Analysis
- max time kernel
92s - max time network
152s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
08/08/2026, 12:26
Behavioral task
behavioral1
Sample
x86_64
Resource
ubuntu1804-amd64-20260513-en
4 signatures
150 seconds
General
- Target x86_64
- Size 130KB
- Sample260808-pmh6aade38
- SHA256 93808e10eac891a5957a61a82ae15922f76d809f58ebafe08f110667135123fb
- MD5 c9bfe42869ee30a4f7e618cf65559ccf
- SHA1 8fe6a653240fbaf3d47800e6a8bd8306856190cd
- SHA512 810b1bf234fc38d18a87e77e0c80493e8d1c4de86ea6fe488ea69f5ddf2089a2de1b6d1ef13bef60760a0164f2c538243f1fb9355e149fbc71ada2b1405cb699
- SSDEEP 3072:fqY9XWP/9KVhdphVwWlL9z37J6Q2H+NcemY3hHP7P6n6:iY9XthhVhXz3l6fHC1v3x7l
- TLSH T183D312BF558DFEE8CF2209B7DB560108991123A3D1156A3406C6F73D8C9EB9D27E1B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog x86_64 File opened for modification /dev/misc/watchdog x86_64 - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ck4rimeh2ru5 1485 x86_64 -
description ioc Process File opened for reading /proc/self/fd x86_64 File opened for reading /proc/self/exe x86_64