Analysis
- max time kernel
147s - max time network
148s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
01/10/2026, 11:40
Behavioral task
behavioral1
Sample
x86_64.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target x86_64.elf
- Size 36KB
- Sample261001-ns4thaba38
- SHA256 eeb4e7217972d1ea391859310759c9d58ae164ca0e1e68ba1e369df4c9d37a86
- MD5 5a48116ba60ffb5f7b9b69b6704a5ca0
- SHA1 a07df54bc22bf5ecbabb235679a71cf021952da3
- SHA512 34fbf351fe60e3decd588f720681e546d27e248e0c85d8f045e9c4b5f2d0d74753fb3e0362756abec57f486c85c740275c3000e5a5f32008d25b5fe403718c3f
- SSDEEP 768:kw2xI4Y3hW26uVyAHG+n+9zQmOauDNVFKg233aasx0K0:kw2xIz3hXVV679zQmPqrwg2SP0
- TLSH T1AAF2F173A37EFAE5D55DC3F10159A3CDF8B1781192232BB91CEA31B78C5A568F201A60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
C2
-
176.65.139.35
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog x86_64.elf File opened for modification /dev/misc/watchdog x86_64.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog x86_64.elf File opened for modification /bin/watchdog x86_64.elf -
description ioc Process File opened for reading /proc/28/status x86_64.elf File opened for reading /proc/12/status x86_64.elf File opened for reading /proc/16/status x86_64.elf File opened for reading /proc/79/status x86_64.elf File opened for reading /proc/267/status x86_64.elf File opened for reading /proc/402/status x86_64.elf File opened for reading /proc/481/status x86_64.elf File opened for reading /proc/916/status x86_64.elf File opened for reading /proc/158/status x86_64.elf File opened for reading /proc/160/status x86_64.elf File opened for reading /proc/468/status x86_64.elf File opened for reading /proc/472/status x86_64.elf File opened for reading /proc/1002/status x86_64.elf File opened for reading /proc/1013/status x86_64.elf File opened for reading /proc/1040/status x86_64.elf File opened for reading /proc/1072/status x86_64.elf File opened for reading /proc/11/status x86_64.elf File opened for reading /proc/169/status x86_64.elf File opened for reading /proc/972/status x86_64.elf File opened for reading /proc/1042/status x86_64.elf File opened for reading /proc/1207/status x86_64.elf File opened for reading /proc/81/status x86_64.elf File opened for reading /proc/591/status x86_64.elf File opened for reading /proc/1243/status x86_64.elf File opened for reading /proc/1480/status x86_64.elf File opened for reading /proc/130/status x86_64.elf File opened for reading /proc/166/status x86_64.elf File opened for reading /proc/1025/status x86_64.elf File opened for reading /proc/1082/status x86_64.elf File opened for reading /proc/1463/status x86_64.elf File opened for reading /proc/15/status x86_64.elf File opened for reading /proc/1070/status x86_64.elf File opened for reading /proc/175/status x86_64.elf File opened for reading /proc/421/status x86_64.elf File opened for reading /proc/590/status x86_64.elf File opened for reading /proc/649/status x86_64.elf File opened for reading /proc/1149/status x86_64.elf File opened for reading /proc/19/status x86_64.elf File opened for reading /proc/82/status x86_64.elf File opened for reading /proc/165/status x86_64.elf File opened for reading /proc/173/status x86_64.elf File opened for reading /proc/429/status x86_64.elf File opened for reading /proc/651/status x86_64.elf File opened for reading /proc/1317/status x86_64.elf File opened for reading /proc/17/status x86_64.elf File opened for reading /proc/23/status x86_64.elf File opened for reading /proc/29/status x86_64.elf File opened for reading /proc/89/status x86_64.elf File opened for reading /proc/168/status x86_64.elf File opened for reading /proc/423/status x86_64.elf File opened for reading /proc/474/status x86_64.elf File opened for reading /proc/894/status x86_64.elf File opened for reading /proc/1/status x86_64.elf File opened for reading /proc/9/status x86_64.elf File opened for reading /proc/83/status x86_64.elf File opened for reading /proc/316/status x86_64.elf File opened for reading /proc/647/status x86_64.elf File opened for reading /proc/416/status x86_64.elf File opened for reading /proc/480/status x86_64.elf File opened for reading /proc/949/status x86_64.elf File opened for reading /proc/1326/status x86_64.elf File opened for reading /proc/638/status x86_64.elf File opened for reading /proc/897/status x86_64.elf File opened for reading /proc/1017/status x86_64.elf