Analysis
- max time kernel
139s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
10/08/2026, 10:15
General
- Target x86.elf
- Size 155KB
- Sample260810-mac3ds1vev
- SHA256 137bf467e6e97d3780f3f75b3c44c89c222c738cce38f4a0e69f42a440ba6fd9
Score
8/10
Malware Config
Signatures
- Contacts a large (928) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Outbound SSH connection to public host 2 TTPs 11 IoCs
SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
- Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Writes file to system bin folder 1 IoCs
- Changes its process name 1 IoCs
Processes
-
/tmp/x86.elf/tmp/x86.elf1⤵
- Modifies Watchdog functionality
- Writes file to system bin folder
- Changes its process name