Analysis
- max time kernel
146s - max time network
148s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
27/07/2026, 12:20
Behavioral task
behavioral1
Sample
nz.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86
- Size 46KB
- Sample260727-phrxmael2w
- SHA256 d1272c36897a7a76a35c07e47815c05a86b15138854438c104790e94d3e286b6
- MD5 b1f251bac3a2a87e63e811c1251c6513
- SHA1 673333b80d2517a47e95279c2239ec3e51ab848d
- SHA512 de679fe0ff3ff89fc3ed19aa5d295d7a96bfe282c6cd0bfe0e78e536fd9fd8e2ee60fa8f50e8ac7b7ea0c4163ed5cea487cfd76b1470311fd87913761c9cb235
- SSDEEP 768:HmYc+qdFDe8e6yKkljQMVUXIbDiHIcLtddn55qqU5Pkn6y40GOPtQnbcuyD7UHQk:HmYfEU3KkJ5UYDiHIctdFau6KGOP2noG
- TLSH T1B623010648D2AA05D6BFA4BAD8CAB911107CD12755EFAEEAFE78001B0124F59BD34323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86 File opened for modification /dev/misc/watchdog nz.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog nz.x86 File opened for modification /sbin/watchdog nz.x86 -
description ioc Process File opened for reading /proc/937/status nz.x86 File opened for reading /proc/1022/status nz.x86 File opened for reading /proc/81/status nz.x86 File opened for reading /proc/168/status nz.x86 File opened for reading /proc/201/status nz.x86 File opened for reading /proc/1484/status nz.x86 File opened for reading /proc/1489/status nz.x86 File opened for reading /proc/25/status nz.x86 File opened for reading /proc/32/status nz.x86 File opened for reading /proc/161/status nz.x86 File opened for reading /proc/499/status nz.x86 File opened for reading /proc/503/status nz.x86 File opened for reading /proc/1062/status nz.x86 File opened for reading /proc/169/status nz.x86 File opened for reading /proc/1074/status nz.x86 File opened for reading /proc/910/status nz.x86 File opened for reading /proc/915/status nz.x86 File opened for reading /proc/951/status nz.x86 File opened for reading /proc/971/status nz.x86 File opened for reading /proc/1265/status nz.x86 File opened for reading /proc/1460/status nz.x86 File opened for reading /proc/29/status nz.x86 File opened for reading /proc/200/status nz.x86 File opened for reading /proc/322/status nz.x86 File opened for reading /proc/709/status nz.x86 File opened for reading /proc/27/status nz.x86 File opened for reading /proc/83/status nz.x86 File opened for reading /proc/158/status nz.x86 File opened for reading /proc/14/status nz.x86 File opened for reading /proc/730/status nz.x86 File opened for reading /proc/1008/status nz.x86 File opened for reading /proc/1100/status nz.x86 File opened for reading /proc/1174/status nz.x86 File opened for reading /proc/79/status nz.x86 File opened for reading /proc/157/status nz.x86 File opened for reading /proc/159/status nz.x86 File opened for reading /proc/554/status nz.x86 File opened for reading /proc/908/status nz.x86 File opened for reading /proc/957/status nz.x86 File opened for reading /proc/1025/status nz.x86 File opened for reading /proc/34/status nz.x86 File opened for reading /proc/78/status nz.x86 File opened for reading /proc/175/status nz.x86 File opened for reading /proc/493/status nz.x86 File opened for reading /proc/1061/status nz.x86 File opened for reading /proc/1495/status nz.x86 File opened for reading /proc/4/status nz.x86 File opened for reading /proc/23/status nz.x86 File opened for reading /proc/653/status nz.x86 File opened for reading /proc/1064/status nz.x86 File opened for reading /proc/80/status nz.x86 File opened for reading /proc/423/status nz.x86 File opened for reading /proc/654/status nz.x86 File opened for reading /proc/672/status nz.x86 File opened for reading /proc/1078/status nz.x86 File opened for reading /proc/1338/status nz.x86 File opened for reading /proc/1354/status nz.x86 File opened for reading /proc/1053/status nz.x86 File opened for reading /proc/1229/status nz.x86 File opened for reading /proc/1488/status nz.x86 File opened for reading /proc/18/status nz.x86 File opened for reading /proc/86/status nz.x86 File opened for reading /proc/89/status nz.x86 File opened for reading /proc/165/status nz.x86