Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/08/2026, 01:14
Behavioral task
behavioral1
Sample
nz.x86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target nz.x86.elf
- Size 105KB
- Sample260804-bltnqsae96
- SHA256 15e1643dc4b7fc906a73a77c4acbedd5c7dabfca19a2433d49e4ed75c73c624a
- MD5 69fd7c6757727b1ab54e083d5839fd65
- SHA1 0032386a210d103cb783ec2b276b8163e64e75c7
- SHA512 9a35679ca3ec54e2f17184ae4713ea4d782a699641a115dc581785a45d223180a03675a33a29478de4124804cd7e374fae48cfea2806c47d827e0c47168e669f
- SSDEEP 3072:JMUr0jtUFKGS2/aT2JX5XcdOpNfeRYAHELZLa:mPjtUnS2/a6fcgRAHELZLa
- TLSH T12CB34BC5E283D0F5EC160534203BFB3B9E72E5BB2129DA47D3B49EA26C56AC1C41579C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86.elf File opened for modification /dev/misc/watchdog nz.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86.elf File opened for modification /bin/watchdog nz.x86.elf -
description ioc Process File opened for reading /proc/36/status nz.x86.elf File opened for reading /proc/86/status nz.x86.elf File opened for reading /proc/115/status nz.x86.elf File opened for reading /proc/918/status nz.x86.elf File opened for reading /proc/1038/status nz.x86.elf File opened for reading /proc/1210/status nz.x86.elf File opened for reading /proc/1314/status nz.x86.elf File opened for reading /proc/1496/status nz.x86.elf File opened for reading /proc/437/status nz.x86.elf File opened for reading /proc/469/status nz.x86.elf File opened for reading /proc/483/status nz.x86.elf File opened for reading /proc/18/status nz.x86.elf File opened for reading /proc/20/status nz.x86.elf File opened for reading /proc/80/status nz.x86.elf File opened for reading /proc/320/status nz.x86.elf File opened for reading /proc/321/status nz.x86.elf File opened for reading /proc/3/status nz.x86.elf File opened for reading /proc/17/status nz.x86.elf File opened for reading /proc/169/status nz.x86.elf File opened for reading /proc/957/status nz.x86.elf File opened for reading /proc/977/status nz.x86.elf File opened for reading /proc/1021/status nz.x86.elf File opened for reading /proc/1099/status nz.x86.elf File opened for reading /proc/1497/status nz.x86.elf File opened for reading /proc/32/status nz.x86.elf File opened for reading /proc/165/status nz.x86.elf File opened for reading /proc/686/status nz.x86.elf File opened for reading /proc/1063/status nz.x86.elf File opened for reading /proc/6/status nz.x86.elf File opened for reading /proc/23/status nz.x86.elf File opened for reading /proc/158/status nz.x86.elf File opened for reading /proc/168/status nz.x86.elf File opened for reading /proc/201/status nz.x86.elf File opened for reading /proc/444/status nz.x86.elf File opened for reading /proc/487/status nz.x86.elf File opened for reading /proc/1060/status nz.x86.elf File opened for reading /proc/162/status nz.x86.elf File opened for reading /proc/441/status nz.x86.elf File opened for reading /proc/978/status nz.x86.elf File opened for reading /proc/997/status nz.x86.elf File opened for reading /proc/1056/status nz.x86.elf File opened for reading /proc/1137/status nz.x86.elf File opened for reading /proc/1198/status nz.x86.elf File opened for reading /proc/5/status nz.x86.elf File opened for reading /proc/29/status nz.x86.elf File opened for reading /proc/34/status nz.x86.elf File opened for reading /proc/176/status nz.x86.elf File opened for reading /proc/655/status nz.x86.elf File opened for reading /proc/1253/status nz.x86.elf File opened for reading /proc/24/status nz.x86.elf File opened for reading /proc/268/status nz.x86.elf File opened for reading /proc/504/status nz.x86.elf File opened for reading /proc/78/status nz.x86.elf File opened for reading /proc/137/status nz.x86.elf File opened for reading /proc/202/status nz.x86.elf File opened for reading /proc/669/status nz.x86.elf File opened for reading /proc/7/status nz.x86.elf File opened for reading /proc/8/status nz.x86.elf File opened for reading /proc/170/status nz.x86.elf File opened for reading /proc/611/status nz.x86.elf File opened for reading /proc/612/status nz.x86.elf File opened for reading /proc/1337/status nz.x86.elf File opened for reading /proc/1492/status nz.x86.elf File opened for reading /proc/26/status nz.x86.elf