB
- Sample260708-bmeafag13z
- SHA256 c18a7f266c4e1ad9447389bb6911539cda1b59a03d795c7932070aee5fc27ee2
- MD5 accbdfd3ef6223ea852cc6ae6bd76e85
- SHA1 17d5663ecb7440b165af6652967a6c904ca94a54
- SHA512 87fcf69f7379537fe02d128437dc4dd7b8aef737bc546996b152f203672379413acd750b60301413afb88d288bdd8d12c6d128268f729110ca55d46f02b413b0
- SSDEEP 768:mYcUTiSFnR+ZW54r03UK12jc8/xCrNhRQeccxdk05pHFFGxhUWVuA5pMuMwcnbcY:mYcUTiMnR+1rKm9gTRRcyplFGxn3563N
- TLSH T16223F12811F66E65B21B86F7195EFB1E2B2471052721D5C735E0E070D6E3B3A0F2C7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.i686.elf File opened for modification /dev/misc/watchdog nz.i686.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.i686.elf File opened for modification /bin/watchdog nz.i686.elf -
description ioc Process File opened for reading /proc/1035/status nz.i686.elf File opened for reading /proc/1063/status nz.i686.elf File opened for reading /proc/1109/status nz.i686.elf File opened for reading /proc/1117/status nz.i686.elf File opened for reading /proc/7/status nz.i686.elf File opened for reading /proc/11/status nz.i686.elf File opened for reading /proc/78/status nz.i686.elf File opened for reading /proc/454/status nz.i686.elf File opened for reading /proc/579/status nz.i686.elf File opened for reading /proc/994/status nz.i686.elf File opened for reading /proc/1158/status nz.i686.elf File opened for reading /proc/1362/status nz.i686.elf File opened for reading /proc/542/status nz.i686.elf File opened for reading /proc/1114/status nz.i686.elf File opened for reading /proc/179/status nz.i686.elf File opened for reading /proc/27/status nz.i686.elf File opened for reading /proc/12/status nz.i686.elf File opened for reading /proc/21/status nz.i686.elf File opened for reading /proc/952/status nz.i686.elf File opened for reading /proc/982/status nz.i686.elf File opened for reading /proc/1031/status nz.i686.elf File opened for reading /proc/1052/status nz.i686.elf File opened for reading /proc/83/status nz.i686.elf File opened for reading /proc/191/status nz.i686.elf File opened for reading /proc/503/status nz.i686.elf File opened for reading /proc/704/status nz.i686.elf File opened for reading /proc/933/status nz.i686.elf File opened for reading /proc/1110/status nz.i686.elf File opened for reading /proc/1504/status nz.i686.elf File opened for reading /proc/1509/status nz.i686.elf File opened for reading /proc/1/status nz.i686.elf File opened for reading /proc/26/status nz.i686.elf File opened for reading /proc/98/status nz.i686.elf File opened for reading /proc/182/status nz.i686.elf File opened for reading /proc/194/status nz.i686.elf File opened for reading /proc/462/status nz.i686.elf File opened for reading /proc/916/status nz.i686.elf File opened for reading /proc/1089/status nz.i686.elf File opened for reading /proc/25/status nz.i686.elf File opened for reading /proc/80/status nz.i686.elf File opened for reading /proc/434/status nz.i686.elf File opened for reading /proc/566/status nz.i686.elf File opened for reading /proc/971/status nz.i686.elf File opened for reading /proc/1275/status nz.i686.elf File opened for reading /proc/1369/status nz.i686.elf File opened for reading /proc/86/status nz.i686.elf File opened for reading /proc/177/status nz.i686.elf File opened for reading /proc/186/status nz.i686.elf File opened for reading /proc/1104/status nz.i686.elf File opened for reading /proc/623/status nz.i686.elf File opened for reading /proc/1088/status nz.i686.elf File opened for reading /proc/1320/status nz.i686.elf File opened for reading /proc/18/status nz.i686.elf File opened for reading /proc/190/status nz.i686.elf File opened for reading /proc/690/status nz.i686.elf File opened for reading /proc/975/status nz.i686.elf File opened for reading /proc/456/status nz.i686.elf File opened for reading /proc/938/status nz.i686.elf File opened for reading /proc/1017/status nz.i686.elf File opened for reading /proc/1061/status nz.i686.elf File opened for reading /proc/24/status nz.i686.elf File opened for reading /proc/31/status nz.i686.elf File opened for reading /proc/342/status nz.i686.elf File opened for reading /proc/674/status nz.i686.elf