Analysis
- max time kernel
147s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/08/2026, 12:22
Behavioral task
behavioral1
Sample
nz.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target nz.x86
- Size 45KB
- Sample260819-pj7dpsfa46
- SHA256 86a98b0a9d3b4cba259ace302a120d0ed77561198f3e6a17b855f4ebd4bbbb50
- MD5 8c1753f1e623b2f86696ff8c977cc2ab
- SHA1 550fefb4ef0d83bb9ce864ae5550a2c0517f3a32
- SHA512 84170e9ca915c9fd66d22b79fde3fc8671c132f0c10a83f07ab6ceb2b0cafbb07c710131254fa6cc5ad8140aaa5a3af8aaf188028e70b3b8c098cd6e98ae0dfb
- SSDEEP 768:xW/211RfNpnT98qYlOuPzPbKSWRatqLs0HY41EFmpN1IpC7w/e6WEnbcuyD7UHQo:ffHNsOWbKSWRcqg0HY41EFIN1IpC7wvj
- TLSH T12523F1F9B2E7FBD4E8B6307C60EA751F5C6014AA6A084DD71ED0F06B44ACF953838061
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog nz.x86 File opened for modification /dev/misc/watchdog nz.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog nz.x86 File opened for modification /bin/watchdog nz.x86 -
description ioc Process File opened for reading /proc/521/status nz.x86 File opened for reading /proc/574/status nz.x86 File opened for reading /proc/649/status nz.x86 File opened for reading /proc/653/status nz.x86 File opened for reading /proc/164/status nz.x86 File opened for reading /proc/30/status nz.x86 File opened for reading /proc/170/status nz.x86 File opened for reading /proc/474/status nz.x86 File opened for reading /proc/682/status nz.x86 File opened for reading /proc/159/status nz.x86 File opened for reading /proc/5/status nz.x86 File opened for reading /proc/7/status nz.x86 File opened for reading /proc/9/status nz.x86 File opened for reading /proc/31/status nz.x86 File opened for reading /proc/948/status nz.x86 File opened for reading /proc/1023/status nz.x86 File opened for reading /proc/83/status nz.x86 File opened for reading /proc/965/status nz.x86 File opened for reading /proc/1064/status nz.x86 File opened for reading /proc/1065/status nz.x86 File opened for reading /proc/1073/status nz.x86 File opened for reading /proc/1247/status nz.x86 File opened for reading /proc/1335/status nz.x86 File opened for reading /proc/22/status nz.x86 File opened for reading /proc/168/status nz.x86 File opened for reading /proc/490/status nz.x86 File opened for reading /proc/1019/status nz.x86 File opened for reading /proc/1086/status nz.x86 File opened for reading /proc/1344/status nz.x86 File opened for reading /proc/1455/status nz.x86 File opened for reading /proc/1491/status nz.x86 File opened for reading /proc/21/status nz.x86 File opened for reading /proc/115/status nz.x86 File opened for reading /proc/162/status nz.x86 File opened for reading /proc/677/status nz.x86 File opened for reading /proc/1187/status nz.x86 File opened for reading /proc/1035/status nz.x86 File opened for reading /proc/1291/status nz.x86 File opened for reading /proc/13/status nz.x86 File opened for reading /proc/24/status nz.x86 File opened for reading /proc/175/status nz.x86 File opened for reading /proc/1051/status nz.x86 File opened for reading /proc/78/status nz.x86 File opened for reading /proc/89/status nz.x86 File opened for reading /proc/161/status nz.x86 File opened for reading /proc/171/status nz.x86 File opened for reading /proc/523/status nz.x86 File opened for reading /proc/611/status nz.x86 File opened for reading /proc/1080/status nz.x86 File opened for reading /proc/15/status nz.x86 File opened for reading /proc/160/status nz.x86 File opened for reading /proc/472/status nz.x86 File opened for reading /proc/707/status nz.x86 File opened for reading /proc/923/status nz.x86 File opened for reading /proc/1193/status nz.x86 File opened for reading /proc/1307/status nz.x86 File opened for reading /proc/1484/status nz.x86 File opened for reading /proc/8/status nz.x86 File opened for reading /proc/20/status nz.x86 File opened for reading /proc/81/status nz.x86 File opened for reading /proc/237/status nz.x86 File opened for reading /proc/909/status nz.x86 File opened for reading /proc/324/status nz.x86 File opened for reading /proc/447/status nz.x86