Analysis
- max time kernel
149s - max time network
148s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/08/2026, 01:29
Behavioral task
behavioral1
Sample
zero.x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target zero.x86_64.elf
- Size 58KB
- Sample260802-bwcszabl8x
- SHA256 28a16751269feab605a0df2ace7b0023cfc439947ce9b23ebda0675b88bd4dbd
- MD5 bd4e47f7394893dcf0f9c759e05a0b8d
- SHA1 e1e5588d55a9e47e80ee36280315f04ba093dc38
- SHA512 9d3aeb243f156a7607a3226b6bdd53daebd2d8d6c98d7883aa4c5357f6c5c390e2eb16ef292296e936509f360e08d3f4a76c73231f812ae9e09bc70e0e5a49d3
- SSDEEP 1536:G10HkpCfuso6bUkL+hSSsVaKCUrB864dxW:GN4Ho6TKZKNVtUW
- TLSH T13D43F2722466EBBCF72B6B7E5648B240C8371A32A51B2EEE54511167067FFE11C0CAD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog zero.x86_64.elf File opened for modification /dev/misc/watchdog zero.x86_64.elf - Traces itself 2 IoCs
Traces itself to prevent debugging attempts
pid Process 1481 zero.x86_64.elf 1482 zero.x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M$ & 1481 zero.x86_64.elf -
description ioc Process File opened for reading /proc/1605/exe zero.x86_64.elf File opened for reading /proc/1620/exe zero.x86_64.elf File opened for reading /proc/1724/exe zero.x86_64.elf File opened for reading /proc/1808/exe zero.x86_64.elf File opened for reading /proc/720/exe zero.x86_64.elf File opened for reading /proc/949/exe zero.x86_64.elf File opened for reading /proc/1489/exe zero.x86_64.elf File opened for reading /proc/1559/exe zero.x86_64.elf File opened for reading /proc/448/exe zero.x86_64.elf File opened for reading /proc/661/exe zero.x86_64.elf File opened for reading /proc/1479/exe zero.x86_64.elf File opened for reading /proc/1611/exe zero.x86_64.elf File opened for reading /proc/1769/exe zero.x86_64.elf File opened for reading /proc/900/exe zero.x86_64.elf File opened for reading /proc/902/exe zero.x86_64.elf File opened for reading /proc/924/exe zero.x86_64.elf File opened for reading /proc/1028/exe zero.x86_64.elf File opened for reading /proc/1793/exe zero.x86_64.elf File opened for reading /proc/1870/exe zero.x86_64.elf File opened for reading /proc/473/exe zero.x86_64.elf File opened for reading /proc/970/exe zero.x86_64.elf File opened for reading /proc/1577/exe zero.x86_64.elf File opened for reading /proc/1594/exe zero.x86_64.elf File opened for reading /proc/1822/exe zero.x86_64.elf File opened for reading /proc/550/exe zero.x86_64.elf File opened for reading /proc/1498/exe zero.x86_64.elf File opened for reading /proc/1562/exe zero.x86_64.elf File opened for reading /proc/1599/exe zero.x86_64.elf File opened for reading /proc/1792/exe zero.x86_64.elf File opened for reading /proc/1811/exe zero.x86_64.elf File opened for reading /proc/1483/exe zero.x86_64.elf File opened for reading /proc/963/exe zero.x86_64.elf File opened for reading /proc/1050/exe zero.x86_64.elf File opened for reading /proc/1512/exe zero.x86_64.elf File opened for reading /proc/1526/exe zero.x86_64.elf File opened for reading /proc/1801/exe zero.x86_64.elf File opened for reading /proc/1817/exe zero.x86_64.elf File opened for reading /proc/977/exe zero.x86_64.elf File opened for reading /proc/1140/exe zero.x86_64.elf File opened for reading /proc/1478/exe zero.x86_64.elf File opened for reading /proc/1519/exe zero.x86_64.elf File opened for reading /proc/1000/exe zero.x86_64.elf File opened for reading /proc/1040/exe zero.x86_64.elf File opened for reading /proc/1710/exe zero.x86_64.elf File opened for reading /proc/479/exe zero.x86_64.elf File opened for reading /proc/688/exe zero.x86_64.elf File opened for reading /proc/729/exe zero.x86_64.elf File opened for reading /proc/1059/exe zero.x86_64.elf File opened for reading /proc/1476/exe zero.x86_64.elf File opened for reading /proc/1499/exe zero.x86_64.elf File opened for reading /proc/1831/exe zero.x86_64.elf File opened for reading /proc/442/exe zero.x86_64.elf File opened for reading /proc/943/exe zero.x86_64.elf File opened for reading /proc/1247/exe zero.x86_64.elf File opened for reading /proc/436/exe zero.x86_64.elf File opened for reading /proc/564/exe zero.x86_64.elf File opened for reading /proc/659/exe zero.x86_64.elf File opened for reading /proc/1548/exe zero.x86_64.elf File opened for reading /proc/1592/exe zero.x86_64.elf File opened for reading /proc/1596/exe zero.x86_64.elf File opened for reading /proc/1804/exe zero.x86_64.elf File opened for reading /proc/1806/exe zero.x86_64.elf File opened for reading /proc/508/exe zero.x86_64.elf File opened for reading /proc/1015/exe zero.x86_64.elf