Analysis
- max time kernel
148s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
21/09/2026, 01:05
Behavioral task
behavioral1
Sample
Space.x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target Space.x86_64.elf
- Size 73KB
- Sample260921-bfpgtsfa27
- SHA256 b4cea7e82069bca6d19f51e04362b13adb9ada4d9564779bff961e936e11531d
- MD5 4b0c92d91bbb2543d3396e6938788a65
- SHA1 b7b48b258330321726e237038eccfa6e992790f8
- SHA512 7ae2f026e31a1b3881a16494f13e2d73e921a3ba5f19d3933cc4d795b5e67eefc2106184f78ba8266a71db5cedd4c0436e6071ad0ce2b11fa0e488ad3649d5bc
- SSDEEP 1536:DeuIZobG3QEWYAIb/+w4HnC+8l8Anzcf8:quIZTAEzAIf4HT8l8Azcf8
- TLSH T197733A17BA4080FEC899C43843BABA36DC7274FE1379725A17D4FE366D55E601E29C84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog Space.x86_64.elf File opened for modification /dev/misc/watchdog Space.x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog Space.x86_64.elf File opened for modification /bin/watchdog Space.x86_64.elf -
description ioc Process File opened for reading /proc/23/status Space.x86_64.elf File opened for reading /proc/79/status Space.x86_64.elf File opened for reading /proc/976/status Space.x86_64.elf File opened for reading /proc/1444/status Space.x86_64.elf File opened for reading /proc/84/status Space.x86_64.elf File opened for reading /proc/115/status Space.x86_64.elf File opened for reading /proc/167/status Space.x86_64.elf File opened for reading /proc/490/status Space.x86_64.elf File opened for reading /proc/535/status Space.x86_64.elf File opened for reading /proc/892/status Space.x86_64.elf File opened for reading /proc/952/status Space.x86_64.elf File opened for reading /proc/999/status Space.x86_64.elf File opened for reading /proc/28/status Space.x86_64.elf File opened for reading /proc/14/status Space.x86_64.elf File opened for reading /proc/17/status Space.x86_64.elf File opened for reading /proc/21/status Space.x86_64.elf File opened for reading /proc/26/status Space.x86_64.elf File opened for reading /proc/171/status Space.x86_64.elf File opened for reading /proc/956/status Space.x86_64.elf File opened for reading /proc/1044/status Space.x86_64.elf File opened for reading /proc/12/status Space.x86_64.elf File opened for reading /proc/27/status Space.x86_64.elf File opened for reading /proc/31/status Space.x86_64.elf File opened for reading /proc/86/status Space.x86_64.elf File opened for reading /proc/176/status Space.x86_64.elf File opened for reading /proc/1042/status Space.x86_64.elf File opened for reading /proc/1060/status Space.x86_64.elf File opened for reading /proc/1207/status Space.x86_64.elf File opened for reading /proc/24/status Space.x86_64.elf File opened for reading /proc/165/status Space.x86_64.elf File opened for reading /proc/532/status Space.x86_64.elf File opened for reading /proc/980/status Space.x86_64.elf File opened for reading /proc/1056/status Space.x86_64.elf File opened for reading /proc/30/status Space.x86_64.elf File opened for reading /proc/897/status Space.x86_64.elf File opened for reading /proc/1337/status Space.x86_64.elf File opened for reading /proc/1046/status Space.x86_64.elf File opened for reading /proc/1150/status Space.x86_64.elf File opened for reading /proc/1151/status Space.x86_64.elf File opened for reading /proc/201/status Space.x86_64.elf File opened for reading /proc/419/status Space.x86_64.elf File opened for reading /proc/919/status Space.x86_64.elf File opened for reading /proc/16/status Space.x86_64.elf File opened for reading /proc/80/status Space.x86_64.elf File opened for reading /proc/163/status Space.x86_64.elf File opened for reading /proc/678/status Space.x86_64.elf File opened for reading /proc/1038/status Space.x86_64.elf File opened for reading /proc/1180/status Space.x86_64.elf File opened for reading /proc/1182/status Space.x86_64.elf File opened for reading /proc/329/status Space.x86_64.elf File opened for reading /proc/960/status Space.x86_64.elf File opened for reading /proc/1034/status Space.x86_64.elf File opened for reading /proc/1078/status Space.x86_64.elf File opened for reading /proc/3/status Space.x86_64.elf File opened for reading /proc/173/status Space.x86_64.elf File opened for reading /proc/202/status Space.x86_64.elf File opened for reading /proc/442/status Space.x86_64.elf File opened for reading /proc/2/status Space.x86_64.elf File opened for reading /proc/7/status Space.x86_64.elf File opened for reading /proc/82/status Space.x86_64.elf File opened for reading /proc/268/status Space.x86_64.elf File opened for reading /proc/550/status Space.x86_64.elf File opened for reading /proc/989/status Space.x86_64.elf File opened for reading /proc/1067/status Space.x86_64.elf