Analysis
- max time kernel
149s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/08/2026, 15:11
Behavioral task
behavioral1
Sample
bot.x86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
6 signatures
150 seconds
General
- Target bot.x86.elf
- Size 92KB
- Sample260809-skte1sba76
- SHA256 b3cece7e7c9dfc37c02752be98080efbabbb7fec651d20521d78fd71eadda289
- MD5 0bacf7a6f55953c655fe51371eaabcb0
- SHA1 00f47f2caf80c884803da27e65218d3b96113a17
- SHA512 937da207f41211acbabd113619084b1d5c6738ea2942e40d3925bbf6c0e3bdb05dea7e87e1d51784795642b503df2e594545dfa9f24cc837f02dc664de70f127
- SSDEEP 1536:+YAg7b3TX+5/PJJNQ1EvpJTBsch5FHXrUdn70ygJFi/YS/HD:++7DTXs/PJJtvpJTBlh5F3gnwyCA/pj
- TLSH T121936BC5D6C3F4F6FC020834307BAB715AB7EE7D2135DEA6E798A5326991242E10639C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 3 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog bot.x86.elf File opened for modification /dev/misc/watchdog bot.x86.elf File opened for modification /dev/Watchdog bot.x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /sbin/watchdog bot.x86.elf - Reads process memory 1 TTPs 49 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/724/maps bot.x86.elf File opened for reading /proc/899/maps bot.x86.elf File opened for reading /proc/923/maps bot.x86.elf File opened for reading /proc/962/maps bot.x86.elf File opened for reading /proc/441/maps bot.x86.elf File opened for reading /proc/451/maps bot.x86.elf File opened for reading /proc/481/maps bot.x86.elf File opened for reading /proc/547/maps bot.x86.elf File opened for reading /proc/564/maps bot.x86.elf File opened for reading /proc/578/maps bot.x86.elf File opened for reading /proc/659/maps bot.x86.elf File opened for reading /proc/717/maps bot.x86.elf File opened for reading /proc/433/maps bot.x86.elf File opened for reading /proc/534/maps bot.x86.elf File opened for reading /proc/906/maps bot.x86.elf File opened for reading /proc/966/maps bot.x86.elf File opened for reading /proc/986/maps bot.x86.elf File opened for reading /proc/442/maps bot.x86.elf File opened for reading /proc/446/maps bot.x86.elf File opened for reading /proc/474/maps bot.x86.elf File opened for reading /proc/602/maps bot.x86.elf File opened for reading /proc/604/maps bot.x86.elf File opened for reading /proc/658/maps bot.x86.elf File opened for reading /proc/554/maps bot.x86.elf File opened for reading /proc/942/maps bot.x86.elf File opened for reading /proc/948/maps bot.x86.elf File opened for reading /proc/968/maps bot.x86.elf File opened for reading /proc/990/maps bot.x86.elf File opened for reading /proc/463/maps bot.x86.elf File opened for reading /proc/476/maps bot.x86.elf File opened for reading /proc/498/maps bot.x86.elf File opened for reading /proc/638/maps bot.x86.elf File opened for reading /proc/909/maps bot.x86.elf File opened for reading /proc/971/maps bot.x86.elf File opened for reading /proc/426/maps bot.x86.elf File opened for reading /proc/473/maps bot.x86.elf File opened for reading /proc/537/maps bot.x86.elf File opened for reading /proc/699/maps bot.x86.elf File opened for reading /proc/901/maps bot.x86.elf File opened for reading /proc/928/maps bot.x86.elf File opened for reading /proc/976/maps bot.x86.elf File opened for reading /proc/999/maps bot.x86.elf File opened for reading /proc/430/maps bot.x86.elf File opened for reading /proc/440/maps bot.x86.elf File opened for reading /proc/450/maps bot.x86.elf File opened for reading /proc/477/maps bot.x86.elf File opened for reading /proc/655/maps bot.x86.elf File opened for reading /proc/661/maps bot.x86.elf File opened for reading /proc/666/maps bot.x86.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a 1488 bot.x86.elf -
description ioc Process File opened for reading /proc/1315/maps bot.x86.elf File opened for reading /proc/1492/maps bot.x86.elf File opened for reading /proc/1059/maps bot.x86.elf File opened for reading /proc/1080/maps bot.x86.elf File opened for reading /proc/1158/maps bot.x86.elf File opened for reading /proc/1489/maps bot.x86.elf File opened for reading /proc/1494/maps bot.x86.elf File opened for reading /proc/1501/maps bot.x86.elf File opened for reading /proc/1028/maps bot.x86.elf File opened for reading /proc/1091/maps bot.x86.elf File opened for reading /proc/1097/maps bot.x86.elf File opened for reading /proc/1459/maps bot.x86.elf File opened for reading /proc/1050/maps bot.x86.elf File opened for reading /proc/1068/maps bot.x86.elf File opened for reading /proc/1088/maps bot.x86.elf File opened for reading /proc/1017/maps bot.x86.elf File opened for reading /proc/1024/maps bot.x86.elf File opened for reading /proc/1032/maps bot.x86.elf File opened for reading /proc/1049/maps bot.x86.elf File opened for reading /proc/1054/maps bot.x86.elf File opened for reading /proc/1251/maps bot.x86.elf File opened for reading /proc/1256/maps bot.x86.elf File opened for reading /proc/1307/maps bot.x86.elf File opened for reading /proc/1036/maps bot.x86.elf File opened for reading /proc/1074/maps bot.x86.elf File opened for reading /proc/1196/maps bot.x86.elf File opened for reading /proc/1343/maps bot.x86.elf File opened for reading /proc/1484/maps bot.x86.elf File opened for reading /proc/1485/maps bot.x86.elf File opened for reading /proc/1486/maps bot.x86.elf File opened for reading /proc/1491/maps bot.x86.elf File opened for reading /proc/1057/maps bot.x86.elf File opened for reading /proc/1014/maps bot.x86.elf File opened for reading /proc/1071/maps bot.x86.elf File opened for reading /proc/1092/maps bot.x86.elf File opened for reading /proc/1093/maps bot.x86.elf File opened for reading /proc/1094/maps bot.x86.elf File opened for reading /proc/1132/maps bot.x86.elf File opened for reading /proc/1351/maps bot.x86.elf File opened for reading /proc/1492/exe bot.x86.elf File opened for reading /proc/1040/maps bot.x86.elf File opened for reading /proc/1069/maps bot.x86.elf File opened for reading /proc/1147/maps bot.x86.elf File opened for reading /proc/1178/maps bot.x86.elf File opened for reading /proc/1195/maps bot.x86.elf File opened for reading /proc/1322/maps bot.x86.elf File opened for reading /proc/1386/maps bot.x86.elf File opened for reading /proc/1045/maps bot.x86.elf File opened for reading /proc/1099/maps bot.x86.elf File opened for reading /proc/1165/maps bot.x86.elf File opened for reading /proc/1310/maps bot.x86.elf