Analysis
- max time kernel
148s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
01/10/2026, 11:40
Behavioral task
behavioral1
Sample
x86.elf
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
5 signatures
150 seconds
General
- Target x86.elf
- Size 34KB
- Sample261001-ns4thatwhy
- SHA256 a7d8a241c75fe5ea94a8804ca51d082e537ae5dc7b3f9358a0772a4a5775caff
- MD5 677dfa2f8f0f4d1ddd702d4d3dd19c14
- SHA1 e79be0afb57ed1b62ba8614e625f178417efbc00
- SHA512 c1f434c818614a68021bd0f59d28f8ce8dbe963ff530be51800a8e0bf027625deb8f2deb12efdc1ac019349d3a8b497975e820f1f087c9c718e3ba48a9149a40
- SSDEEP 768:OaWbW51wSwDF+l+6b7/sGmAd5RrOT1V/WAcnbcuyD7UHQRjA:OaAWrnwDFyhbpV5RKnBcnouy8Hyc
- TLSH T120F2F17695F48148C2BA913A06FB3F986538A3AF68120877D8DC14B6D041E30F718F97
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
mirai
Botnet
-
LZRD
C2
-
176.65.139.35
Signatures
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog x86.elf File opened for modification /dev/watchdog x86.elf - Enumerates running processes
Discovers information about currently running processes on the system
- Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog x86.elf File opened for modification /bin/watchdog x86.elf -
description ioc Process File opened for reading /proc/18/status x86.elf File opened for reading /proc/21/status x86.elf File opened for reading /proc/22/status x86.elf File opened for reading /proc/449/status x86.elf File opened for reading /proc/495/status x86.elf File opened for reading /proc/1031/status x86.elf File opened for reading /proc/1488/status x86.elf File opened for reading /proc/78/status x86.elf File opened for reading /proc/167/status x86.elf File opened for reading /proc/1091/status x86.elf File opened for reading /proc/1258/status x86.elf File opened for reading /proc/83/status x86.elf File opened for reading /proc/669/status x86.elf File opened for reading /proc/1480/status x86.elf File opened for reading /proc/1491/status x86.elf File opened for reading /proc/80/status x86.elf File opened for reading /proc/162/status x86.elf File opened for reading /proc/166/status x86.elf File opened for reading /proc/415/status x86.elf File opened for reading /proc/667/status x86.elf File opened for reading /proc/923/status x86.elf File opened for reading /proc/966/status x86.elf File opened for reading /proc/1165/status x86.elf File opened for reading /proc/28/status x86.elf File opened for reading /proc/416/status x86.elf File opened for reading /proc/455/status x86.elf File opened for reading /proc/484/status x86.elf File opened for reading /proc/948/status x86.elf File opened for reading /proc/1079/status x86.elf File opened for reading /proc/1503/status x86.elf File opened for reading /proc/9/status x86.elf File opened for reading /proc/20/status x86.elf File opened for reading /proc/27/status x86.elf File opened for reading /proc/32/status x86.elf File opened for reading /proc/159/status x86.elf File opened for reading /proc/506/status x86.elf File opened for reading /proc/1092/status x86.elf File opened for reading /proc/81/status x86.elf File opened for reading /proc/317/status x86.elf File opened for reading /proc/204/status x86.elf File opened for reading /proc/444/status x86.elf File opened for reading /proc/999/status x86.elf File opened for reading /proc/1303/status x86.elf File opened for reading /proc/82/status x86.elf File opened for reading /proc/909/status x86.elf File opened for reading /proc/1056/status x86.elf File opened for reading /proc/3/status x86.elf File opened for reading /proc/562/status x86.elf File opened for reading /proc/969/status x86.elf File opened for reading /proc/976/status x86.elf File opened for reading /proc/1178/status x86.elf File opened for reading /proc/1497/status x86.elf File opened for reading /proc/172/status x86.elf File opened for reading /proc/487/status x86.elf File opened for reading /proc/658/status x86.elf File opened for reading /proc/1074/status x86.elf File opened for reading /proc/1266/status x86.elf File opened for reading /proc/19/status x86.elf File opened for reading /proc/169/status x86.elf File opened for reading /proc/1455/status x86.elf File opened for reading /proc/25/status x86.elf File opened for reading /proc/13/status x86.elf File opened for reading /proc/84/status x86.elf File opened for reading /proc/203/status x86.elf