Analysis
- max time kernel
148s - max time network
152s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
19/08/2026, 12:22
Behavioral task
behavioral1
Sample
debug
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target debug
- Size 48KB
- Sample260819-pj7dpsfa49
- SHA256 c27cc06efd48dc2d6bcbe8153f5ee23574a85f0a87878f579929c50dcbd32f2a
- MD5 ed92fa567b1820caa2bb079ad15e4457
- SHA1 515da106246d358dc14f5e52dc0a40445ce044e1
- SHA512 f518c6f985c9ff04154117507488cb6e80756c2fb672e5f7157808c714c4d204428609273b8dcb1ebf46b151dd3dabbaca3897e2f392337960d74d74bd363d07
- SSDEEP 1536:XeYVOK59fwd7e4oh/cay+xmScjI792WmQe2Anouy8Hyh:XTfMdPohUB+xmA792WmTout6
- TLSH T15F23F1B7C5D3DA67C91EC13B6DED3A5D9604E112A94846BA98E1313BCB01315BE0CB8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
C2
-
s3o65awrf56.net
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog debug File opened for modification /dev/watchdog debug - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog debug File opened for modification /bin/watchdog debug -
description ioc Process File opened for reading /proc/21/status debug File opened for reading /proc/32/status debug File opened for reading /proc/278/status debug File opened for reading /proc/173/status debug File opened for reading /proc/17/status debug File opened for reading /proc/137/status debug File opened for reading /proc/731/status debug File opened for reading /proc/1172/status debug File opened for reading /proc/1362/status debug File opened for reading /proc/80/status debug File opened for reading /proc/81/status debug File opened for reading /proc/1169/status debug File opened for reading /proc/1499/status debug File opened for reading /proc/27/status debug File opened for reading /proc/29/status debug File opened for reading /proc/520/status debug File opened for reading /proc/1504/status debug File opened for reading /proc/18/status debug File opened for reading /proc/20/status debug File opened for reading /proc/82/status debug File opened for reading /proc/473/status debug File opened for reading /proc/1085/status debug File opened for reading /proc/1170/status debug File opened for reading /proc/1318/status debug File opened for reading /proc/3/status debug File opened for reading /proc/84/status debug File opened for reading /proc/86/status debug File opened for reading /proc/176/status debug File opened for reading /proc/180/status debug File opened for reading /proc/626/status debug File opened for reading /proc/735/status debug File opened for reading /proc/1096/status debug File opened for reading /proc/14/status debug File opened for reading /proc/177/status debug File opened for reading /proc/667/status debug File opened for reading /proc/1091/status debug File opened for reading /proc/1208/status debug File opened for reading /proc/78/status debug File opened for reading /proc/79/status debug File opened for reading /proc/272/status debug File opened for reading /proc/505/status debug File opened for reading /proc/668/status debug File opened for reading /proc/1067/status debug File opened for reading /proc/1189/status debug File opened for reading /proc/9/status debug File opened for reading /proc/34/status debug File opened for reading /proc/2/status debug File opened for reading /proc/35/status debug File opened for reading /proc/36/status debug File opened for reading /proc/451/status debug File opened for reading /proc/681/status debug File opened for reading /proc/928/status debug File opened for reading /proc/981/status debug File opened for reading /proc/31/status debug File opened for reading /proc/212/status debug File opened for reading /proc/680/status debug File opened for reading /proc/89/status debug File opened for reading /proc/468/status debug File opened for reading /proc/688/status debug File opened for reading /proc/995/status debug File opened for reading /proc/1028/status debug File opened for reading /proc/1108/status debug File opened for reading /proc/1274/status debug File opened for reading /proc/8/status debug