Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
28/07/2026, 18:17
Behavioral task
behavioral1
Sample
nz.i686
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.i686
- Size 48KB
- Sample260728-ww2sbasble
- SHA256 44fcd7a6a61dd418b64fd2fa3e0048d139740bf74a77d261a6900e24609e83f6
- MD5 c83ed258db4980f307a79b98ec9752dd
- SHA1 b729096f41548f821e7efc79080856f5de5202b3
- SHA512 d3d70541cdac81d1f956395b7742a3bb208af800a5b746f1752a0ff3266df7626bbb907a7bac9b2a2082cefd2599276f2dd9633bb60947287daab43a5ba8e0b7
- SSDEEP 1536:4woCY8XMNETeWlullw4aswgzsY+lzebmuenouy8HyY:tsCWEwllwYwhoutr
- TLSH T1AB23F190C8CB8E026BCFC3F474BF1C4B1720B2686866C5979AD897678D34F16BE592D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.i686 File opened for modification /dev/misc/watchdog nz.i686 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.i686 File opened for modification /bin/watchdog nz.i686 -
description ioc Process File opened for reading /proc/14/status nz.i686 File opened for reading /proc/162/status nz.i686 File opened for reading /proc/170/status nz.i686 File opened for reading /proc/174/status nz.i686 File opened for reading /proc/333/status nz.i686 File opened for reading /proc/557/status nz.i686 File opened for reading /proc/710/status nz.i686 File opened for reading /proc/159/status nz.i686 File opened for reading /proc/583/status nz.i686 File opened for reading /proc/947/status nz.i686 File opened for reading /proc/967/status nz.i686 File opened for reading /proc/987/status nz.i686 File opened for reading /proc/3/status nz.i686 File opened for reading /proc/20/status nz.i686 File opened for reading /proc/24/status nz.i686 File opened for reading /proc/454/status nz.i686 File opened for reading /proc/456/status nz.i686 File opened for reading /proc/922/status nz.i686 File opened for reading /proc/974/status nz.i686 File opened for reading /proc/1045/status nz.i686 File opened for reading /proc/36/status nz.i686 File opened for reading /proc/1020/status nz.i686 File opened for reading /proc/1085/status nz.i686 File opened for reading /proc/1094/status nz.i686 File opened for reading /proc/1137/status nz.i686 File opened for reading /proc/7/status nz.i686 File opened for reading /proc/167/status nz.i686 File opened for reading /proc/478/status nz.i686 File opened for reading /proc/565/status nz.i686 File opened for reading /proc/1024/status nz.i686 File opened for reading /proc/1053/status nz.i686 File opened for reading /proc/1187/status nz.i686 File opened for reading /proc/29/status nz.i686 File opened for reading /proc/80/status nz.i686 File opened for reading /proc/201/status nz.i686 File opened for reading /proc/549/status nz.i686 File opened for reading /proc/964/status nz.i686 File opened for reading /proc/1468/status nz.i686 File opened for reading /proc/164/status nz.i686 File opened for reading /proc/669/status nz.i686 File opened for reading /proc/21/status nz.i686 File opened for reading /proc/32/status nz.i686 File opened for reading /proc/30/status nz.i686 File opened for reading /proc/674/status nz.i686 File opened for reading /proc/1051/status nz.i686 File opened for reading /proc/23/status nz.i686 File opened for reading /proc/81/status nz.i686 File opened for reading /proc/488/status nz.i686 File opened for reading /proc/941/status nz.i686 File opened for reading /proc/1062/status nz.i686 File opened for reading /proc/268/status nz.i686 File opened for reading /proc/983/status nz.i686 File opened for reading /proc/1138/status nz.i686 File opened for reading /proc/35/status nz.i686 File opened for reading /proc/161/status nz.i686 File opened for reading /proc/424/status nz.i686 File opened for reading /proc/900/status nz.i686 File opened for reading /proc/34/status nz.i686 File opened for reading /proc/171/status nz.i686 File opened for reading /proc/5/status nz.i686 File opened for reading /proc/82/status nz.i686 File opened for reading /proc/158/status nz.i686 File opened for reading /proc/610/status nz.i686 File opened for reading /proc/655/status nz.i686