Analysis
- max time kernel
147s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/08/2026, 01:27
Behavioral task
behavioral1
Sample
nz.x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86_64.elf
- Size 48KB
- Sample260804-bt91pattct
- SHA256 5413190d593ced48661818bccc75ad1b7a582ec879e9d5980be9b0b0bc663379
- MD5 cfe41d324d5e1b5f249737eb83af4635
- SHA1 deeed8be44b05bebbcd581ea5febacd7b38d07a5
- SHA512 3576cb44829c407f6054e7f0a54ebd569a3ddefb1312436c479749519390211e30cc38695541e556cf8c9c47a87d4528e343533c6a25346e02fb3735f9f3e18d
- SSDEEP 1536:UEdq9MVZzeYHKsszoacRzf7+ANYahwpSA:FU9MVZzVsNKzf7PNYaFA
- TLSH T15A23F1FA4B3BAAB0C92693B11D7A1D41CBE2F90FD70A219F0A1AF6595C3A443DC13751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86_64.elf File opened for modification /dev/misc/watchdog nz.x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86_64.elf File opened for modification /bin/watchdog nz.x86_64.elf -
description ioc Process File opened for reading /proc/2/status nz.x86_64.elf File opened for reading /proc/8/status nz.x86_64.elf File opened for reading /proc/19/status nz.x86_64.elf File opened for reading /proc/577/status nz.x86_64.elf File opened for reading /proc/1296/status nz.x86_64.elf File opened for reading /proc/716/status nz.x86_64.elf File opened for reading /proc/22/status nz.x86_64.elf File opened for reading /proc/160/status nz.x86_64.elf File opened for reading /proc/165/status nz.x86_64.elf File opened for reading /proc/176/status nz.x86_64.elf File opened for reading /proc/1091/status nz.x86_64.elf File opened for reading /proc/1487/status nz.x86_64.elf File opened for reading /proc/12/status nz.x86_64.elf File opened for reading /proc/36/status nz.x86_64.elf File opened for reading /proc/430/status nz.x86_64.elf File opened for reading /proc/451/status nz.x86_64.elf File opened for reading /proc/473/status nz.x86_64.elf File opened for reading /proc/474/status nz.x86_64.elf File opened for reading /proc/1481/status nz.x86_64.elf File opened for reading /proc/1/status nz.x86_64.elf File opened for reading /proc/35/status nz.x86_64.elf File opened for reading /proc/471/status nz.x86_64.elf File opened for reading /proc/560/status nz.x86_64.elf File opened for reading /proc/963/status nz.x86_64.elf File opened for reading /proc/1040/status nz.x86_64.elf File opened for reading /proc/1049/status nz.x86_64.elf File opened for reading /proc/1078/status nz.x86_64.elf File opened for reading /proc/11/status nz.x86_64.elf File opened for reading /proc/24/status nz.x86_64.elf File opened for reading /proc/25/status nz.x86_64.elf File opened for reading /proc/27/status nz.x86_64.elf File opened for reading /proc/1095/status nz.x86_64.elf File opened for reading /proc/1128/status nz.x86_64.elf File opened for reading /proc/1327/status nz.x86_64.elf File opened for reading /proc/1489/status nz.x86_64.elf File opened for reading /proc/10/status nz.x86_64.elf File opened for reading /proc/16/status nz.x86_64.elf File opened for reading /proc/28/status nz.x86_64.elf File opened for reading /proc/270/status nz.x86_64.elf File opened for reading /proc/431/status nz.x86_64.elf File opened for reading /proc/660/status nz.x86_64.elf File opened for reading /proc/987/status nz.x86_64.elf File opened for reading /proc/86/status nz.x86_64.elf File opened for reading /proc/166/status nz.x86_64.elf File opened for reading /proc/173/status nz.x86_64.elf File opened for reading /proc/476/status nz.x86_64.elf File opened for reading /proc/1050/status nz.x86_64.elf File opened for reading /proc/1245/status nz.x86_64.elf File opened for reading /proc/1492/status nz.x86_64.elf File opened for reading /proc/29/status nz.x86_64.elf File opened for reading /proc/167/status nz.x86_64.elf File opened for reading /proc/168/status nz.x86_64.elf File opened for reading /proc/929/status nz.x86_64.elf File opened for reading /proc/973/status nz.x86_64.elf File opened for reading /proc/1073/status nz.x86_64.elf File opened for reading /proc/1343/status nz.x86_64.elf File opened for reading /proc/80/status nz.x86_64.elf File opened for reading /proc/175/status nz.x86_64.elf File opened for reading /proc/305/status nz.x86_64.elf File opened for reading /proc/1015/status nz.x86_64.elf File opened for reading /proc/1055/status nz.x86_64.elf File opened for reading /proc/1097/status nz.x86_64.elf File opened for reading /proc/1486/status nz.x86_64.elf File opened for reading /proc/907/status nz.x86_64.elf