Analysis
- user interaction
yes - max time kernel
1s - max time network
7s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
26/08/2026, 16:38
Behavioral task
behavioral1
Sample
system_x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target system_x86
- Size 50KB
- Sample260826-t5pg8sseqg
- SHA256 69a491b3693ffef078bb4f0683e2291a15185b349316b15c6f3d532b19ba1fa8
- MD5 918eb1d2d763c5f7ac2fff9d1b0dde08
- SHA1 1316a24b78bf04ee27efe03ae927aff0efe79a12
- SHA512 a1a4ede21f80cf4daaf19b276113ff2bf191fab2ee376155a144e9999b81eaa0602549bc7e96a547bcdc9f6e4f1be402881344e7535ead9e4c87dbe646a077d0
- SSDEEP 1536:Vveu7fOHSpK49CrV5gd2oZeUiov96qBniAinouy8oY:7SoK/rV5gPZ6e96qBniA6outoY
- TLSH T15033F171D2BAEF14D1A96474452C7C0B2C20D0CED34A9FE64FE86896F829F5B7928349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog system_x86 File opened for modification /dev/watchdog system_x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 3 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself [kworker/0:0] 1495 system_x86 Changes the process name, possibly in an attempt to hide itself 1495 system_x86 Changes the process name, possibly in an attempt to hide itself systemd 1495 system_x86 -
description ioc Process File opened for reading /proc/19/cmdline system_x86 File opened for reading /proc/82/cmdline system_x86 File opened for reading /proc/492/cmdline system_x86 File opened for reading /proc/1491/cmdline system_x86 File opened for reading /proc/1492/cmdline system_x86 File opened for reading /proc/1506/cmdline system_x86 File opened for reading /proc/1520/net/tcp system_x86 File opened for reading /proc/13/cmdline system_x86 File opened for reading /proc/458/stat system_x86 File opened for reading /proc/710/exe system_x86 File opened for reading /proc/1493/cmdline system_x86 File opened for reading /proc/1528/net/tcp system_x86 File opened for reading /proc/1535/exe system_x86 File opened for reading /proc/458/cmdline system_x86 File opened for reading /proc/458/net/tcp system_x86 File opened for reading /proc/1522/status system_x86 File opened for reading /proc/79/cmdline system_x86 File opened for reading /proc/429/cmdline system_x86 File opened for reading /proc/1520/cmdline system_x86 File opened for reading /proc/194/cmdline system_x86 File opened for reading /proc/1275/exe system_x86 File opened for reading /proc/4/cmdline system_x86 File opened for reading /proc/22/cmdline system_x86 File opened for reading /proc/23/cmdline system_x86 File opened for reading /proc/89/cmdline system_x86 File opened for reading /proc/179/cmdline system_x86 File opened for reading /proc/181/cmdline system_x86 File opened for reading /proc/368/cmdline system_x86 File opened for reading /proc/1583/stat system_x86 File opened for reading /proc/84/cmdline system_x86 File opened for reading /proc/682/status system_x86 File opened for reading /proc/21/cmdline system_x86 File opened for reading /proc/616/exe system_x86 File opened for reading /proc/288/status system_x86 File opened for reading /proc/617/exe system_x86 File opened for reading /proc/1496/exe system_x86 File opened for reading /proc/1535/stat system_x86 File opened for reading /proc/182/cmdline system_x86 File opened for reading /proc/183/cmdline system_x86 File opened for reading /proc/444/exe system_x86 File opened for reading /proc/710/stat system_x86 File opened for reading /proc/1275/net/tcp system_x86 File opened for reading /proc/1502/exe system_x86 File opened for reading /proc/1526/cmdline system_x86 File opened for reading /proc/288/stat system_x86 File opened for reading /proc/1536/exe system_x86 File opened for reading /proc/185/cmdline system_x86 File opened for reading /proc/368/net/tcp system_x86 File opened for reading /proc/467/status system_x86 File opened for reading /proc/1506/status system_x86 File opened for reading /proc/1583/status system_x86 File opened for reading /proc/3/cmdline system_x86 File opened for reading /proc/15/cmdline system_x86 File opened for reading /proc/444/net/tcp system_x86 File opened for reading /proc/909/net/tcp system_x86 File opened for reading /proc/1536/net/tcp system_x86 File opened for reading /proc/26/cmdline system_x86 File opened for reading /proc/492/exe system_x86 File opened for reading /proc/1522/net/tcp system_x86 File opened for reading /proc/279/status system_x86 File opened for reading /proc/482/exe system_x86 File opened for reading /proc/1512/net/tcp system_x86 File opened for reading /proc/1520/status system_x86 File opened for reading /proc/1541/net/tcp system_x86