Analysis
- max time kernel
149s - max time network
152s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/08/2026, 18:13
Behavioral task
behavioral1
Sample
x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target x86
- Size 34KB
- Sample260822-wt38csar2x
- SHA256 7b0fec9dc952de2ff789094282c1d2c5071cb3ac68a52bc9537842b85bd89daf
- MD5 7e4aaaf9dc9eeddeb8c0ff4addf5ac7d
- SHA1 45ac50c11b83aae5d15464a38549df3453216506
- SHA512 91ef34e30f4c1afa12db563cc7e44e43683c173dbf64fcadf70b632862f3c6de4812e075da9c5a6d1fc8635453cb2f745620bdfd1462c63d2cbf249f31cb4482
- SSDEEP 768:gzbGjwng3vdOhxV/Whew0IAls1SeGhRLN1Hv8bZqqPaOjLKnbcuyD7UHQRjw:gdnAzhe3rs2hRLbHv8bZPaOCnouy8HyM
- TLSH T1F4F2E0079284A39AF16D963E18FEBE8D1711E21DEF49602AFEF85037B854F0C5369742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
C2
-
77.239.124.123
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog x86 File opened for modification /dev/misc/watchdog x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog x86 File opened for modification /bin/watchdog x86 -
description ioc Process File opened for reading /proc/429/status x86 File opened for reading /proc/725/status x86 File opened for reading /proc/1467/status x86 File opened for reading /proc/1498/status x86 File opened for reading /proc/22/status x86 File opened for reading /proc/157/status x86 File opened for reading /proc/511/status x86 File opened for reading /proc/946/status x86 File opened for reading /proc/1359/status x86 File opened for reading /proc/169/status x86 File opened for reading /proc/966/status x86 File opened for reading /proc/1003/status x86 File opened for reading /proc/1036/status x86 File opened for reading /proc/1222/status x86 File opened for reading /proc/160/status x86 File opened for reading /proc/11/status x86 File opened for reading /proc/17/status x86 File opened for reading /proc/21/status x86 File opened for reading /proc/464/status x86 File opened for reading /proc/476/status x86 File opened for reading /proc/589/status x86 File opened for reading /proc/1087/status x86 File opened for reading /proc/79/status x86 File opened for reading /proc/513/status x86 File opened for reading /proc/1180/status x86 File opened for reading /proc/1505/status x86 File opened for reading /proc/83/status x86 File opened for reading /proc/960/status x86 File opened for reading /proc/1181/status x86 File opened for reading /proc/15/status x86 File opened for reading /proc/26/status x86 File opened for reading /proc/505/status x86 File opened for reading /proc/674/status x86 File opened for reading /proc/1093/status x86 File opened for reading /proc/1497/status x86 File opened for reading /proc/684/status x86 File opened for reading /proc/313/status x86 File opened for reading /proc/34/status x86 File opened for reading /proc/78/status x86 File opened for reading /proc/89/status x86 File opened for reading /proc/1016/status x86 File opened for reading /proc/1105/status x86 File opened for reading /proc/1209/status x86 File opened for reading /proc/1492/status x86 File opened for reading /proc/1/status x86 File opened for reading /proc/558/status x86 File opened for reading /proc/706/status x86 File opened for reading /proc/1107/status x86 File opened for reading /proc/1281/status x86 File opened for reading /proc/1396/status x86 File opened for reading /proc/1502/status x86 File opened for reading /proc/27/status x86 File opened for reading /proc/168/status x86 File opened for reading /proc/173/status x86 File opened for reading /proc/174/status x86 File opened for reading /proc/472/status x86 File opened for reading /proc/941/status x86 File opened for reading /proc/1048/status x86 File opened for reading /proc/10/status x86 File opened for reading /proc/28/status x86 File opened for reading /proc/29/status x86 File opened for reading /proc/1147/status x86 File opened for reading /proc/7/status x86 File opened for reading /proc/20/status x86