Analysis
- max time kernel
148s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/08/2026, 06:19
Behavioral task
behavioral1
Sample
debug.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target debug.elf
- Size 113KB
- Sample260804-g3dlqsshka
- SHA256 b46ddd583aacf603b9521a361024cbda1e73353bbd04f2a60b5fd005c6deeee1
- MD5 6c70f490bfcd740922717db1aa56b365
- SHA1 344d2fb176359fd029e09a9ff1477140cd0d82af
- SHA512 df88eda075e809d9cf622825314e2356ff8d69b3b98b4252c9a5b11789f6e884a0cfc3a753f3658371bf6fd631bb7f0791648f5ad439a08f64648882e2adcce6
- SSDEEP 3072:LZMQCBJGnZW+I41MFlrKp0xrYNUJdBNoHxgQCtB3UJ:LZMQCG0+I418YpIZoHxgQCtB3UJ
- TLSH T132B35AC5E247D0F9DC5609302276FB375E76E1BB1229CA83D7F49A32AC12AC1D4167AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog debug.elf File opened for modification /dev/misc/watchdog debug.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog debug.elf File opened for modification /bin/watchdog debug.elf -
description ioc Process File opened for reading /proc/406/status debug.elf File opened for reading /proc/645/status debug.elf File opened for reading /proc/975/status debug.elf File opened for reading /proc/1011/status debug.elf File opened for reading /proc/1080/status debug.elf File opened for reading /proc/1127/status debug.elf File opened for reading /proc/1234/status debug.elf File opened for reading /proc/15/status debug.elf File opened for reading /proc/31/status debug.elf File opened for reading /proc/647/status debug.elf File opened for reading /proc/664/status debug.elf File opened for reading /proc/1305/status debug.elf File opened for reading /proc/166/status debug.elf File opened for reading /proc/35/status debug.elf File opened for reading /proc/13/status debug.elf File opened for reading /proc/480/status debug.elf File opened for reading /proc/1032/status debug.elf File opened for reading /proc/4/status debug.elf File opened for reading /proc/9/status debug.elf File opened for reading /proc/160/status debug.elf File opened for reading /proc/172/status debug.elf File opened for reading /proc/449/status debug.elf File opened for reading /proc/716/status debug.elf File opened for reading /proc/956/status debug.elf File opened for reading /proc/1058/status debug.elf File opened for reading /proc/3/status debug.elf File opened for reading /proc/5/status debug.elf File opened for reading /proc/17/status debug.elf File opened for reading /proc/89/status debug.elf File opened for reading /proc/177/status debug.elf File opened for reading /proc/1081/status debug.elf File opened for reading /proc/1290/status debug.elf File opened for reading /proc/161/status debug.elf File opened for reading /proc/582/status debug.elf File opened for reading /proc/865/status debug.elf File opened for reading /proc/1239/status debug.elf File opened for reading /proc/7/status debug.elf File opened for reading /proc/165/status debug.elf File opened for reading /proc/454/status debug.elf File opened for reading /proc/481/status debug.elf File opened for reading /proc/1326/status debug.elf File opened for reading /proc/1470/status debug.elf File opened for reading /proc/36/status debug.elf File opened for reading /proc/82/status debug.elf File opened for reading /proc/98/status debug.elf File opened for reading /proc/115/status debug.elf File opened for reading /proc/137/status debug.elf File opened for reading /proc/952/status debug.elf File opened for reading /proc/1084/status debug.elf File opened for reading /proc/24/status debug.elf File opened for reading /proc/78/status debug.elf File opened for reading /proc/175/status debug.elf File opened for reading /proc/269/status debug.elf File opened for reading /proc/440/status debug.elf File opened for reading /proc/1038/status debug.elf File opened for reading /proc/1471/status debug.elf File opened for reading /proc/80/status debug.elf File opened for reading /proc/159/status debug.elf File opened for reading /proc/2/status debug.elf File opened for reading /proc/16/status debug.elf File opened for reading /proc/29/status debug.elf File opened for reading /proc/998/status debug.elf File opened for reading /proc/1365/status debug.elf File opened for reading /proc/162/status debug.elf