Analysis
- max time kernel
149s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/08/2026, 00:43
Static task
static1
Behavioral task
behavioral1
Sample
zero.i486.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target zero.i486.elf
- Size 96KB
- Sample260802-a249qsba96
- SHA256 69e9c7d448f0171c34feb8af04e09d576ab33b105b4c57efbd72aada686401a0
- MD5 649defd344c72648a14a3c062e673927
- SHA1 86fa96ff0c97efc2f96872d0af29623b074c6403
- SHA512 95f1285ed5b43e69a2e9e8ad6651ccd6cb478341938dccb2204c4a75dbfacd7470c9e0734fa81c2f076812b5bfef1b50b7ac92f3e1a2ed796cb4fcf0c0eefdb7
- SSDEEP 3072:Uw5rY9IfnpLUuZY7rrrG4YHLJnlAcDeBbyKDOhdP:Uw5rY9IfnpLXY7rrr3YtBDNrP
- TLSH T1D8A32B1DD783E9F0C9420AB0115FBB379931C8E12230ADFBE7E47ED6A961781A456E1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog zero.i486.elf File opened for modification /dev/misc/watchdog zero.i486.elf - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 1479 zero.i486.elf 1480 zero.i486.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1479 zero.i486.elf -
description ioc Process File opened for reading /proc/484/exe zero.i486.elf File opened for reading /proc/663/exe zero.i486.elf File opened for reading /proc/1150/exe zero.i486.elf File opened for reading /proc/1164/exe zero.i486.elf File opened for reading /proc/1309/exe zero.i486.elf File opened for reading /proc/431/exe zero.i486.elf File opened for reading /proc/919/exe zero.i486.elf File opened for reading /proc/938/exe zero.i486.elf File opened for reading /proc/1676/exe zero.i486.elf File opened for reading /proc/971/exe zero.i486.elf File opened for reading /proc/543/exe zero.i486.elf File opened for reading /proc/1030/exe zero.i486.elf File opened for reading /proc/1695/exe zero.i486.elf File opened for reading /proc/412/exe zero.i486.elf File opened for reading /proc/492/exe zero.i486.elf File opened for reading /proc/560/exe zero.i486.elf File opened for reading /proc/902/exe zero.i486.elf File opened for reading /proc/1516/exe zero.i486.elf File opened for reading /proc/1518/exe zero.i486.elf File opened for reading /proc/1595/exe zero.i486.elf File opened for reading /proc/1605/exe zero.i486.elf File opened for reading /proc/482/exe zero.i486.elf File opened for reading /proc/1447/exe zero.i486.elf File opened for reading /proc/1610/exe zero.i486.elf File opened for reading /proc/1706/exe zero.i486.elf File opened for reading /proc/1481/exe zero.i486.elf File opened for reading /proc/652/exe zero.i486.elf File opened for reading /proc/602/exe zero.i486.elf File opened for reading /proc/1044/exe zero.i486.elf File opened for reading /proc/1573/exe zero.i486.elf File opened for reading /proc/1597/exe zero.i486.elf File opened for reading /proc/1618/exe zero.i486.elf File opened for reading /proc/430/exe zero.i486.elf File opened for reading /proc/1018/exe zero.i486.elf File opened for reading /proc/1641/exe zero.i486.elf File opened for reading /proc/961/exe zero.i486.elf File opened for reading /proc/1243/exe zero.i486.elf File opened for reading /proc/1512/exe zero.i486.elf File opened for reading /proc/1526/exe zero.i486.elf File opened for reading /proc/1599/exe zero.i486.elf File opened for reading /proc/479/exe zero.i486.elf File opened for reading /proc/648/exe zero.i486.elf File opened for reading /proc/722/exe zero.i486.elf File opened for reading /proc/1062/exe zero.i486.elf File opened for reading /proc/1371/exe zero.i486.elf File opened for reading /proc/1537/exe zero.i486.elf File opened for reading /proc/1623/exe zero.i486.elf File opened for reading /proc/895/exe zero.i486.elf File opened for reading /proc/1477/exe zero.i486.elf File opened for reading /proc/1561/exe zero.i486.elf File opened for reading /proc/472/exe zero.i486.elf File opened for reading /proc/1043/exe zero.i486.elf File opened for reading /proc/1093/exe zero.i486.elf File opened for reading /proc/1127/exe zero.i486.elf File opened for reading /proc/1248/exe zero.i486.elf File opened for reading /proc/905/exe zero.i486.elf File opened for reading /proc/1009/exe zero.i486.elf File opened for reading /proc/1074/exe zero.i486.elf File opened for reading /proc/1091/exe zero.i486.elf File opened for reading /proc/1185/exe zero.i486.elf File opened for reading /proc/1086/exe zero.i486.elf File opened for reading /proc/1523/exe zero.i486.elf File opened for reading /proc/464/exe zero.i486.elf File opened for reading /proc/1339/exe zero.i486.elf