Analysis
- max time kernel
149s - max time network
153s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/08/2026, 00:14
Behavioral task
behavioral1
Sample
nz.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86
- Size 45KB
- Sample260809-ajjkbaga32
- SHA256 86a98b0a9d3b4cba259ace302a120d0ed77561198f3e6a17b855f4ebd4bbbb50
- MD5 8c1753f1e623b2f86696ff8c977cc2ab
- SHA1 550fefb4ef0d83bb9ce864ae5550a2c0517f3a32
- SHA512 84170e9ca915c9fd66d22b79fde3fc8671c132f0c10a83f07ab6ceb2b0cafbb07c710131254fa6cc5ad8140aaa5a3af8aaf188028e70b3b8c098cd6e98ae0dfb
- SSDEEP 768:xW/211RfNpnT98qYlOuPzPbKSWRatqLs0HY41EFmpN1IpC7w/e6WEnbcuyD7UHQo:ffHNsOWbKSWRcqg0HY41EFIN1IpC7wvj
- TLSH T12523F1F9B2E7FBD4E8B6307C60EA751F5C6014AA6A084DD71ED0F06B44ACF953838061
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86 File opened for modification /dev/misc/watchdog nz.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog nz.x86 File opened for modification /sbin/watchdog nz.x86 -
description ioc Process File opened for reading /proc/457/status nz.x86 File opened for reading /proc/912/status nz.x86 File opened for reading /proc/984/status nz.x86 File opened for reading /proc/1036/status nz.x86 File opened for reading /proc/1093/status nz.x86 File opened for reading /proc/1509/status nz.x86 File opened for reading /proc/440/status nz.x86 File opened for reading /proc/1107/status nz.x86 File opened for reading /proc/270/status nz.x86 File opened for reading /proc/581/status nz.x86 File opened for reading /proc/989/status nz.x86 File opened for reading /proc/3/status nz.x86 File opened for reading /proc/32/status nz.x86 File opened for reading /proc/34/status nz.x86 File opened for reading /proc/173/status nz.x86 File opened for reading /proc/204/status nz.x86 File opened for reading /proc/653/status nz.x86 File opened for reading /proc/1153/status nz.x86 File opened for reading /proc/1271/status nz.x86 File opened for reading /proc/2/status nz.x86 File opened for reading /proc/29/status nz.x86 File opened for reading /proc/86/status nz.x86 File opened for reading /proc/1365/status nz.x86 File opened for reading /proc/19/status nz.x86 File opened for reading /proc/89/status nz.x86 File opened for reading /proc/166/status nz.x86 File opened for reading /proc/494/status nz.x86 File opened for reading /proc/534/status nz.x86 File opened for reading /proc/538/status nz.x86 File opened for reading /proc/1099/status nz.x86 File opened for reading /proc/27/status nz.x86 File opened for reading /proc/203/status nz.x86 File opened for reading /proc/481/status nz.x86 File opened for reading /proc/999/status nz.x86 File opened for reading /proc/1069/status nz.x86 File opened for reading /proc/1210/status nz.x86 File opened for reading /proc/165/status nz.x86 File opened for reading /proc/257/status nz.x86 File opened for reading /proc/10/status nz.x86 File opened for reading /proc/20/status nz.x86 File opened for reading /proc/98/status nz.x86 File opened for reading /proc/507/status nz.x86 File opened for reading /proc/645/status nz.x86 File opened for reading /proc/982/status nz.x86 File opened for reading /proc/1504/status nz.x86 File opened for reading /proc/9/status nz.x86 File opened for reading /proc/160/status nz.x86 File opened for reading /proc/176/status nz.x86 File opened for reading /proc/178/status nz.x86 File opened for reading /proc/961/status nz.x86 File opened for reading /proc/1029/status nz.x86 File opened for reading /proc/1061/status nz.x86 File opened for reading /proc/17/status nz.x86 File opened for reading /proc/172/status nz.x86 File opened for reading /proc/1003/status nz.x86 File opened for reading /proc/1078/status nz.x86 File opened for reading /proc/1336/status nz.x86 File opened for reading /proc/18/status nz.x86 File opened for reading /proc/24/status nz.x86 File opened for reading /proc/30/status nz.x86 File opened for reading /proc/36/status nz.x86 File opened for reading /proc/167/status nz.x86 File opened for reading /proc/549/status nz.x86 File opened for reading /proc/1057/status nz.x86