Analysis
- max time kernel
147s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/08/2026, 06:14
Behavioral task
behavioral1
Sample
nz.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86
- Size 45KB
- Sample260809-gzedvssbmc
- SHA256 86a98b0a9d3b4cba259ace302a120d0ed77561198f3e6a17b855f4ebd4bbbb50
- MD5 8c1753f1e623b2f86696ff8c977cc2ab
- SHA1 550fefb4ef0d83bb9ce864ae5550a2c0517f3a32
- SHA512 84170e9ca915c9fd66d22b79fde3fc8671c132f0c10a83f07ab6ceb2b0cafbb07c710131254fa6cc5ad8140aaa5a3af8aaf188028e70b3b8c098cd6e98ae0dfb
- SSDEEP 768:xW/211RfNpnT98qYlOuPzPbKSWRatqLs0HY41EFmpN1IpC7w/e6WEnbcuyD7UHQo:ffHNsOWbKSWRcqg0HY41EFIN1IpC7wvj
- TLSH T12523F1F9B2E7FBD4E8B6307C60EA751F5C6014AA6A084DD71ED0F06B44ACF953838061
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86 File opened for modification /dev/misc/watchdog nz.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86 File opened for modification /bin/watchdog nz.x86 -
description ioc Process File opened for reading /proc/12/status nz.x86 File opened for reading /proc/23/status nz.x86 File opened for reading /proc/86/status nz.x86 File opened for reading /proc/423/status nz.x86 File opened for reading /proc/493/status nz.x86 File opened for reading /proc/1064/status nz.x86 File opened for reading /proc/529/status nz.x86 File opened for reading /proc/1174/status nz.x86 File opened for reading /proc/36/status nz.x86 File opened for reading /proc/83/status nz.x86 File opened for reading /proc/654/status nz.x86 File opened for reading /proc/664/status nz.x86 File opened for reading /proc/1488/status nz.x86 File opened for reading /proc/676/status nz.x86 File opened for reading /proc/730/status nz.x86 File opened for reading /proc/15/status nz.x86 File opened for reading /proc/32/status nz.x86 File opened for reading /proc/82/status nz.x86 File opened for reading /proc/167/status nz.x86 File opened for reading /proc/1061/status nz.x86 File opened for reading /proc/608/status nz.x86 File opened for reading /proc/17/status nz.x86 File opened for reading /proc/25/status nz.x86 File opened for reading /proc/3/status nz.x86 File opened for reading /proc/5/status nz.x86 File opened for reading /proc/35/status nz.x86 File opened for reading /proc/168/status nz.x86 File opened for reading /proc/1074/status nz.x86 File opened for reading /proc/19/status nz.x86 File opened for reading /proc/30/status nz.x86 File opened for reading /proc/98/status nz.x86 File opened for reading /proc/170/status nz.x86 File opened for reading /proc/998/status nz.x86 File opened for reading /proc/1096/status nz.x86 File opened for reading /proc/1099/status nz.x86 File opened for reading /proc/1168/status nz.x86 File opened for reading /proc/10/status nz.x86 File opened for reading /proc/508/status nz.x86 File opened for reading /proc/1489/status nz.x86 File opened for reading /proc/161/status nz.x86 File opened for reading /proc/165/status nz.x86 File opened for reading /proc/200/status nz.x86 File opened for reading /proc/1075/status nz.x86 File opened for reading /proc/1312/status nz.x86 File opened for reading /proc/21/status nz.x86 File opened for reading /proc/27/status nz.x86 File opened for reading /proc/717/status nz.x86 File opened for reading /proc/915/status nz.x86 File opened for reading /proc/1048/status nz.x86 File opened for reading /proc/1100/status nz.x86 File opened for reading /proc/412/status nz.x86 File opened for reading /proc/531/status nz.x86 File opened for reading /proc/568/status nz.x86 File opened for reading /proc/1307/status nz.x86 File opened for reading /proc/1494/status nz.x86 File opened for reading /proc/28/status nz.x86 File opened for reading /proc/657/status nz.x86 File opened for reading /proc/1025/status nz.x86 File opened for reading /proc/20/status nz.x86 File opened for reading /proc/166/status nz.x86 File opened for reading /proc/240/status nz.x86 File opened for reading /proc/475/status nz.x86 File opened for reading /proc/1032/status nz.x86 File opened for reading /proc/1338/status nz.x86