Analysis
- max time kernel
148s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/07/2026, 18:18
Behavioral task
behavioral1
Sample
nz.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86
- Size 45KB
- Sample260722-wx2hya1glc
- SHA256 3eab3901798ec748895b2dca4b8762aec553d2966112999c60061d4599b599a0
- MD5 415b9f5d5ca31b56d3df6efc1ded335c
- SHA1 7bcedc7c220edb6dfc24808423aeb5283c1893fd
- SHA512 871fb361ffdb747d9a91dc70f8af19b34cef9da01c2db88f6411171969f9a21980d4e68846a8c1082a6edc66af47fa04cd2a273c0c9a258fc6b6fe7b046288ff
- SSDEEP 768:zkIZRy9tAFAHzZp7mbLIF/4Yng1nZ+A/mEu1eO0qFVjHQUewc7QXP3oS1hVupnbG:zkIZk9j+bLC5g1ZhfYSAVb1ewcg4eupa
- TLSH T1D62302D3A48A4FCAF15DE2BA188A760F0A51315C7B354BFEB54C24D388B9F19AB143C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
cgur743.zapto.org
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86 File opened for modification /dev/misc/watchdog nz.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86 File opened for modification /bin/watchdog nz.x86 -
description ioc Process File opened for reading /proc/1068/status nz.x86 File opened for reading /proc/1540/status nz.x86 File opened for reading /proc/20/status nz.x86 File opened for reading /proc/89/status nz.x86 File opened for reading /proc/177/status nz.x86 File opened for reading /proc/541/status nz.x86 File opened for reading /proc/1538/status nz.x86 File opened for reading /proc/14/status nz.x86 File opened for reading /proc/12/status nz.x86 File opened for reading /proc/19/status nz.x86 File opened for reading /proc/79/status nz.x86 File opened for reading /proc/1134/status nz.x86 File opened for reading /proc/1421/status nz.x86 File opened for reading /proc/159/status nz.x86 File opened for reading /proc/445/status nz.x86 File opened for reading /proc/494/status nz.x86 File opened for reading /proc/574/status nz.x86 File opened for reading /proc/98/status nz.x86 File opened for reading /proc/170/status nz.x86 File opened for reading /proc/901/status nz.x86 File opened for reading /proc/908/status nz.x86 File opened for reading /proc/944/status nz.x86 File opened for reading /proc/974/status nz.x86 File opened for reading /proc/1355/status nz.x86 File opened for reading /proc/1508/status nz.x86 File opened for reading /proc/3/status nz.x86 File opened for reading /proc/17/status nz.x86 File opened for reading /proc/660/status nz.x86 File opened for reading /proc/911/status nz.x86 File opened for reading /proc/977/status nz.x86 File opened for reading /proc/2/status nz.x86 File opened for reading /proc/203/status nz.x86 File opened for reading /proc/307/status nz.x86 File opened for reading /proc/460/status nz.x86 File opened for reading /proc/968/status nz.x86 File opened for reading /proc/1058/status nz.x86 File opened for reading /proc/1073/status nz.x86 File opened for reading /proc/1149/status nz.x86 File opened for reading /proc/22/status nz.x86 File opened for reading /proc/28/status nz.x86 File opened for reading /proc/83/status nz.x86 File opened for reading /proc/1025/status nz.x86 File opened for reading /proc/1060/status nz.x86 File opened for reading /proc/1316/status nz.x86 File opened for reading /proc/167/status nz.x86 File opened for reading /proc/1092/status nz.x86 File opened for reading /proc/36/status nz.x86 File opened for reading /proc/80/status nz.x86 File opened for reading /proc/160/status nz.x86 File opened for reading /proc/673/status nz.x86 File opened for reading /proc/13/status nz.x86 File opened for reading /proc/7/status nz.x86 File opened for reading /proc/712/status nz.x86 File opened for reading /proc/1257/status nz.x86 File opened for reading /proc/1530/status nz.x86 File opened for reading /proc/1/status nz.x86 File opened for reading /proc/78/status nz.x86 File opened for reading /proc/950/status nz.x86 File opened for reading /proc/1101/status nz.x86 File opened for reading /proc/603/status nz.x86 File opened for reading /proc/930/status nz.x86 File opened for reading /proc/1029/status nz.x86 File opened for reading /proc/25/status nz.x86 File opened for reading /proc/27/status nz.x86