Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
15/08/2026, 12:24
Behavioral task
behavioral1
Sample
nz.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86
- Size 45KB
- Sample260815-plhhcsfh52
- SHA256 86a98b0a9d3b4cba259ace302a120d0ed77561198f3e6a17b855f4ebd4bbbb50
- MD5 8c1753f1e623b2f86696ff8c977cc2ab
- SHA1 550fefb4ef0d83bb9ce864ae5550a2c0517f3a32
- SHA512 84170e9ca915c9fd66d22b79fde3fc8671c132f0c10a83f07ab6ceb2b0cafbb07c710131254fa6cc5ad8140aaa5a3af8aaf188028e70b3b8c098cd6e98ae0dfb
- SSDEEP 768:xW/211RfNpnT98qYlOuPzPbKSWRatqLs0HY41EFmpN1IpC7w/e6WEnbcuyD7UHQo:ffHNsOWbKSWRcqg0HY41EFIN1IpC7wvj
- TLSH T12523F1F9B2E7FBD4E8B6307C60EA751F5C6014AA6A084DD71ED0F06B44ACF953838061
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86 File opened for modification /dev/misc/watchdog nz.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86 File opened for modification /bin/watchdog nz.x86 -
description ioc Process File opened for reading /proc/31/status nz.x86 File opened for reading /proc/176/status nz.x86 File opened for reading /proc/213/status nz.x86 File opened for reading /proc/1075/status nz.x86 File opened for reading /proc/1088/status nz.x86 File opened for reading /proc/943/status nz.x86 File opened for reading /proc/1259/status nz.x86 File opened for reading /proc/1488/status nz.x86 File opened for reading /proc/2/status nz.x86 File opened for reading /proc/6/status nz.x86 File opened for reading /proc/14/status nz.x86 File opened for reading /proc/30/status nz.x86 File opened for reading /proc/80/status nz.x86 File opened for reading /proc/98/status nz.x86 File opened for reading /proc/169/status nz.x86 File opened for reading /proc/188/status nz.x86 File opened for reading /proc/615/status nz.x86 File opened for reading /proc/651/status nz.x86 File opened for reading /proc/214/status nz.x86 File opened for reading /proc/454/status nz.x86 File opened for reading /proc/986/status nz.x86 File opened for reading /proc/1018/status nz.x86 File opened for reading /proc/1047/status nz.x86 File opened for reading /proc/1175/status nz.x86 File opened for reading /proc/16/status nz.x86 File opened for reading /proc/32/status nz.x86 File opened for reading /proc/84/status nz.x86 File opened for reading /proc/181/status nz.x86 File opened for reading /proc/182/status nz.x86 File opened for reading /proc/970/status nz.x86 File opened for reading /proc/1083/status nz.x86 File opened for reading /proc/1093/status nz.x86 File opened for reading /proc/137/status nz.x86 File opened for reading /proc/485/status nz.x86 File opened for reading /proc/962/status nz.x86 File opened for reading /proc/1052/status nz.x86 File opened for reading /proc/1062/status nz.x86 File opened for reading /proc/1071/status nz.x86 File opened for reading /proc/1147/status nz.x86 File opened for reading /proc/1348/status nz.x86 File opened for reading /proc/929/status nz.x86 File opened for reading /proc/25/status nz.x86 File opened for reading /proc/447/status nz.x86 File opened for reading /proc/472/status nz.x86 File opened for reading /proc/538/status nz.x86 File opened for reading /proc/614/status nz.x86 File opened for reading /proc/1319/status nz.x86 File opened for reading /proc/3/status nz.x86 File opened for reading /proc/546/status nz.x86 File opened for reading /proc/1043/status nz.x86 File opened for reading /proc/1193/status nz.x86 File opened for reading /proc/29/status nz.x86 File opened for reading /proc/184/status nz.x86 File opened for reading /proc/714/status nz.x86 File opened for reading /proc/1298/status nz.x86 File opened for reading /proc/1494/status nz.x86 File opened for reading /proc/468/status nz.x86 File opened for reading /proc/900/status nz.x86 File opened for reading /proc/185/status nz.x86 File opened for reading /proc/493/status nz.x86 File opened for reading /proc/575/status nz.x86 File opened for reading /proc/1009/status nz.x86 File opened for reading /proc/24/status nz.x86 File opened for reading /proc/34/status nz.x86