Analysis
- max time kernel
147s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/08/2026, 00:13
Behavioral task
behavioral1
Sample
Space.x86
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target Space.x86
- Size 34KB
- Sample260829-ah84ksvbpb
- SHA256 68de31e7ab680594337c3f74c8bef5cf993d2c7a49bc7ef4a029b483d8f337fc
- MD5 528284e78476ceaa5429509b463b3f2e
- SHA1 9c27a2b65289cdaea12e0e170d713b5f636efd21
- SHA512 7a054858eff2262f77c96bcc9ac9e20076d9b56f6fa687416df678470e91a58bf35f8c35bba35313316b7ffa96a19d720efb512cff25f20c5cb76e9c7a84f01d
- SSDEEP 768:ICkGi0D/4BfI7dZhttp96q7yYC6s2Lge3SzKoEBfBUfRQsGnbcuyD7UHQRj9:IBGbyq9ZL9MmAWfOqsGnouy8HyJ
- TLSH T142F2F1030A7A8F87807A50B79EDF379E4CD9CA115144C0E8CF94F836C8E5F6AAD5916E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
C2
-
37.49.230.40
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.x86 File opened for modification /dev/misc/watchdog Space.x86 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.x86 File opened for modification /bin/watchdog Space.x86 -
description ioc Process File opened for reading /proc/16/status Space.x86 File opened for reading /proc/449/status Space.x86 File opened for reading /proc/1090/status Space.x86 File opened for reading /proc/1297/status Space.x86 File opened for reading /proc/1333/status Space.x86 File opened for reading /proc/1480/status Space.x86 File opened for reading /proc/9/status Space.x86 File opened for reading /proc/31/status Space.x86 File opened for reading /proc/169/status Space.x86 File opened for reading /proc/487/status Space.x86 File opened for reading /proc/25/status Space.x86 File opened for reading /proc/160/status Space.x86 File opened for reading /proc/578/status Space.x86 File opened for reading /proc/29/status Space.x86 File opened for reading /proc/78/status Space.x86 File opened for reading /proc/79/status Space.x86 File opened for reading /proc/163/status Space.x86 File opened for reading /proc/497/status Space.x86 File opened for reading /proc/948/status Space.x86 File opened for reading /proc/1091/status Space.x86 File opened for reading /proc/1476/status Space.x86 File opened for reading /proc/8/status Space.x86 File opened for reading /proc/18/status Space.x86 File opened for reading /proc/722/status Space.x86 File opened for reading /proc/1034/status Space.x86 File opened for reading /proc/1066/status Space.x86 File opened for reading /proc/923/status Space.x86 File opened for reading /proc/158/status Space.x86 File opened for reading /proc/162/status Space.x86 File opened for reading /proc/17/status Space.x86 File opened for reading /proc/82/status Space.x86 File opened for reading /proc/168/status Space.x86 File opened for reading /proc/246/status Space.x86 File opened for reading /proc/901/status Space.x86 File opened for reading /proc/20/status Space.x86 File opened for reading /proc/551/status Space.x86 File opened for reading /proc/961/status Space.x86 File opened for reading /proc/967/status Space.x86 File opened for reading /proc/1089/status Space.x86 File opened for reading /proc/1092/status Space.x86 File opened for reading /proc/1149/status Space.x86 File opened for reading /proc/89/status Space.x86 File opened for reading /proc/559/status Space.x86 File opened for reading /proc/1030/status Space.x86 File opened for reading /proc/1047/status Space.x86 File opened for reading /proc/5/status Space.x86 File opened for reading /proc/324/status Space.x86 File opened for reading /proc/656/status Space.x86 File opened for reading /proc/1013/status Space.x86 File opened for reading /proc/1048/status Space.x86 File opened for reading /proc/1/status Space.x86 File opened for reading /proc/7/status Space.x86 File opened for reading /proc/170/status Space.x86 File opened for reading /proc/443/status Space.x86 File opened for reading /proc/985/status Space.x86 File opened for reading /proc/201/status Space.x86 File opened for reading /proc/481/status Space.x86 File opened for reading /proc/965/status Space.x86 File opened for reading /proc/1140/status Space.x86 File opened for reading /proc/482/status Space.x86 File opened for reading /proc/610/status Space.x86 File opened for reading /proc/19/status Space.x86 File opened for reading /proc/80/status Space.x86 File opened for reading /proc/172/status Space.x86