9613957243feee5856b463939fab394765d6c9d8231c6c96a8f81ff1fb8925e5

Analysis

max time kernel
145s
max time network
146s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08/08/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
i686.elf
Size 77KB
Sample260808-vky2lsvxay
SHA256 9613957243feee5856b463939fab394765d6c9d8231c6c96a8f81ff1fb8925e5
MD5 cbf9ee652b7aac613557d2fa8cb82b5e
SHA1 13fdd0fd1678d0375fa6390bb0587fe62c56e0f3
SHA512 da433fcad3d8086bbb45d15941f577a3f914e65a92a0d17ea1c8430ddf8568906cc59d8c3de72104de8fd6b23ff30a33f84d008068713d66c9e4e686aaf315d4
SSDEEP 1536:uVHQ0rPyMQn+JgVV/SGQ+Zsb3SfFWLIk1Q9j+Lxty4AH8:uVFrPNQn+WVQ3EyVUk29jgxO8
TLSH
T11D733B81F54B80F1D847487090BBF33FCE31D69541B5D66EEF699F36EA63202A60629C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	i686.elf
File opened for modification	/dev/watchdog	i686.elf

Changes its process name 1 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1483	i686.elf

/tmp/i686.elf
/tmp/i686.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:1483

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads