Analysis
- max time kernel
149s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/08/2026, 17:17
Behavioral task
behavioral1
Sample
5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin
- Size 48KB
- Sample260809-vtp53avzfx
- SHA256 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f
- MD5 7a02be54bd5dd4a0c391c2b04d38e610
- SHA1 1107cf4f526b3f5412b7671f9eb88e979fb20cdb
- SHA512 592cf3c4f6d8bd3db03777e4bdbba06297e25456762ffc319cbcb9f4a185460337a19f9f217f9d6be9ba5a13af02ccee790dc244f36ca9aaa964e64f6530ddf3
- SSDEEP 1536:6nJRT4QPfZfW5XTOeY3Dve3AG+1pa/4Qw7bn2iRNe:Gv4QPfZfW5XTOeoEzG0AQwf2i
- TLSH T1B62308C8E443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for modification /dev/watchdog 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for modification /bin/watchdog 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin -
description ioc Process File opened for reading /proc/508/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/924/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/929/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1028/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1040/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1059/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1085/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1173/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/659/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1057/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1092/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1099/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1336/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1375/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1525/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1543/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/449/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/531/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/672/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1054/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1519/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1537/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1549/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1579/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/438/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/476/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/720/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1000/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1069/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1192/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1254/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1307/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/435/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/479/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1032/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1045/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1049/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1072/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1080/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1190/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/556/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1015/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1140/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1449/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1473/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1477/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1489/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1531/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/474/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/550/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/907/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/991/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1050/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1066/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1094/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1156/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/900/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/967/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1317/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1496/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/688/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/972/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1089/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin File opened for reading /proc/1093/cmdline 5e3a9353373c1543fe915037f1fda7a7034b0e34f3a7554b87b6ec937ac6159f.bin