Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
29/08/2026, 00:13
Behavioral task
behavioral1
Sample
Space.x86_64
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target Space.x86_64
- Size 36KB
- Sample260829-ah84ksvbpe
- SHA256 d7f70d9e7392593238179a17214420161b2b8fd8eca119521cbba82c9aae00cc
- MD5 aa1cdc9b4e8511e8d7b6412692cdf4a3
- SHA1 38bafbc97f191b223cfac08d15baf5d5b13a8296
- SHA512 8f552b645d4d7791b3f4326ba3dce19b5d31f81ad7976c8cb14f5783528ee97b3d5b9c00061554d8f11179560bd290d06d68dfd40e878934793a8e3bd2e312d3
- SSDEEP 768:7wS0nQr9tpJEu6+F2QKnEgWWX+sWF0tKsevFohLEdEUx0nZC:yOXU1WoZwYO1MZC
- TLSH T129F2E17063A9E8FCE43B6DBB45852F4C7DE3E0B9069E0B6A705CA0955DB7D813E125C0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
C2
-
37.49.230.40
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.x86_64 File opened for modification /dev/misc/watchdog Space.x86_64 - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.x86_64 File opened for modification /bin/watchdog Space.x86_64 -
description ioc Process File opened for reading /proc/566/status Space.x86_64 File opened for reading /proc/1192/status Space.x86_64 File opened for reading /proc/30/status Space.x86_64 File opened for reading /proc/35/status Space.x86_64 File opened for reading /proc/196/status Space.x86_64 File opened for reading /proc/1166/status Space.x86_64 File opened for reading /proc/1475/status Space.x86_64 File opened for reading /proc/6/status Space.x86_64 File opened for reading /proc/181/status Space.x86_64 File opened for reading /proc/191/status Space.x86_64 File opened for reading /proc/355/status Space.x86_64 File opened for reading /proc/1270/status Space.x86_64 File opened for reading /proc/1/status Space.x86_64 File opened for reading /proc/9/status Space.x86_64 File opened for reading /proc/19/status Space.x86_64 File opened for reading /proc/448/status Space.x86_64 File opened for reading /proc/472/status Space.x86_64 File opened for reading /proc/963/status Space.x86_64 File opened for reading /proc/1039/status Space.x86_64 File opened for reading /proc/1505/status Space.x86_64 File opened for reading /proc/21/status Space.x86_64 File opened for reading /proc/542/status Space.x86_64 File opened for reading /proc/1208/status Space.x86_64 File opened for reading /proc/13/status Space.x86_64 File opened for reading /proc/279/status Space.x86_64 File opened for reading /proc/449/status Space.x86_64 File opened for reading /proc/673/status Space.x86_64 File opened for reading /proc/1019/status Space.x86_64 File opened for reading /proc/1110/status Space.x86_64 File opened for reading /proc/1318/status Space.x86_64 File opened for reading /proc/86/status Space.x86_64 File opened for reading /proc/115/status Space.x86_64 File opened for reading /proc/505/status Space.x86_64 File opened for reading /proc/735/status Space.x86_64 File opened for reading /proc/1098/status Space.x86_64 File opened for reading /proc/1211/status Space.x86_64 File opened for reading /proc/483/status Space.x86_64 File opened for reading /proc/1112/status Space.x86_64 File opened for reading /proc/1344/status Space.x86_64 File opened for reading /proc/10/status Space.x86_64 File opened for reading /proc/36/status Space.x86_64 File opened for reading /proc/185/status Space.x86_64 File opened for reading /proc/464/status Space.x86_64 File opened for reading /proc/723/status Space.x86_64 File opened for reading /proc/999/status Space.x86_64 File opened for reading /proc/1119/status Space.x86_64 File opened for reading /proc/1287/status Space.x86_64 File opened for reading /proc/15/status Space.x86_64 File opened for reading /proc/178/status Space.x86_64 File opened for reading /proc/508/status Space.x86_64 File opened for reading /proc/4/status Space.x86_64 File opened for reading /proc/78/status Space.x86_64 File opened for reading /proc/179/status Space.x86_64 File opened for reading /proc/671/status Space.x86_64 File opened for reading /proc/1006/status Space.x86_64 File opened for reading /proc/1055/status Space.x86_64 File opened for reading /proc/695/status Space.x86_64 File opened for reading /proc/16/status Space.x86_64 File opened for reading /proc/25/status Space.x86_64 File opened for reading /proc/81/status Space.x86_64 File opened for reading /proc/177/status Space.x86_64 File opened for reading /proc/513/status Space.x86_64 File opened for reading /proc/518/status Space.x86_64 File opened for reading /proc/1177/status Space.x86_64