Analysis
- max time kernel
149s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/08/2026, 15:19
Behavioral task
behavioral1
Sample
2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin
- Size 48KB
- Sample260802-sqdxhsbh49
- SHA256 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb
- MD5 961a6fe27418917191e43304668041ac
- SHA1 d24ed10c98f8133a8d794354f1fd33b8ebd00d09
- SHA512 218b42c94c7e2d36a7d8c4e6616ed6698d705b42dfbca146cb524a534f8485b059f011eef5887d3a778a93b632498ca46863471424e98af182eca3d48f59d534
- SSDEEP 1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2i5e:Gv4QPfZfW5XTOeoEzJ7AQwf2i
- TLSH T1042309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for modification /dev/misc/watchdog 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for modification /bin/watchdog 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin -
description ioc Process File opened for reading /proc/484/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/609/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/920/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1324/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/550/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/990/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1039/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1048/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1328/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/453/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/949/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1073/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1182/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1266/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1536/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1584/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/425/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/579/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/734/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1020/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1044/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1056/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1570/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1596/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/445/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/690/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/742/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1086/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1112/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1564/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1620/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/450/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/474/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/669/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1070/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1092/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1107/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1117/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1549/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/473/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/485/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/578/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/628/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1069/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1211/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1538/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1558/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1011/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/449/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/487/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/672/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/930/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/987/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/996/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1361/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/555/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/670/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/993/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1097/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1262/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1511/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1590/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/1602/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin File opened for reading /proc/506/cmdline 2b171cf60ec05800b5dc97dddd5f71ecb85e7e750252eaf5de9dd38978fcdbeb.bin