Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
16/08/2026, 17:24
Behavioral task
behavioral1
Sample
debug.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target debug.elf
- Size 40KB
- Sample260816-vyvw4sshkc
- SHA256 f46e36db293f62f037e5442b11868018c2d82ee028b8c8b63cbf4bcad977fea3
- MD5 d247e05eca9386a2882a7bcacc1265ef
- SHA1 03b8200afcdf1daee8e0ce0cb7b74b5f3f2d7b63
- SHA512 db3c489edbaec0d248f4e82faf9a8cac06c50cb61946a8e7951ac53252d308effde56dd7e5678872c630585bde2fb57011c70b2b028b32d38d43141bea38ef36
- SSDEEP 768:vNxWle2mmbYB2Bue7CP0XsjAzhF5WoQcKZjlep8TnbcuyD7UHQRjm:leeGUhP0Xsm3pQcKlTnouy8HyC
- TLSH T19D13F176F5AB9B88F58ED03E88CE700D0806EF49A70A1D6A5ED597B1DC54B34B40CBE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
nagawar.xyz
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog debug.elf File opened for modification /dev/misc/watchdog debug.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog debug.elf File opened for modification /bin/watchdog debug.elf -
description ioc Process File opened for reading /proc/161/status debug.elf File opened for reading /proc/168/status debug.elf File opened for reading /proc/317/status debug.elf File opened for reading /proc/465/status debug.elf File opened for reading /proc/514/status debug.elf File opened for reading /proc/1054/status debug.elf File opened for reading /proc/1088/status debug.elf File opened for reading /proc/15/status debug.elf File opened for reading /proc/81/status debug.elf File opened for reading /proc/203/status debug.elf File opened for reading /proc/694/status debug.elf File opened for reading /proc/962/status debug.elf File opened for reading /proc/1029/status debug.elf File opened for reading /proc/1106/status debug.elf File opened for reading /proc/1496/status debug.elf File opened for reading /proc/20/status debug.elf File opened for reading /proc/26/status debug.elf File opened for reading /proc/80/status debug.elf File opened for reading /proc/165/status debug.elf File opened for reading /proc/476/status debug.elf File opened for reading /proc/10/status debug.elf File opened for reading /proc/14/status debug.elf File opened for reading /proc/25/status debug.elf File opened for reading /proc/115/status debug.elf File opened for reading /proc/492/status debug.elf File opened for reading /proc/504/status debug.elf File opened for reading /proc/982/status debug.elf File opened for reading /proc/1019/status debug.elf File opened for reading /proc/3/status debug.elf File opened for reading /proc/82/status debug.elf File opened for reading /proc/98/status debug.elf File opened for reading /proc/137/status debug.elf File opened for reading /proc/174/status debug.elf File opened for reading /proc/449/status debug.elf File opened for reading /proc/486/status debug.elf File opened for reading /proc/684/status debug.elf File opened for reading /proc/166/status debug.elf File opened for reading /proc/1256/status debug.elf File opened for reading /proc/1501/status debug.elf File opened for reading /proc/4/status debug.elf File opened for reading /proc/171/status debug.elf File opened for reading /proc/173/status debug.elf File opened for reading /proc/736/status debug.elf File opened for reading /proc/1046/status debug.elf File opened for reading /proc/1075/status debug.elf File opened for reading /proc/1295/status debug.elf File opened for reading /proc/1504/status debug.elf File opened for reading /proc/1112/status debug.elf File opened for reading /proc/89/status debug.elf File opened for reading /proc/259/status debug.elf File opened for reading /proc/495/status debug.elf File opened for reading /proc/1086/status debug.elf File opened for reading /proc/1115/status debug.elf File opened for reading /proc/164/status debug.elf File opened for reading /proc/491/status debug.elf File opened for reading /proc/515/status debug.elf File opened for reading /proc/615/status debug.elf File opened for reading /proc/926/status debug.elf File opened for reading /proc/1063/status debug.elf File opened for reading /proc/730/status debug.elf File opened for reading /proc/1010/status debug.elf File opened for reading /proc/1058/status debug.elf File opened for reading /proc/1085/status debug.elf File opened for reading /proc/1141/status debug.elf