Analysis
- max time kernel
146s - max time network
138s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
26/08/2026, 15:46
Behavioral task
behavioral1
Sample
system_x86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target system_x86.elf
- Size 50KB
- Sample260826-s7tpasfp21
- SHA256 69a491b3693ffef078bb4f0683e2291a15185b349316b15c6f3d532b19ba1fa8
- MD5 918eb1d2d763c5f7ac2fff9d1b0dde08
- SHA1 1316a24b78bf04ee27efe03ae927aff0efe79a12
- SHA512 a1a4ede21f80cf4daaf19b276113ff2bf191fab2ee376155a144e9999b81eaa0602549bc7e96a547bcdc9f6e4f1be402881344e7535ead9e4c87dbe646a077d0
- SSDEEP 1536:Vveu7fOHSpK49CrV5gd2oZeUiov96qBniAinouy8oY:7SoK/rV5gPZ6e96qBniA6outoY
- TLSH T15033F171D2BAEF14D1A96474452C7C0B2C20D0CED34A9FE64FE86896F829F5B7928349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Contacts a large (1034) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog system_x86.elf File opened for modification /dev/misc/watchdog system_x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself [kworker/0:0] 1475 system_x86.elf Changes the process name, possibly in an attempt to hide itself 1475 system_x86.elf Changes the process name, possibly in an attempt to hide itself systemd 1475 system_x86.elf -
description ioc Process File opened for reading /proc/2175/exe system_x86.elf File opened for reading /proc/6290/cmdline system_x86.elf File opened for reading /proc/10263/net/tcp system_x86.elf File opened for reading /proc/11554/net/tcp system_x86.elf File opened for reading /proc/18922/stat system_x86.elf File opened for reading /proc/18952/exe system_x86.elf File opened for reading /proc/18955/net/tcp system_x86.elf File opened for reading /proc/4995/stat system_x86.elf File opened for reading /proc/6301/status system_x86.elf File opened for reading /proc/8863/net/tcp system_x86.elf File opened for reading /proc/10221/net/tcp system_x86.elf File opened for reading /proc/14345/net/tcp system_x86.elf File opened for reading /proc/17822/status system_x86.elf File opened for reading /proc/17885/stat system_x86.elf File opened for reading /proc/18980/stat system_x86.elf File opened for reading /proc/453/stat system_x86.elf File opened for reading /proc/1650/cmdline system_x86.elf File opened for reading /proc/2211/stat system_x86.elf File opened for reading /proc/8927/net/tcp system_x86.elf File opened for reading /proc/14258/cmdline system_x86.elf File opened for reading /proc/15699/net/tcp system_x86.elf File opened for reading /proc/16813/exe system_x86.elf File opened for reading /proc/1512/cmdline system_x86.elf File opened for reading /proc/1674/status system_x86.elf File opened for reading /proc/7614/status system_x86.elf File opened for reading /proc/15714/net/tcp system_x86.elf File opened for reading /proc/16814/cmdline system_x86.elf File opened for reading /proc/17895/net/tcp system_x86.elf File opened for reading /proc/7614/net/tcp system_x86.elf File opened for reading /proc/8922/net/tcp system_x86.elf File opened for reading /proc/11564/stat system_x86.elf File opened for reading /proc/12944/stat system_x86.elf File opened for reading /proc/18955/status system_x86.elf File opened for reading /proc/1478/cmdline system_x86.elf File opened for reading /proc/11547/cmdline system_x86.elf File opened for reading /proc/11564/exe system_x86.elf File opened for reading /proc/11569/net/tcp system_x86.elf File opened for reading /proc/14345/exe system_x86.elf File opened for reading /proc/484/exe system_x86.elf File opened for reading /proc/1478/status system_x86.elf File opened for reading /proc/1596/cmdline system_x86.elf File opened for reading /proc/250/stat system_x86.elf File opened for reading /proc/7649/stat system_x86.elf File opened for reading /proc/7651/exe system_x86.elf File opened for reading /proc/11555/status system_x86.elf File opened for reading /proc/16814/exe system_x86.elf File opened for reading /proc/17841/exe system_x86.elf File opened for reading /proc/15/cmdline system_x86.elf File opened for reading /proc/84/cmdline system_x86.elf File opened for reading /proc/596/cmdline system_x86.elf File opened for reading /proc/2175/stat system_x86.elf File opened for reading /proc/3656/exe system_x86.elf File opened for reading /proc/8915/status system_x86.elf File opened for reading /proc/10263/exe system_x86.elf File opened for reading /proc/14330/exe system_x86.elf File opened for reading /proc/475/exe system_x86.elf File opened for reading /proc/4994/net/tcp system_x86.elf File opened for reading /proc/6311/net/tcp system_x86.elf File opened for reading /proc/15742/status system_x86.elf File opened for reading /proc/17885/net/tcp system_x86.elf File opened for reading /proc/1529/status system_x86.elf File opened for reading /proc/7607/cmdline system_x86.elf File opened for reading /proc/12965/cmdline system_x86.elf File opened for reading /proc/16791/net/tcp system_x86.elf