Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/08/2026, 00:07
Behavioral task
behavioral1
Sample
nz.x86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target nz.x86.elf
- Size 105KB
- Sample260803-aejdray1cx
- SHA256 312fbbedbe184110665f336846fff7a36d2c211b484e87fd7f57962267bbd66c
- MD5 8e9cafeb7276fc942635606fc770ada1
- SHA1 0974de6ef4f4536349ce31415975e6f63486625e
- SHA512 87045af12126faf764da03c19acdcc3bcef97646fd2507e7bd32e83266c6f84c8022fd81d4856fcf58aa4fb7cff26bc1028b534d7affd3564ca5e45abd07627e
- SSDEEP 3072:/Wd7t7hm8ba3D2RI+DB2M5Jfebx/SHhA9:/Wd7tE8ba3q1B3GJSHhA9
- TLSH T110B33AC4E243D0F9EC160534213BFB379A73E5BF212DDA43D3A49AA26C96AC1D41679C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86.elf File opened for modification /dev/misc/watchdog nz.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86.elf File opened for modification /bin/watchdog nz.x86.elf -
description ioc Process File opened for reading /proc/456/status nz.x86.elf File opened for reading /proc/504/status nz.x86.elf File opened for reading /proc/673/status nz.x86.elf File opened for reading /proc/11/status nz.x86.elf File opened for reading /proc/19/status nz.x86.elf File opened for reading /proc/34/status nz.x86.elf File opened for reading /proc/674/status nz.x86.elf File opened for reading /proc/676/status nz.x86.elf File opened for reading /proc/952/status nz.x86.elf File opened for reading /proc/1039/status nz.x86.elf File opened for reading /proc/1089/status nz.x86.elf File opened for reading /proc/502/status nz.x86.elf File opened for reading /proc/690/status nz.x86.elf File opened for reading /proc/971/status nz.x86.elf File opened for reading /proc/1027/status nz.x86.elf File opened for reading /proc/1043/status nz.x86.elf File opened for reading /proc/1216/status nz.x86.elf File opened for reading /proc/1282/status nz.x86.elf File opened for reading /proc/1509/status nz.x86.elf File opened for reading /proc/115/status nz.x86.elf File opened for reading /proc/1110/status nz.x86.elf File opened for reading /proc/1510/status nz.x86.elf File opened for reading /proc/882/status nz.x86.elf File opened for reading /proc/1086/status nz.x86.elf File opened for reading /proc/1178/status nz.x86.elf File opened for reading /proc/17/status nz.x86.elf File opened for reading /proc/177/status nz.x86.elf File opened for reading /proc/189/status nz.x86.elf File opened for reading /proc/998/status nz.x86.elf File opened for reading /proc/1109/status nz.x86.elf File opened for reading /proc/1508/status nz.x86.elf File opened for reading /proc/695/status nz.x86.elf File opened for reading /proc/1320/status nz.x86.elf File opened for reading /proc/2/status nz.x86.elf File opened for reading /proc/27/status nz.x86.elf File opened for reading /proc/187/status nz.x86.elf File opened for reading /proc/1052/status nz.x86.elf File opened for reading /proc/28/status nz.x86.elf File opened for reading /proc/79/status nz.x86.elf File opened for reading /proc/183/status nz.x86.elf File opened for reading /proc/184/status nz.x86.elf File opened for reading /proc/724/status nz.x86.elf File opened for reading /proc/1047/status nz.x86.elf File opened for reading /proc/1097/status nz.x86.elf File opened for reading /proc/1514/status nz.x86.elf File opened for reading /proc/22/status nz.x86.elf File opened for reading /proc/83/status nz.x86.elf File opened for reading /proc/221/status nz.x86.elf File opened for reading /proc/222/status nz.x86.elf File opened for reading /proc/434/status nz.x86.elf File opened for reading /proc/982/status nz.x86.elf File opened for reading /proc/1275/status nz.x86.elf File opened for reading /proc/6/status nz.x86.elf File opened for reading /proc/35/status nz.x86.elf File opened for reading /proc/188/status nz.x86.elf File opened for reading /proc/919/status nz.x86.elf File opened for reading /proc/1171/status nz.x86.elf File opened for reading /proc/1197/status nz.x86.elf File opened for reading /proc/1512/status nz.x86.elf File opened for reading /proc/182/status nz.x86.elf File opened for reading /proc/933/status nz.x86.elf File opened for reading /proc/958/status nz.x86.elf File opened for reading /proc/1065/status nz.x86.elf File opened for reading /proc/1080/status nz.x86.elf