Analysis
- max time kernel
145s - max time network
146s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
18/08/2026, 12:27
Behavioral task
behavioral1
Sample
Space.i686.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target Space.i686.elf
- Size 35KB
- Sample260818-pm36fstvbx
- SHA256 218ebbd553fac0ff81e56ef028ef9809071ea9ce0b202b05e5568397ad523d83
- MD5 d4fa81976c5a15e0aaf6cad849e5619e
- SHA1 d4c922a807e63d92aa928aee6819a6d437d6743c
- SHA512 675be01445ae7a9418fbb8279a77c174c40cc437a0437272880fbcf7b9c787c0eb12f00729e30853fbdb46e0975992ba5bd4a60d66219056e11169cc342c492f
- SSDEEP 768:6W/zEpEYEgHE+Tc0F/NVvsvrDN7yGjjtnjcPOggCZPRnbcuyD7UHQRjt:34B1E+Tc0FlVv4NWGjamBCBRnouy8Hyp
- TLSH T1F3F2E1078A748754E2EAB03808BE761E5A16762CED006099C7C4772778F4F2CB7756EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
C2
-
37.49.230.40
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.i686.elf File opened for modification /dev/misc/watchdog Space.i686.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.i686.elf File opened for modification /bin/watchdog Space.i686.elf -
description ioc Process File opened for reading /proc/1/status Space.i686.elf File opened for reading /proc/174/status Space.i686.elf File opened for reading /proc/178/status Space.i686.elf File opened for reading /proc/737/status Space.i686.elf File opened for reading /proc/1260/status Space.i686.elf File opened for reading /proc/1500/status Space.i686.elf File opened for reading /proc/14/status Space.i686.elf File opened for reading /proc/1032/status Space.i686.elf File opened for reading /proc/1093/status Space.i686.elf File opened for reading /proc/1153/status Space.i686.elf File opened for reading /proc/662/status Space.i686.elf File opened for reading /proc/972/status Space.i686.elf File opened for reading /proc/1172/status Space.i686.elf File opened for reading /proc/16/status Space.i686.elf File opened for reading /proc/82/status Space.i686.elf File opened for reading /proc/567/status Space.i686.elf File opened for reading /proc/586/status Space.i686.elf File opened for reading /proc/1075/status Space.i686.elf File opened for reading /proc/1203/status Space.i686.elf File opened for reading /proc/4/status Space.i686.elf File opened for reading /proc/115/status Space.i686.elf File opened for reading /proc/467/status Space.i686.elf File opened for reading /proc/486/status Space.i686.elf File opened for reading /proc/511/status Space.i686.elf File opened for reading /proc/1044/status Space.i686.elf File opened for reading /proc/1048/status Space.i686.elf File opened for reading /proc/1077/status Space.i686.elf File opened for reading /proc/86/status Space.i686.elf File opened for reading /proc/211/status Space.i686.elf File opened for reading /proc/551/status Space.i686.elf File opened for reading /proc/1205/status Space.i686.elf File opened for reading /proc/500/status Space.i686.elf File opened for reading /proc/505/status Space.i686.elf File opened for reading /proc/83/status Space.i686.elf File opened for reading /proc/27/status Space.i686.elf File opened for reading /proc/186/status Space.i686.elf File opened for reading /proc/471/status Space.i686.elf File opened for reading /proc/953/status Space.i686.elf File opened for reading /proc/1099/status Space.i686.elf File opened for reading /proc/15/status Space.i686.elf File opened for reading /proc/30/status Space.i686.elf File opened for reading /proc/84/status Space.i686.elf File opened for reading /proc/1018/status Space.i686.elf File opened for reading /proc/1056/status Space.i686.elf File opened for reading /proc/1081/status Space.i686.elf File opened for reading /proc/1171/status Space.i686.elf File opened for reading /proc/1312/status Space.i686.elf File opened for reading /proc/32/status Space.i686.elf File opened for reading /proc/959/status Space.i686.elf File opened for reading /proc/1065/status Space.i686.elf File opened for reading /proc/1097/status Space.i686.elf File opened for reading /proc/11/status Space.i686.elf File opened for reading /proc/26/status Space.i686.elf File opened for reading /proc/366/status Space.i686.elf File opened for reading /proc/614/status Space.i686.elf File opened for reading /proc/985/status Space.i686.elf File opened for reading /proc/1330/status Space.i686.elf File opened for reading /proc/9/status Space.i686.elf File opened for reading /proc/170/status Space.i686.elf File opened for reading /proc/576/status Space.i686.elf File opened for reading /proc/1489/status Space.i686.elf File opened for reading /proc/35/status Space.i686.elf File opened for reading /proc/1040/status Space.i686.elf File opened for reading /proc/1310/status Space.i686.elf