Analysis
- max time kernel
149s - max time network
144s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
11/08/2026, 12:24
Behavioral task
behavioral1
Sample
px86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target px86
- Size 34KB
- Sample260811-plbptayzhy
- SHA256 64ebf723abb8d3cf07df9d682d5342f93a6e69bc2245cdbb3c7b38003667ce43
- MD5 faea484ac292af8903b4fb41e8af5b7c
- SHA1 88951e26ec9c5df5be57d17b580ae086900988fb
- SHA512 a57660ab915b4dd25007dd20609cd4df925c6614ce8e380e1170213b845cac8385ee9afdd8913b931d426efdb6d1ecd329edd7fd44f04ac46d4393699bd0f1e7
- SSDEEP 768:CT7+FNO23RznmHhEJa2mkhjhCc6BmxKP/z9Tpf+tznbcuyD7UtQRjC:CTAIohmBKa2B9hnxsb9oVnouy8tyO
- TLSH T162F2E106E5FB0244E14C097C5EFFFC1A1C01E695D1D8C6E6D7A82129D34EB587A2A3EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
MIRAI
Signatures
- Deletes itself 1 IoCs
pid Process 1483 px86 - Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog px86 File opened for modification /dev/misc/watchdog px86 - Changes its process name 1 IoCs
description pid Process Changes the process name, possibly in an attempt to hide itself 1483 px86 -
description ioc Process File opened for reading /proc/26cmdline px86 File opened for reading /proc/30cmdline px86 File opened for reading /proc/1180cmdline px86 File opened for reading /proc/1239cmdline px86 File opened for reading /proc/596cmdline px86 File opened for reading /proc/161cmdline px86 File opened for reading /proc/165cmdline px86 File opened for reading /proc/1041cmdline px86 File opened for reading /proc/1373cmdline px86 File opened for reading /proc/1450cmdline px86 File opened for reading /proc/1485cmdline px86 File opened for reading /proc/166cmdline px86 File opened for reading /proc/36cmdline px86 File opened for reading /proc/84cmdline px86 File opened for reading /proc/115cmdline px86 File opened for reading /proc/257cmdline px86 File opened for reading /proc/317cmdline px86 File opened for reading /proc/82cmdline px86 File opened for reading /proc/160cmdline px86 File opened for reading /proc/167cmdline px86 File opened for reading /proc/270cmdline px86 File opened for reading /proc/423cmdline px86 File opened for reading /proc/901cmdline px86 File opened for reading /proc/14cmdline px86 File opened for reading /proc/86cmdline px86 File opened for reading /proc/324cmdline px86 File opened for reading /proc/13cmdline px86 File opened for reading /proc/164cmdline px86 File opened for reading /proc/34cmdline px86 File opened for reading /proc/169cmdline px86 File opened for reading /proc/465cmdline px86 File opened for reading /proc/532cmdline px86 File opened for reading /proc/957cmdline px86 File opened for reading /proc/1492cmdline px86 File opened for reading /proc/12cmdline px86 File opened for reading /proc/19cmdline px86 File opened for reading /proc/25cmdline px86 File opened for reading /proc/515cmdline px86 File opened for reading /proc/669cmdline px86 File opened for reading /proc/1072cmdline px86 File opened for reading /proc/1084cmdline px86 File opened for reading /proc/1299cmdline px86 File opened for reading /proc/24cmdline px86 File opened for reading /proc/168cmdline px86 File opened for reading /proc/636cmdline px86 File opened for reading /proc/714cmdline px86 File opened for reading /proc/20cmdline px86 File opened for reading /proc/79cmdline px86 File opened for reading /proc/204cmdline px86 File opened for reading /proc/551cmdline px86 File opened for reading /proc/1480cmdline px86 File opened for reading /proc/17cmdline px86 File opened for reading /proc/22cmdline px86 File opened for reading /proc/28cmdline px86 File opened for reading /proc/173cmdline px86 File opened for reading /proc/178cmdline px86 File opened for reading /proc/967cmdline px86 File opened for reading /proc/989cmdline px86 File opened for reading /proc/1011cmdline px86 File opened for reading /proc/2cmdline px86 File opened for reading /proc/98cmdline px86 File opened for reading /proc/514cmdline px86 File opened for reading /proc/597cmdline px86 File opened for reading /proc/1058cmdline px86