Analysis
- max time kernel
130s - max time network
146s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/08/2026, 12:17
Behavioral task
behavioral1
Sample
lkxstress.x86_64
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target lkxstress.x86_64
- Size 68KB
- Sample260809-pf2daaem6z
- SHA256 be66c7df624bd1d76e62c3244369eae66e470eee6d2d75fdc12ad98456e22361
- MD5 9413239408fd3a6770399fc27cd33519
- SHA1 2b4165a10b34517729b49d8f2d8dad3211680b57
- SHA512 d94f9d4d187fb3e279fb36ee981ef2e6495d6301ccf8434887a3f89d24e198056e5bde6d746d134e01bad0a55da0dc8fe7df30355d8d9fdff9a145944d63b876
- SSDEEP 1536:l/EWSbgS9P503Gwynht9FGIeLi57UH7+jrXiIX7uQQLGRolDCp:l/EWYg4503G3LemWH7grSCqIOOp
- TLSH T1C06302C70F8A17FDF9C672B24DD53582F8605C31790EAE0241CAA7AECED813B4AB5651
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog lkxstress.x86_64 File opened for modification /dev/misc/watchdog lkxstress.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog lkxstress.x86_64 File opened for modification /bin/watchdog lkxstress.x86_64 -
description ioc Process File opened for reading /proc/1061/status lkxstress.x86_64 File opened for reading /proc/1109/status lkxstress.x86_64 File opened for reading /proc/1508/status lkxstress.x86_64 File opened for reading /proc/1/status lkxstress.x86_64 File opened for reading /proc/7/status lkxstress.x86_64 File opened for reading /proc/15/status lkxstress.x86_64 File opened for reading /proc/20/status lkxstress.x86_64 File opened for reading /proc/24/status lkxstress.x86_64 File opened for reading /proc/83/status lkxstress.x86_64 File opened for reading /proc/676/status lkxstress.x86_64 File opened for reading /proc/919/status lkxstress.x86_64 File opened for reading /proc/18/status lkxstress.x86_64 File opened for reading /proc/189/status lkxstress.x86_64 File opened for reading /proc/192/status lkxstress.x86_64 File opened for reading /proc/542/status lkxstress.x86_64 File opened for reading /proc/690/status lkxstress.x86_64 File opened for reading /proc/994/status lkxstress.x86_64 File opened for reading /proc/1065/status lkxstress.x86_64 File opened for reading /proc/1088/status lkxstress.x86_64 File opened for reading /proc/3/status lkxstress.x86_64 File opened for reading /proc/5/status lkxstress.x86_64 File opened for reading /proc/338/status lkxstress.x86_64 File opened for reading /proc/1039/status lkxstress.x86_64 File opened for reading /proc/1043/status lkxstress.x86_64 File opened for reading /proc/1097/status lkxstress.x86_64 File opened for reading /proc/1320/status lkxstress.x86_64 File opened for reading /proc/1514/status lkxstress.x86_64 File opened for reading /proc/36/status lkxstress.x86_64 File opened for reading /proc/623/status lkxstress.x86_64 File opened for reading /proc/916/status lkxstress.x86_64 File opened for reading /proc/1108/status lkxstress.x86_64 File opened for reading /proc/882/status lkxstress.x86_64 File opened for reading /proc/1282/status lkxstress.x86_64 File opened for reading /proc/1479/status lkxstress.x86_64 File opened for reading /proc/1513/status lkxstress.x86_64 File opened for reading /proc/29/status lkxstress.x86_64 File opened for reading /proc/177/status lkxstress.x86_64 File opened for reading /proc/179/status lkxstress.x86_64 File opened for reading /proc/911/status lkxstress.x86_64 File opened for reading /proc/187/status lkxstress.x86_64 File opened for reading /proc/460/status lkxstress.x86_64 File opened for reading /proc/1369/status lkxstress.x86_64 File opened for reading /proc/23/status lkxstress.x86_64 File opened for reading /proc/30/status lkxstress.x86_64 File opened for reading /proc/186/status lkxstress.x86_64 File opened for reading /proc/1344/status lkxstress.x86_64 File opened for reading /proc/31/status lkxstress.x86_64 File opened for reading /proc/82/status lkxstress.x86_64 File opened for reading /proc/594/status lkxstress.x86_64 File opened for reading /proc/704/status lkxstress.x86_64 File opened for reading /proc/25/status lkxstress.x86_64 File opened for reading /proc/181/status lkxstress.x86_64 File opened for reading /proc/221/status lkxstress.x86_64 File opened for reading /proc/938/status lkxstress.x86_64 File opened for reading /proc/1007/status lkxstress.x86_64 File opened for reading /proc/98/status lkxstress.x86_64 File opened for reading /proc/190/status lkxstress.x86_64 File opened for reading /proc/191/status lkxstress.x86_64 File opened for reading /proc/680/status lkxstress.x86_64 File opened for reading /proc/982/status lkxstress.x86_64 File opened for reading /proc/1515/status lkxstress.x86_64 File opened for reading /proc/11/status lkxstress.x86_64 File opened for reading /proc/32/status lkxstress.x86_64 File opened for reading /proc/79/status lkxstress.x86_64