Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/08/2026, 22:53
Behavioral task
behavioral1
Sample
faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4
- Size 44KB
- Sample260802-2vfrcagh82
- SHA256 faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4
- MD5 c5661bd393751b68c214c986ac8ee1df
- SHA1 0cff1b98579052e35e0ec5f0423121806204a5ad
- SHA512 e6127bec20e04a938e6708f8043a92f66e05525c9523a4225ad14fd33b9666c50cc560c43a13c4ee44e59dbc8583c85a82bdb370eff713ca491b136f049d6e33
- SSDEEP 768:U9yWoI48AT9oGCQJf3oJyOvWuaaDdAO1w+Jt/gFS3a3wu5SgR9nbcuyD7UHQRju:zO4VxrCQd3oJ1vWqDdXTJxgFiag27noe
- TLSH T18D13F11B71C1C1C8DACB52B0943FAD772434F8390628F525DBC129AFA456BE86B38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Detects suspicious XORed keyword - Mozilla/5.0 1 IoCs
resource yara_rule behavioral1/memory/1492-1-0x0000000008048000-0x0000000008064f80-memory.dmp SUSP_XORed_Mozilla - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for modification /dev/misc/watchdog faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for modification /sbin/watchdog faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 -
description ioc Process File opened for reading /proc/20/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/159/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/166/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/553/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/561/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1053/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/2/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/22/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/32/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/498/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1065/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1196/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/7/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/23/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/35/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/89/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/174/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/204/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1049/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1090/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/17/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/524/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/525/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/910/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/972/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1303/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1494/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/176/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1096/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/6/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/19/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/25/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/641/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/949/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/966/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1068/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/80/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/82/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/479/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1027/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/18/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/472/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/480/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/481/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1048/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1163/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/31/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/171/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/503/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/654/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/668/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1009/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1044/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/27/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/160/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/469/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/470/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/34/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/1091/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/81/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/168/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/321/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4 File opened for reading /proc/968/status faec9b98cdfbe3b6ae10e7d33ccda9c6f7ca0c6002e60111d1dc342083b06bd4