e47e9bfa8d3e71d7a70a830292c92cd504b1c340e91c51a4384a67f0a0f352d9

Analysis

max time kernel
148s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12/10/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x86_64.elf
Size 122KB
Sample261012-lvl1csbc86
SHA256 e47e9bfa8d3e71d7a70a830292c92cd504b1c340e91c51a4384a67f0a0f352d9
MD5 ba290935088e82a64d67d07c57a0d6be
SHA1 8543f26357d0fc0dd40d85f76550a5780e704700
SHA512 0e85f022d9e6f87596148d7dce226160cf1de7f2419c11c97adcd0d8deb1e9744d32ca5876ebfa114091a3de49ac2a0e65f5103ebe3b090dd13c4e73710200d9
SSDEEP 3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BAz1upmzQUAdojgaR/oN:eH3TghM/1weZbcnITeyosFAIxnJdhgJH
TLSH
T1ABC32802F98184FDC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	x86_64.elf
File opened for modification	/dev/watchdog	x86_64.elf

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	x86_64.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	WnKdnmEzvsheopBsV	1484	x86_64.elf

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	x86_64.elf

/tmp/x86_64.elf
/tmp/x86_64.elf
1⤵
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Changes its process name
- Reads system network configuration
PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads