Analysis
- max time kernel
145s - max time network
146s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/07/2026, 01:03
Behavioral task
behavioral1
Sample
nz.x86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86.elf
- Size 45KB
- Sample260709-bema3scs21
- SHA256 54fd2bd51e3cdea2b09da11d96ae7e87fbc7ada093a7818f2b1be5d95fa6fb19
- MD5 d0784fba690fc2f99a5153af99b133eb
- SHA1 73b0a5d51a15391c838cf90656626d489f971137
- SHA512 a051185e95189a7cb5a4b386a70ad650b83758a31fa7763e2ff062395d2153f7aba0ae340aee4ded9448d219c02af8a64c6abafa5f38cc5ae44de104ed3b5cb2
- SSDEEP 768:4QKTOSNoekrlarmeqOskbRUXwE5L4owd3jdJZQc3WrqamIHDLn4aCU7oeO4OnbcE:4QKTOGoeO1eqlXwOEowd50MTIjLnjVoJ
- TLSH T18223F186A97D2A04C37BB135756D31C704E4E44D3EA2807B8E94A46AD672F58EC3D3D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
oefjpwefgjujw865.hopto.org
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86.elf File opened for modification /dev/misc/watchdog nz.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86.elf File opened for modification /bin/watchdog nz.x86.elf -
description ioc Process File opened for reading /proc/1063/status nz.x86.elf File opened for reading /proc/1171/status nz.x86.elf File opened for reading /proc/7/status nz.x86.elf File opened for reading /proc/183/status nz.x86.elf File opened for reading /proc/366/status nz.x86.elf File opened for reading /proc/368/status nz.x86.elf File opened for reading /proc/500/status nz.x86.elf File opened for reading /proc/729/status nz.x86.elf File opened for reading /proc/1018/status nz.x86.elf File opened for reading /proc/1138/status nz.x86.elf File opened for reading /proc/179/status nz.x86.elf File opened for reading /proc/452/status nz.x86.elf File opened for reading /proc/466/status nz.x86.elf File opened for reading /proc/486/status nz.x86.elf File opened for reading /proc/586/status nz.x86.elf File opened for reading /proc/693/status nz.x86.elf File opened for reading /proc/1077/status nz.x86.elf File opened for reading /proc/1263/status nz.x86.elf File opened for reading /proc/89/status nz.x86.elf File opened for reading /proc/499/status nz.x86.elf File opened for reading /proc/646/status nz.x86.elf File opened for reading /proc/1312/status nz.x86.elf File opened for reading /proc/167/status nz.x86.elf File opened for reading /proc/8/status nz.x86.elf File opened for reading /proc/12/status nz.x86.elf File opened for reading /proc/1044/status nz.x86.elf File opened for reading /proc/1071/status nz.x86.elf File opened for reading /proc/1330/status nz.x86.elf File opened for reading /proc/14/status nz.x86.elf File opened for reading /proc/15/status nz.x86.elf File opened for reading /proc/27/status nz.x86.elf File opened for reading /proc/172/status nz.x86.elf File opened for reading /proc/177/status nz.x86.elf File opened for reading /proc/1498/status nz.x86.elf File opened for reading /proc/1053/status nz.x86.elf File opened for reading /proc/1203/status nz.x86.elf File opened for reading /proc/1466/status nz.x86.elf File opened for reading /proc/22/status nz.x86.elf File opened for reading /proc/78/status nz.x86.elf File opened for reading /proc/182/status nz.x86.elf File opened for reading /proc/917/status nz.x86.elf File opened for reading /proc/1098/status nz.x86.elf File opened for reading /proc/1351/status nz.x86.elf File opened for reading /proc/1359/status nz.x86.elf File opened for reading /proc/81/status nz.x86.elf File opened for reading /proc/671/status nz.x86.elf File opened for reading /proc/999/status nz.x86.elf File opened for reading /proc/1048/status nz.x86.elf File opened for reading /proc/1061/status nz.x86.elf File opened for reading /proc/1503/status nz.x86.elf File opened for reading /proc/34/status nz.x86.elf File opened for reading /proc/171/status nz.x86.elf File opened for reading /proc/505/status nz.x86.elf File opened for reading /proc/995/status nz.x86.elf File opened for reading /proc/1075/status nz.x86.elf File opened for reading /proc/1100/status nz.x86.elf File opened for reading /proc/26/status nz.x86.elf File opened for reading /proc/31/status nz.x86.elf File opened for reading /proc/180/status nz.x86.elf File opened for reading /proc/920/status nz.x86.elf File opened for reading /proc/1260/status nz.x86.elf File opened for reading /proc/79/status nz.x86.elf File opened for reading /proc/664/status nz.x86.elf File opened for reading /proc/1008/status nz.x86.elf