Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
03/08/2026, 01:19
Behavioral task
behavioral1
Sample
nz.i686.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target nz.i686.elf
- Size 117KB
- Sample260803-bpptyswaqa
- SHA256 7229420792cf2ed0803b978655c0afc86e543f5343d73af490c097db9e021fbc
- MD5 fba46ccd1790d7462954eafe7bfad008
- SHA1 b1b2a4c52f611bfb014dccfba764b889e9023ab7
- SHA512 599ddf78d3180250f1057b8c49160d73ae7bea8dfeba55e4f6afbae8210fdaf9ab1daa5190e234b4673b4d10889ed250442c27a40045ac48e32fb43f4616e982
- SSDEEP 3072:6ncCIGcJvNoHW8/ySBV/tI6QyK4BUlsWrhKHHT:UIGcJvyHh6SH/tf1K9wHHT
- TLSH T17DC32AC0F98B81F6C40B88305166F63FDF3199A85163DA9DEF999F72DA73981912234C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.i686.elf File opened for modification /dev/misc/watchdog nz.i686.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.i686.elf File opened for modification /bin/watchdog nz.i686.elf -
description ioc Process File opened for reading /proc/18/status nz.i686.elf File opened for reading /proc/98/status nz.i686.elf File opened for reading /proc/178/status nz.i686.elf File opened for reading /proc/270/status nz.i686.elf File opened for reading /proc/1091/status nz.i686.elf File opened for reading /proc/1100/status nz.i686.elf File opened for reading /proc/1485/status nz.i686.elf File opened for reading /proc/16/status nz.i686.elf File opened for reading /proc/34/status nz.i686.elf File opened for reading /proc/166/status nz.i686.elf File opened for reading /proc/1027/status nz.i686.elf File opened for reading /proc/1303/status nz.i686.elf File opened for reading /proc/1334/status nz.i686.elf File opened for reading /proc/1490/status nz.i686.elf File opened for reading /proc/13/status nz.i686.elf File opened for reading /proc/159/status nz.i686.elf File opened for reading /proc/424/status nz.i686.elf File opened for reading /proc/969/status nz.i686.elf File opened for reading /proc/1058/status nz.i686.elf File opened for reading /proc/1197/status nz.i686.elf File opened for reading /proc/163/status nz.i686.elf File opened for reading /proc/416/status nz.i686.elf File opened for reading /proc/9/status nz.i686.elf File opened for reading /proc/436/status nz.i686.elf File opened for reading /proc/658/status nz.i686.elf File opened for reading /proc/962/status nz.i686.elf File opened for reading /proc/4/status nz.i686.elf File opened for reading /proc/22/status nz.i686.elf File opened for reading /proc/31/status nz.i686.elf File opened for reading /proc/245/status nz.i686.elf File opened for reading /proc/901/status nz.i686.elf File opened for reading /proc/1035/status nz.i686.elf File opened for reading /proc/1053/status nz.i686.elf File opened for reading /proc/15/status nz.i686.elf File opened for reading /proc/415/status nz.i686.elf File opened for reading /proc/528/status nz.i686.elf File opened for reading /proc/699/status nz.i686.elf File opened for reading /proc/999/status nz.i686.elf File opened for reading /proc/1133/status nz.i686.elf File opened for reading /proc/170/status nz.i686.elf File opened for reading /proc/175/status nz.i686.elf File opened for reading /proc/976/status nz.i686.elf File opened for reading /proc/1068/status nz.i686.elf File opened for reading /proc/906/status nz.i686.elf File opened for reading /proc/78/status nz.i686.elf File opened for reading /proc/417/status nz.i686.elf File opened for reading /proc/497/status nz.i686.elf File opened for reading /proc/506/status nz.i686.elf File opened for reading /proc/1039/status nz.i686.elf File opened for reading /proc/1158/status nz.i686.elf File opened for reading /proc/1486/status nz.i686.elf File opened for reading /proc/2/status nz.i686.elf File opened for reading /proc/7/status nz.i686.elf File opened for reading /proc/173/status nz.i686.elf File opened for reading /proc/317/status nz.i686.elf File opened for reading /proc/602/status nz.i686.elf File opened for reading /proc/1031/status nz.i686.elf File opened for reading /proc/1074/status nz.i686.elf File opened for reading /proc/1302/status nz.i686.elf File opened for reading /proc/14/status nz.i686.elf File opened for reading /proc/11/status nz.i686.elf File opened for reading /proc/24/status nz.i686.elf File opened for reading /proc/164/status nz.i686.elf File opened for reading /proc/165/status nz.i686.elf