Analysis
- max time kernel
149s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/08/2026, 15:19
Behavioral task
behavioral1
Sample
5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin
- Size 48KB
- Sample260802-sqd8aabh52
- SHA256 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb
- MD5 d28550aae3872bfee618bafe6a7cdf69
- SHA1 5a0f71042bcc7dd257898525949b071c19c2b549
- SHA512 f73242f0c6b3bd76b7e028f060a16efc10fcfd1ab24b76b178687ced0b0591cbb00863f9a396c91dcfd476125b8800aa8f32daba6c0e91244fe465b64996461a
- SSDEEP 1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2i8e:Gv4QPfZfW5XTOeoEzJ7AQwf2i
- TLSH T1942309C8F443D9F9DC4A09746036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for modification /dev/misc/watchdog 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for modification /bin/watchdog 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin -
description ioc Process File opened for reading /proc/1093/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1110/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1346/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/464/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/469/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/498/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1089/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1098/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1279/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1501/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1594/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1005/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/440/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/465/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/503/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/541/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/626/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/684/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/741/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/988/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1018/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1033/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/457/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/597/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/699/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/926/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/985/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/545/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/551/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/625/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/962/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1185/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1218/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1497/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1532/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/667/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/728/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/929/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/968/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1063/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1086/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1111/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1322/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1058/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1104/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1334/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1403/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1502/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1540/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1576/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/989/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1009/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1113/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1472/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1552/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1582/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/471/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/981/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1364/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1371/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/466/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/689/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/995/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin File opened for reading /proc/1046/cmdline 5ca15d97592bfbfbddc200f9eae28c8f292fd8662a857d672825a9f20053adcb.bin