Analysis
- max time kernel
143s - max time network
148s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
18/08/2026, 06:18
Behavioral task
behavioral1
Sample
x86_64nosl
Resource
ubuntu1804-amd64-20260513-en
3 signatures
150 seconds
General
- Target x86_64nosl
- Size 202KB
- Sample260818-g2rf7sfj41
- SHA256 be9d54109b23bf1ca1abfca12c64e00ab5aac1e48617931f0bc93840e05b145d
- MD5 bad104b0a907022dba93b064fb8f818b
- SHA1 e681c6d8eb5ec5d564226df361372ab9803c4a23
- SHA512 c8691a105ff76a0f601bc9635556a7c1799c88fd54af9004cc91239a17f726ad73800a7d8d55ce58a8887aa57fc7934302b12bfaeec371cf2b45e76c667944a0
- SSDEEP 3072:G+wyfortJ8WzCKbh8TBBrJfUAGYAQCznl9Y6vyA1vWzJUUug3vQ7obj:DwCortJvzCRVmfXv+OxNo
- TLSH T10F146C16B98080FFC496D1781BFEF43AE931B0AE5278725B27D4AF262D4DE615B2C740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog x86_64nosl File opened for modification /dev/watchdog x86_64nosl - Writes file to system bin folder 1 IoCs
description ioc Process File opened for modification /sbin/watchdog x86_64nosl - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself lk`ippclXPGG[ 1509 x86_64nosl