Analysis
- max time kernel
147s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/07/2026, 01:00
Behavioral task
behavioral1
Sample
nz.x86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86.elf
- Size 45KB
- Sample260709-bc5pmscs2w
- SHA256 54fd2bd51e3cdea2b09da11d96ae7e87fbc7ada093a7818f2b1be5d95fa6fb19
- MD5 d0784fba690fc2f99a5153af99b133eb
- SHA1 73b0a5d51a15391c838cf90656626d489f971137
- SHA512 a051185e95189a7cb5a4b386a70ad650b83758a31fa7763e2ff062395d2153f7aba0ae340aee4ded9448d219c02af8a64c6abafa5f38cc5ae44de104ed3b5cb2
- SSDEEP 768:4QKTOSNoekrlarmeqOskbRUXwE5L4owd3jdJZQc3WrqamIHDLn4aCU7oeO4OnbcE:4QKTOGoeO1eqlXwOEowd50MTIjLnjVoJ
- TLSH T18223F186A97D2A04C37BB135756D31C704E4E44D3EA2807B8E94A46AD672F58EC3D3D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
oefjpwefgjujw865.hopto.org
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86.elf File opened for modification /dev/misc/watchdog nz.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86.elf File opened for modification /bin/watchdog nz.x86.elf -
description ioc Process File opened for reading /proc/163/status nz.x86.elf File opened for reading /proc/725/status nz.x86.elf File opened for reading /proc/32/status nz.x86.elf File opened for reading /proc/168/status nz.x86.elf File opened for reading /proc/174/status nz.x86.elf File opened for reading /proc/443/status nz.x86.elf File opened for reading /proc/159/status nz.x86.elf File opened for reading /proc/2/status nz.x86.elf File opened for reading /proc/8/status nz.x86.elf File opened for reading /proc/9/status nz.x86.elf File opened for reading /proc/14/status nz.x86.elf File opened for reading /proc/36/status nz.x86.elf File opened for reading /proc/86/status nz.x86.elf File opened for reading /proc/415/status nz.x86.elf File opened for reading /proc/13/status nz.x86.elf File opened for reading /proc/29/status nz.x86.elf File opened for reading /proc/80/status nz.x86.elf File opened for reading /proc/325/status nz.x86.elf File opened for reading /proc/487/status nz.x86.elf File opened for reading /proc/986/status nz.x86.elf File opened for reading /proc/1256/status nz.x86.elf File opened for reading /proc/16/status nz.x86.elf File opened for reading /proc/35/status nz.x86.elf File opened for reading /proc/158/status nz.x86.elf File opened for reading /proc/173/status nz.x86.elf File opened for reading /proc/488/status nz.x86.elf File opened for reading /proc/901/status nz.x86.elf File opened for reading /proc/928/status nz.x86.elf File opened for reading /proc/1038/status nz.x86.elf File opened for reading /proc/481/status nz.x86.elf File opened for reading /proc/976/status nz.x86.elf File opened for reading /proc/1452/status nz.x86.elf File opened for reading /proc/1485/status nz.x86.elf File opened for reading /proc/82/status nz.x86.elf File opened for reading /proc/1057/status nz.x86.elf File opened for reading /proc/1247/status nz.x86.elf File opened for reading /proc/1331/status nz.x86.elf File opened for reading /proc/3/status nz.x86.elf File opened for reading /proc/137/status nz.x86.elf File opened for reading /proc/433/status nz.x86.elf File opened for reading /proc/691/status nz.x86.elf File opened for reading /proc/971/status nz.x86.elf File opened for reading /proc/1054/status nz.x86.elf File opened for reading /proc/1163/status nz.x86.elf File opened for reading /proc/12/status nz.x86.elf File opened for reading /proc/170/status nz.x86.elf File opened for reading /proc/202/status nz.x86.elf File opened for reading /proc/464/status nz.x86.elf File opened for reading /proc/899/status nz.x86.elf File opened for reading /proc/948/status nz.x86.elf File opened for reading /proc/162/status nz.x86.elf File opened for reading /proc/7/status nz.x86.elf File opened for reading /proc/84/status nz.x86.elf File opened for reading /proc/490/status nz.x86.elf File opened for reading /proc/648/status nz.x86.elf File opened for reading /proc/1069/status nz.x86.elf File opened for reading /proc/1092/status nz.x86.elf File opened for reading /proc/1480/status nz.x86.elf File opened for reading /proc/81/status nz.x86.elf File opened for reading /proc/421/status nz.x86.elf File opened for reading /proc/540/status nz.x86.elf File opened for reading /proc/966/status nz.x86.elf File opened for reading /proc/999/status nz.x86.elf File opened for reading /proc/1018/status nz.x86.elf