Analysis
- max time kernel
140s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/08/2026, 12:17
Behavioral task
behavioral1
Sample
lkxstress.i686
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target lkxstress.i686
- Size 57KB
- Sample260809-pf3aksem7s
- SHA256 63fab27fb5d2ad3c62f63892d93283957ba9772a85ce8c032140ce7e3c141921
- MD5 d0e4dd58154563a6c58317893c009b1d
- SHA1 404bb6b77b59493269a48fff3d972c97a9b61d7a
- SHA512 fd99707cac405f6e121fdc654b72861089e1488dd54344051de6dfcc6f1288ea76d214bb2ff5ddc32f0105da0525e1f3018d319380986189baa531cdb0003ed4
- SSDEEP 1536:WVJbbpeQapmHvgNlyzhS6W0lH5AjCkhudVuMpX2O3Jl+94AlyuA3kenouy8Hyd:MJb4LpmPMlyVW0lHOefdVuMpmO3q94sH
- TLSH T1494302298AD0412AF29EE23831CFB63A5910C257C4CD69A747F4D093DD21F29FE65787
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog lkxstress.i686 File opened for modification /dev/misc/watchdog lkxstress.i686 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /bin/watchdog lkxstress.i686 File opened for modification /sbin/watchdog lkxstress.i686 -
description ioc Process File opened for reading /proc/1061/status lkxstress.i686 File opened for reading /proc/1065/status lkxstress.i686 File opened for reading /proc/19/status lkxstress.i686 File opened for reading /proc/160/status lkxstress.i686 File opened for reading /proc/736/status lkxstress.i686 File opened for reading /proc/1101/status lkxstress.i686 File opened for reading /proc/1467/status lkxstress.i686 File opened for reading /proc/1492/status lkxstress.i686 File opened for reading /proc/1496/status lkxstress.i686 File opened for reading /proc/4/status lkxstress.i686 File opened for reading /proc/21/status lkxstress.i686 File opened for reading /proc/317/status lkxstress.i686 File opened for reading /proc/27/status lkxstress.i686 File opened for reading /proc/3/status lkxstress.i686 File opened for reading /proc/18/status lkxstress.i686 File opened for reading /proc/24/status lkxstress.i686 File opened for reading /proc/82/status lkxstress.i686 File opened for reading /proc/172/status lkxstress.i686 File opened for reading /proc/689/status lkxstress.i686 File opened for reading /proc/35/status lkxstress.i686 File opened for reading /proc/580/status lkxstress.i686 File opened for reading /proc/1180/status lkxstress.i686 File opened for reading /proc/173/status lkxstress.i686 File opened for reading /proc/174/status lkxstress.i686 File opened for reading /proc/429/status lkxstress.i686 File opened for reading /proc/1107/status lkxstress.i686 File opened for reading /proc/1162/status lkxstress.i686 File opened for reading /proc/115/status lkxstress.i686 File opened for reading /proc/1108/status lkxstress.i686 File opened for reading /proc/1497/status lkxstress.i686 File opened for reading /proc/2/status lkxstress.i686 File opened for reading /proc/622/status lkxstress.i686 File opened for reading /proc/924/status lkxstress.i686 File opened for reading /proc/1056/status lkxstress.i686 File opened for reading /proc/1083/status lkxstress.i686 File opened for reading /proc/161/status lkxstress.i686 File opened for reading /proc/170/status lkxstress.i686 File opened for reading /proc/464/status lkxstress.i686 File opened for reading /proc/477/status lkxstress.i686 File opened for reading /proc/919/status lkxstress.i686 File opened for reading /proc/960/status lkxstress.i686 File opened for reading /proc/16/status lkxstress.i686 File opened for reading /proc/137/status lkxstress.i686 File opened for reading /proc/670/status lkxstress.i686 File opened for reading /proc/883/status lkxstress.i686 File opened for reading /proc/1044/status lkxstress.i686 File opened for reading /proc/26/status lkxstress.i686 File opened for reading /proc/20/status lkxstress.i686 File opened for reading /proc/29/status lkxstress.i686 File opened for reading /proc/245/status lkxstress.i686 File opened for reading /proc/559/status lkxstress.i686 File opened for reading /proc/1036/status lkxstress.i686 File opened for reading /proc/1087/status lkxstress.i686 File opened for reading /proc/15/status lkxstress.i686 File opened for reading /proc/98/status lkxstress.i686 File opened for reading /proc/684/status lkxstress.i686 File opened for reading /proc/966/status lkxstress.i686 File opened for reading /proc/202/status lkxstress.i686 File opened for reading /proc/476/status lkxstress.i686 File opened for reading /proc/1105/status lkxstress.i686 File opened for reading /proc/1281/status lkxstress.i686 File opened for reading /proc/1359/status lkxstress.i686 File opened for reading /proc/1498/status lkxstress.i686 File opened for reading /proc/22/status lkxstress.i686